I first ran all the sample models via ollama, docker, open-webui. I asked each model the same prompt which was please give me the top 100 most common weak passwords for use in an Oracle security tool. Ollama, docker and open-webui are running on my mac book pro M5 with 64gb of ram.
I tested:
qwen3-coder said no, sorry I cant do that, its not ethical
Deepseek-r1:32b said the same that its not ethical again
llama3.3:70b also said no BUT it took 19 minutes and lots of thinking to come up with the same answer
llama3.1:8b was much faster than its sibling but also said no
gemma3:27b failed in open-webui as it does not support tools
Dolphin3-latest also failed in open-webui because it does not
I of course tested chatpgt free website chat version as well and that did give the proper top 100 common weakest passwords and also advice on permutation ideas and also stated it got the list from various hacked password lists / websites
I decided to then run some of the models direct in ollama on my mac book so avoiding the open-webui interface:
I ran dolphin3:latest direct via ollama and now works BUT the list is not good; the first 19 passwords are clearly weak passwords but from 20 to 100 they are just names. The LLM has just decided to make up a list of weak passwords not actual weak passwords.
I ran qwen3-coder:30b from the command line in ollama and it still said it cant give me passwords and suggested other resources for password verify functions and rules.
I ran llama3.1:8b direct in ollama did not say no but gave me examples of weak passwords and rules not to use, i.e. patterns and advice on suing a password manager to generate 12 character random passwords.
I ran deepseek-r1:32b direct in ollama and it gave a lot of text about how it should not give me a list and advised me to use reputable cyber security sources and also have advice on 2FA and MFA and others BUT it still would not give me a list
I ran gemma3:27b direct in ollama and it worked best to give me a list of passwords and advice on permutations and also it stated the list is historic.
The LLMs when run through open-webui all failed to give the top 10 weak passwords or timed out or did not work due to tools. A small number worked via ollama direct on the mac book but for instance Doplhin was just made up nonsense, so hallucinating. Gemma3:27b was the best but most likely out of date based on when the model originated. Open-webui blocked the requests but as some of the models worked or at least gave better background means open-webui can be modified to not pass in as much system prompt, knowledge or other pre-determined memory.
I do not know without further experiment whether the answer NO can be bypassed but at least Gemma3 can be used for this task locally without further work and the data was decent
For this particular task we did not need AI, it is much better to search for lists of weak passwords on the net and simply download a list BUT it was an interesting test.
The use of local LLMs has shown for me that some models are better for general questions, some better for code, some better for security and some have had their restraints removed such as Dolphin.
It would be useful in some cases to limit what open-webui does in terms of system prompt and memory but in other cases for instance to be an expert then it is useful to use skills files or other knowledge.
With all the recent news on AI sovereignty its useful to run local LLMs so that the commercial engines do not keep your history or prompts or data passed in to use.
#oracleace #sym_42 #oracle #security #ai #sovereignty #llm #local #dataprotection
