1Password launched 1Password for Agents on Thursday, October 22, 2026, a service that lets users authorize AI agents to log in to their personal accounts without the agent ever seeing their credentials, according to TechCrunch. The launch addresses a problem that has grown with each new personal agent: to act for someone, an agent often needs to sign in as them, and the simplest way to do that is to hand over a password.
How the flow works
TechCrunch describes the process in three steps:
| Step | What happens | Who sees the credential |
|---|---|---|
| 1. Identify | When an agent tries to log in for a user, it sends a unique digital key to 1Password to confirm its identity | Nobody; no password is involved yet |
| 2. Approve | The user receives an alert about the login attempt and can personally approve it | The user approves, not the agent |
| 3. Fill | After approval, 1Password signs the agent in by filling in the credentials on its behalf | 1Password; the agent receives a signed-in session |
1Password said that handing credentials to an agent can leave sensitive information where people "can no longer control" it, and described the product as "a trusted way to delegate tasks to personal AI agents while keeping control of the passwords". The launch article gives no pricing or detailed availability terms.
Which agents it supports
TechCrunch names Anthropic's Claude Duet, OpenAI's Dots and ChatGPT Work, Grok Bot, Meta's Muse, and agents from Town, with 1Password saying it is working with other companies to expand the service. Several of these agents are covered in our recent posts, including Claude Duet and Town's Series B.
OpenAI
Anthropic
Grok
MetaThree ways to let an agent act as you
The product is easiest to understand next to the alternatives. This comparison is our analysis, not 1Password's.
| Model | How it works | Main risk |
|---|---|---|
| Share the password | The user gives the agent a username and password, often in a chat or settings field | The secret enters the agent's context and logs; a prompt injection or leak can expose it |
| Scoped token (OAuth) | The service issues a limited token for specific actions | Only available where the service supports it; many consumer sites do not |
| Brokered sign-in | A vault authenticates on the agent's behalf after approval, and the agent receives only a session | Depends on the vault, the approval prompt and what the session is allowed to do |
1Password for Agents falls in the third category. Its value is clearest where a service offers no token system, which describes much of the consumer web. The design also keeps the secret out of the model's context, which matters because agents read web pages and documents that can contain malicious instructions, a risk we examined in AI agent memory poisoning and prompt injection.
The agent proves who it is, the person approves what it does, and the vault handles the secret. Each party only holds what it needs.
The bank problem the launch is arriving into
TechCrunch notes the launch coincided with an Axios report that US banks have begun detecting agentic activity in user accounts, and that most banks cannot tell whether that activity follows user requests. Bankers interviewed described the situation as "horrifying", and a Chase spokesperson said customers "should not give their usernames and passwords to anyone."
Security vendors are working on the same gap from the other side. BioCatch says most banks cannot yet answer whether a session is the customer, their agent or something else, and Incognia launched an AI agent detection product for financial institutions in October 2026 that separately checks whether an agent is legitimate and whether the customer authorised the specific action. Its first version is read-only, so enforcement stays under human control.
This points to an unresolved tension. A brokered sign-in improves the user's side, since the password never reaches the agent. It does not by itself tell the bank that the login was authorised, and banks' terms of service may still prohibit sharing access. Whether institutions will treat an approved, vault-mediated agent session differently from a shared password is an open question, and the launch coverage does not say that any bank has agreed to.
For context on where institutions are drawing lines, see how JPMorgan, Schwab and Block are handling agents that move customer money, where read-only access was the common pattern.
Analysis: what to look for in any agent credential design
Whether an organisation uses this product or another, five questions separate strong designs from weak ones:
- Does the secret ever enter model context? Anything the model sees can be exposed by injection or logging.
- Is approval per action, per site, or standing? Standing approval widens what a hijacked agent can do.
- What does the session allow? A login that can move money differs from one that can read a balance.
- Is there an audit trail? Users and services need a record of which agent did what and when.
- Can access be revoked quickly? The ConnectWise incident we covered in our analysis of the Storm-0940 breach shows how long tokens can outlive a disabled app.
Workspaces that run agents for their users face the same design choices. Metir, for example, keeps stored logins in an encrypted vault and redacts secrets from what the model sees, which reflects the same principle of separating the credential from the agent. No design removes the need for the user to understand what they are approving.
What to watch next
- Pricing and availability. Neither is stated in the launch coverage.
- Which services accept brokered agent logins. Adoption depends on sites and banks permitting it.
- Bank policy. Whether any institution formally recognises vault-mediated agent sessions.
- Standards. Whether agent identity keys become interoperable across vaults, as discussed in AI agent interoperability standards.
Sources:
- 1Password launches a way for AI agents to log in on your behalf without seeing your password (TechCrunch)
- Is that your customer, their agent, or someone or something else? (BioCatch)
- Incognia launches AI agent detection for financial institutions (The Paypers)
Image credits
- Hero and in-body image: "1Password for Windows screenshot 01 Lock screen.png" by AgileBits, public domain, via Wikimedia Commons. Pulled 2026-10-23 and reviewed visually before use.