1Password lets AI agents use saved credentials without seeing them

When an agent reaches a sign-in form, it uses a unique digital key to identify itself to 1Password.[1] The user can see which credential the agent requests and why, then decide whether to approve access on their own device.[1] If approved, 1Password fills the credential directly into the sign-in form instead of sending it to the agent.[1] 1Password says the agent can continue its task after signing in while the password remains protected in the vault.[1] Connecting an agent does not give it access to everything in the vault.[2]

1Password says the service is available at no additional cost to Individual and Family account holders on 1Password.com.[4] Accounts on 1Password.eu and 1Password.ca are not currently supported.[4] Integrations are rolling out over the coming days across platforms, and 1Password says its integrations can autofill one-time codes as well as passwords.[2][4] The Verge’s quoted list includes Meta Muse, ChatGPT Work and Dots, Claude Duet, Grok Bot, and Town.[3] 1Password says it is developing additional integrations with Browserbase, Browser Use, Dana, Instinct, Kernel, Perplexity, Ramp, Tomo, and Wajo.[4]

The design aims to avoid handing credentials directly to an AI model: 1Password says the integration gives agents access to saved accounts without exposing sensitive credentials to the model.[1] But keeping a password in the vault does not eliminate what an agent can do once signed in.[1][2] 1Password cautions that an agent may see information or take actions inside an account after logging in.[2] Users can disconnect an agent integration at any time.[4] That makes the scope of the signed-in account an important consideration alongside the credential approval.

1Password frames the platform as an alternative to giving an agent a credential and hoping for the best.[1] Its examples include Claude Duet asking before signing in, with 1Password saying it will soon complete sign-ins using saved passwords.[1] The launch comes as U.S. banks have begun detecting agentic activity inside user accounts, according to TechCrunch; bankers interviewed by the outlet described the situation as “horrifying.”[5] A spokesperson said customers should not give their usernames and passwords to anyone.[5] Those concerns make the distinction between credential access and activity inside an account especially relevant.