1Password launched 1Password for Agents on Thursday, a platform that lets personal AI agents sign in to a user’s accounts and finish tasks without the agent or the model behind it, ever receiving the credential.
The Toronto identity-security company announced the platform at 9:00 a.m. EDT on October 22 with five rival agent makers already attached: Meta’s Muse, Anthropic’s Claude Duet, OpenAI’s ChatGPT Work and dots, SpaceXSI’s Grok Bot, and Town’s Townie. It is included at no extra cost with 1Password Individual and Families plans, with a waitlist for most integrations.
The problem it targets is a shortcut users are already taking. Pasting a password into a chat window leaves a copy somewhere the user no longer controls, 1Password said, and that copy persists for the next time the agent needs it.
How it works?
Instead of handing over the secret, the agent proves its own identity to 1Password with a unique digital key when it hits a login form. The user is shown which credential is being requested and why, and approves or denies it on their own device. 1Password then fills the password and any one-time code directly into the page and strips it once the site accepts the login.
The handshake, step by step
| Step | Actor | What happens | What the agent sees |
|---|---|---|---|
| 01 | AI agent | Hits a login wall and requests the credential, verifying its identity to 1Password with a unique digital key | That a request was made |
| 02 | User | Sees which credential is wanted and why; approves or denies on their own device | Nothing until approval |
| 03 | 1Password | Fills the password and any one-time code straight into the sign-in form | That access was granted |
| 04 | 1Password | Removes the credential once the site accepts the login | An authenticated session |
Source: 1Password press release and product documentation, October 22, 2026.
The model behaves more like a two-factor prompt than a shared password. Each integration is opt-in, and connecting one agent does not expose the rest of the vault.
An agent should be able to do the job it’s been asked to do without getting permanent access to everything behind the account.
Aashish Tripathi, Chief Product Officer, 1Password
Who signed on?
Launch integrations
| Agent | Company | Status |
|---|---|---|
| Muse | Meta | Rolling out across platforms in the days after launch |
| Claude Duet | Anthropic | 1Password completes sign-ins Duet requests inside existing work tools |
| ChatGPT Work, dots | OpenAI | Users approve each sign-in; credentials stay out of the model |
| Grok Bot | SpaceXSI | AI teammates using approved logins across tools and inboxes |
| Townie | Town | Employees approve the logins a Townie needs to keep working |
Nine further partners were named as building integrations, including Browserbase, Perplexity, Ramp and Browser Use.
Launched against the tide
The timing is pointed. Axios reported the same day that US banks have begun detecting agentic activity inside customer accounts, mostly consumers delegating tasks, not rogue software, and that banks largely cannot tell which sessions a customer actually authorised. A Chase spokesperson’s advice to the outlet was that customers should not give their username and password to anyone.
Financial sector response, autumn 2026
| Date | Institution | Action |
|---|---|---|
| Oct 13 | JPMorgan Chase | Jamie Dimon declares a ban on external AI agents operating retail customer accounts |
| Oct 16 | Bank of America | Announces restrictions on AI agent access to customer accounts |
| Oct 2026 | Citi | Restricts AI agents from accessing customer accounts, per the Financial Times |
| Oct 22 | 1Password | Launches a mechanism for agents to authenticate without holding the credential |
Compiled from Axios, CNBC, the Financial Times and Business Insider reporting.
What it does not fix?
Hiding the password does not make the agent careful. Once the user approves, the agent is inside the account, and prompt injection remains unsolved: a malicious page can push an agent into requesting access the user never intended or taking unintended actions after sign-in. Security firm Zenity demonstrated exactly that against an agentic browser in March, walking an agent through a vault to exfiltrate secrets.
1Password has not claimed otherwise. The architecture shrinks the blast radius from an unbounded credential leak to a bounded session, a real improvement, and an incomplete one.
The launch extends work the company began with Secure Agentic Autofill and Browserbase in October 2025, and 1Password for Claude on Mac in July. 1Password last disclosed annual recurring revenue above $400 million in November 2025, with more than three-quarters of it from business customers.
Olivia Bennett is a technology writer at TechJox with over 8 years of experience creating detailed how-to guides, software tutorials, troubleshooting articles, and step-by-step walkthroughs. She specializes in Windows, Android, iOS, AI tools, software applications, browser settings, and everyday tech solutions. Her expertise includes simplifying technical processes, resolving common software issues, and explaining digital tools through practical, beginner-friendly instructions. Olivia focuses on making technology easier to navigate, helping readers solve problems confidently and get the most out of their devices and applications.
Discussion (0)
You need a free TechJox account to join the discussion and report scams you spot.