The Bot Left a Fingerprint: Detecting and Attributing LLM-Generated Passwords

In February 2026, researchers at Irregular explored the predictability of passwords generated by Large Language Models (LLMs) and discovered that these passwords often follow notable patterns, making them less secure. The research extended previous analyses by increasing the scope to 40 LLM models from 11 providers, generating 8,000 passwords to examine statistical biases. They confirmed that LLM-generated passwords are not only biased but also exhibit specific patterns and common substrings, compromising their security. By employing Markov chains, the study was able to classify LLM-generated passwords and identify their models or providers with moderate success. A further investigation of 34 million passwords found that LLM-generated passwords are being used in the wild, particularly in configuration files, albeit not prevalently. The study highlighted potential security risks, emphasizing the need for secure password management practices and the avoidance of LLMs for password generation, while also outlining defensive strategies involving tools like GitGuard's ggshield to mitigate risks associated with AI-generated passwords.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.