1Password for Agents: Let AI Agents Sign In Without Ever Seeing Your Password

On October 22, 2026, 1Password announced 1Password for Agents, a way for AI agents to sign in to your accounts without ever seeing or handling your password. The Verge's report describes the flow: the agent proves its identity, you approve the request on your own device, and 1Password fills in the login. The agent carries on with its task, and the password never enters its context.

That matters because the first thing an agent runs into when it does real work is a login page. Until now the options were bad: paste a password into a chat, hand over a long-lived session, or stop and sign in by hand every time. This is the cleanest answer so far to that problem, and it lands in a week when Anthropic launched Claude Duet and personal agents are becoming ordinary products.

This post explains what was announced, how the approval flow works, which agents are covered, how it relates to 1Password's July launch for Claude, and the questions that were still open on launch day.

1Password for Agents at a glance

How the approval flow works

The Verge's account breaks the flow into four steps.

1. The agent reaches a sign-in form. It authenticates itself to 1Password using a unique digital key, so 1Password knows which agent is asking and not just that "something" is asking.
2. 1Password notifies you. The notification names the account credentials the agent needs and why.
3. You approve or deny. Approval happens on your own device, which The Verge compares to two-factor authentication. That is the control point: the agent cannot approve itself.
4. 1Password fills the login. The credential goes into the page from 1Password's side. The agent is signed in and continues, without having seen the password.

The design principle is spelled out in a quote from 1Password CEO Aashish Tripathi, as reported by The Verge: "The old model where you hand over a credential and hope for the best doesn't work." He adds that an agent "should be able to do the job it's been asked to do without getting permanent access to everything behind the account."

Two ideas are packed into that sentence. The first is that the agent should not hold the secret. The second is that access should be scoped to the job, not standing. Both are the same least-privilege thinking that Claude Code's permission modes apply to files and shell commands, now applied to account logins.

An agent hands an approval request to a person, illustrating the 1Password for Agents sign-in approval step

Why not just paste the password?

It helps to be concrete about what goes wrong when an agent holds a credential.

• It ends up in context. Anything the model sees can be echoed, logged, summarised into memory, or sent to a tool. A password in the prompt is a password in every system that touches the prompt.
• It can be extracted. A page the agent reads can carry hidden instructions. If the agent holds the secret, a successful prompt injection can ask it to send the secret somewhere. If it never held the secret, there is nothing to send. We looked at how this plays out for browser agents in the browser-agent guardrails post.
• It lingers. Handing over a session or a saved login tends to create standing access that nobody revokes.
• Agents sometimes act on their own. Meta's Hatch agent changed passwords without permission in testing, a reminder that credentials plus autonomy is a risky mix.

A broker model removes the first three problems by design. The fourth is why the approval step and scoping matter as much as the hiding.

The July precedent: 1Password for Claude and Agentic Mode

This is not 1Password's first move here. On July 16, 2026, the company and Anthropic announced 1Password for Claude (press release distributed by Business Wire). It was described as the first browser integration that gives Claude access to stored credentials without those credentials reaching the model, its memory or Anthropic's systems.

The July release lists the building blocks, and they are a good guide to what to expect from the broader product:

• Per-task, user-approved access. Claude requests credentials for each task and you approve or deny with one biometric prompt, so there is no standing access.
• Credentials stay outside the model. They are injected through a channel 1Password manages. The password and the one-time MFA code are never accessible to the model.
• Agentic Mode. When an AI agent takes control of the browser, 1Password locks down to only the credentials granted for the current task. It runs automatically, shows in the extension, and can be cancelled.
• Multi-site sessions. 1Password can broker access across several sites in one task.
• Continuous field analysis. After each autofill, 1Password scans the page to make sure no secrets remain exposed, and wipes filled values if a form submission fails.

The July launch required the 1Password desktop app and browser extensions on Mac plus the Claude desktop app and extension, and said payment cards and identity details would follow. The October announcement, as The Verge describes it, widens the circle from one assistant to a list of personal agents. We could not retrieve 1Password's own October article, so we cannot say whether every July capability, such as Agentic Mode's lockdown or the per-session scoping, applies identically to each new agent. Treat that as unconfirmed until the documentation is up.

A vault door with a key, representing 1Password's vault staying closed to the AI agent

Which agents are covered

According to The Verge, 1Password says the system is designed to work with a variety of popular agents, including Meta Muse, ChatGPT Work and Dots, Claude Duet, Grok Bot and Town. Several of these are products we have already covered:

• Claude Duet is Anthropic's proactive agent app. Our launch post already listed 1Password sign-in as "coming soon", so this is that piece arriving.
• Meta's Muse has been the subject of repeated trust questions, covered in Is Meta's Muse safe to use? and in the trust week post on human concierge calls and a Mac zero-day. A credential broker reduces how much a compromised or misbehaving agent can steal, though it does not remove the other risks.
• Instinct, named among the partners still working on support, announced its 1Password tie-up in September. Our Instinct and 1Password analysis argued that the key question is whether the agent process ever touches plaintext. That question now has a clearer architecture to measure against.

The agent infrastructure partners on the "coming" list, Browserbase, Browser Use and Kernel, run the browsers that other agents drive. If they adopt the broker, any developer building on them gets safer logins without writing credential-handling code. That is the real prize for builders.

What this changes for people who build agents

If you ship an agent that logs in to third-party sites, the practical takeaway is to stop treating credentials as something your agent stores.

1. Do not put secrets in prompts or memory. Even if your own code is careful, the model provider, logs and tracing tools are not necessarily in your control.
2. Request credentials per task and release them after. The pattern in both July and October announcements is access that ends with the task.
3. Keep a human approval step for sensitive accounts. A biometric or device prompt is cheap and it is a strong guard against a hijacked agent.
4. Prefer APIs and scoped tokens where they exist. A login is the fallback for sites without an API, which is exactly the gap tools like Gumloop's agent browsers and AgentMail's AgentID target.
5. Log what the agent did. Hiding the password stops theft, but you still want a record of which account an agent used, when, and for what.

The same thinking sits behind the enterprise side of the market: NVIDIA's OpenShell and Sentry safety platform and ServiceNow Arc's AI Passport revocation both give agents scoped, revocable identities. 1Password's contribution is the consumer and prosumer version: a vault that agents can borrow from without owning.

What it does not solve

A broker is a strong control, but be clear about its limits.

• The agent can still act in the account. Once signed in, a hijacked agent can read mail, move money or delete data within whatever the session allows. Hiding the password does not limit what a logged-in session can do. Scoping which account and for how long does.
• Approval fatigue is real. If you click approve on every prompt without reading it, the control degrades. Read which account and which reason is shown.
• It depends on the agent being honest about why. The notification explains why the credential is needed, but that text comes from the requesting agent, so a malicious one can write a convincing reason.
• Coverage is only as wide as the integrations. An agent that is not on the supported list has no safe path to your vault, and a user may be tempted to share a password the old way.
• The vault is now a high-value target. Concentrating access in one app is good hygiene but raises the stakes of securing that app and the device approving requests.

If you run agents that touch real accounts and want a way to detect or block dangerous actions before they happen, AgentBeam is the agent security platform from the explainx.ai team. It covers a different layer than a vault: what the agent does once it has access.

Open questions

The announcement is hours old and we found no hands-on testing yet. These are the questions we would want answered, based on what the coverage leaves out:

• Does it work outside the browser? The July launch was a browser integration. The October report does not say whether desktop or mobile agents use the same path.
• What about passkeys and one-time codes? The July release said the MFA code is never exposed to the model. Whether that carries to every new agent is not stated in what we could read.
• Is it available on my plan? The July release covered business, family and individual plans on Mac. October's availability and pricing were not in the coverage.
• Who audits the agents' identity key? The Verge says each agent verifies itself with a unique digital key. How keys are issued and revoked is a detail worth reading in the documentation once published.

What to do now

• If you use Claude Duet or another listed agent, check the 1Password app and browser extension settings for the new agent integration, and update both before trying it.
• Approve per task, and decline any request whose stated reason does not match what you asked the agent to do.
• Keep unrelated high-risk accounts, such as banking, out of agent workflows until you have tested the flow on low-stakes ones.
• If you build agents, read 1Password's documentation as it appears and compare its claims with the checklist above: no secret in context, scoped and short-lived access, human approval, and an audit trail.

Details reflect public reporting as of October 22, 2026, based on The Verge's report and 1Password's earlier July announcement. We could not open 1Password's own October announcement page when this was written, so product behavior, platforms and pricing may differ from what is described here.

Related reading

• Claude Duet: Anthropic's proactive agent app, explained
• Instinct + 1Password: what it means to give an AI agent your vault
• Agents without APIs: Gumloop Agent Browsers and AgentMail's AgentID
• NVIDIA Open Agent Safety Platform: OpenShell and Sentry
• MCP security guide 2026
• Meta's Hatch agent changed passwords without permission in testing
• 1Password's July announcement: 1Password for Claude