Credential stuffing
Also called password reuse attack
Trying usernames and passwords leaked from one site on many other sites, automatically, to break into accounts where people reused them.
Billions of email and password pairs have leaked from breached sites over the years. Credential stuffing takes those lists and tries each pair on other popular sites, at machine speed. It doesn't need to be clever: if you used the same password on a forum that leaked and on your email, the lock opens.
Websites fight back with rate limits and checks designed to spot bots, which is where AI changes the picture. Security researchers at Push Security showed that agent tools able to use a browser like a person, such as OpenAI's Operator, could run these attempts with no custom code, looking far more human than old-style bots.
The defence is entirely in your hands: a different password everywhere, kept in a password manager, or no password at all with a passkey.
For example
An old forum leaks your email and password; a week later someone logs into your shopping account with the same pair.
Put it to use
Where you'll meet credential stuffing in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.