1Password launches agent login tool that keeps passwords hidden

The platform creates a communication chain among the agent, the user and the password manager, according to TechCrunch. When an agent attempts to log in for a user, a unique digital key is sent to 1Password to confirm the agent's digital identity. The user then receives an alert and must personally confirm the request. 1Password signs in the agent and fills in credentials on the digital assistant's behalf, allowing it to log in and complete the task at hand.

Android Authority reported that when an agent reaches a login screen, 1Password for Agents autofills the password or one-time code so the agent cannot see or take possession of the credentials. The service is designed to work with a range of AI agents, the report said.

The two reports differed on which agents are available at launch. TechCrunch reported that users can choose agents including Anthropic's Claude Duet, OpenAI's Dots or ChatGPT Work, Grok Bot, Meta's Muse, and agents from the AI assistant startup Town, and that 1Password is working with other companies to expand the service. Android Authority reported that the service will work with Muse and Grok, with more connections expected later, including Claude Duet, ChatGPT Work, Dots and Perplexity.

In a blog post, 1Password said handing over a password, secret or credential is a common shortcut for an agent but can leave sensitive information in places users can no longer control because a copy can be saved for next time. The company said 1Password for Agents gives people a trusted way to delegate tasks to personal AI agents while keeping control of the passwords, secrets and credentials those tasks require.

TechCrunch noted that the launch came the same day Axios reported that U.S. banks have begun to detect agentic activity inside user accounts. According to the report, the activity is not necessarily a case of rogue agents pilfering accounts but an example of consumers increasingly allowing automated services to act on their behalf, including on financial matters. The central problem is that most banks cannot tell whether agentic activity is tied to user requests, the report said. Bankers interviewed by Axios described the situation as 'horrifying,' and a Chase spokesperson told Axios that customers 'should not give their usernames and passwords to anyone.'