1Password launched 1Password for Agents on Oct. 22, a service that lets personal AI agents sign in to websites for a customer without ever receiving the password. The agent proves its identity with a unique digital key, the customer approves the request on a personal device, and 1Password then fills the credential directly into the sign-in form.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Launch partners include Meta’s Muse, Anthropic’s Claude Duet, OpenAI’s ChatGPT Work and dots, Grok Bot and Town’s Townie. The release arrives as banks report that agents are already acting inside customer accounts, often after being handed a username and password.
How 1Password for Agents keeps the password out of the agent
As laid out in the company’s launch announcement, the sequence has five steps. The agent verifies itself to 1Password with its key. When it reaches a sign-in form, the person sees which credential is needed and why. The person approves or declines on their own device. 1Password fills the credential straight into the form, and the agent carries on with the task while the password stays in the vault.
The design targets what 1Password calls a common shortcut, in which a user pastes a password or secret into an agent so it can finish a chore. TechCrunch’s report, by Lucas Ropek, quotes the company describing the product as a trusted way to delegate tasks to personal AI agents, and notes that the customer can personally confirm each request.
What the partners and executives say
Aashish Tripathi, 1Password’s chief product officer, said in the announcement that the old approach of handing over a credential and hoping for the best no longer works. John Torrey, the chief business officer, said that reaching a large number of people takes the industry working together to build agents that can be trusted.
Partner executives framed the feature in the same terms. Anthropic chief product officer Ami Vora said, “Claude Duet asks before it signs in anywhere.” Glen Coates, OpenAI’s head of app platform, said the integration allows access without exposing sensitive credentials to the model. Tido Carriero of SpaceXSI, which makes Grok Bot, said users can have the agent sign in without sharing or pasting passwords, and Town chief executive Jean-Denis Greze said the approach lets security teams say yes while people hand off more of their work.
The announcement also lists Browserbase, Browser Use, Dana, Instinct, KERNEL, Perplexity, Ramp, Tomo and Wajo as partners, and says more integrations are coming. Neither the announcement nor TechCrunch gives pricing, plan tiers or regional availability, so who can use it and at what cost remains unstated. The announcement points readers to 1Password’s website and blog for details on which integrations are available, which suggests the rollout will vary by agent.
A pattern 1Password started with Claude in July
The launch extends an approach the company introduced earlier. In July, 1Password announced a beta integration for Claude, which PYMNTS described as letting the assistant finish tasks that need passwords or authentication codes without the credentials reaching the model. The user approves with a fingerprint, access ends when the task ends, and 1Password checks that no sensitive data was left exposed on the page after filling a login.
Nancy Wang, 1Password’s chief technology officer, framed the principle in that earlier announcement as letting a user give an agent permission to use a credential without letting the agent see it. The October product widens that pattern from one assistant to a roster of agents from several companies. PYMNTS also noted that researchers had recently shown AI browser tools can be tricked into leaking credentials through prompt injection, the threat this design is meant to blunt.
For developers, 1Password’s documentation index describes related tools that keep secrets from agents, such as stand-in values for sandboxed coding agents, secrets that are not returned to an MCP client, and fingerprint prompts for command-line tools. They address coding workflows rather than personal accounts, but they rest on the same idea of keeping the secret out of the model’s reach.
The bank problem the launch lands in
Banks supply the strongest argument for the idea. Axios reported on the day of the launch that major U.S. banks are detecting third-party agents operating inside customer accounts, sometimes without the customer’s instruction. Axios said agents often log in with a customer’s credentials and permission, which conflicts with rules at most banks that humans sign in to their own accounts.
Morgan Stanley has begun blocking third-party agents, and JPMorgan, Bank of America and Citi are restricting them, while many banks cannot tell whether activity is user-directed. A Chase spokesperson told Axios that customers “should not give their usernames and passwords to anyone.” A scheme in which the agent never holds the password does not settle whether a bank will accept the agent, but it removes one objection: the secret is no longer sitting in the agent’s context where a prompt-injection attack could extract it.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
- Long use of a common prostate pill is tied to a higher chance of glaucoma
- Ford is recalling 223,472 F-150 pickups because the fuel tank can leak or detach
- Hybrids have 15% fewer problems than gas cars, while EVs and plug-in hybrids have about 80% more, Consumer Reports finds
