1Password launched a way for personal AI agents to sign into your accounts without ever holding your password. The timing is pointed: US banks spent the same week discovering agents inside customer accounts.
How 1Password for Agents handles a sign-in
The flow is short, and the details are where the trust sits.
An agent reaches a login form. It proves who it's talking to, using a unique digital key. Your phone or laptop shows a prompt: which credential the agent wants, and why. You approve or decline, on your own device.
Then 1Password types the password into the form. Not the agent. The credential never enters the model's context, so there's nothing for the agent to leak, log or reuse later.
After that, the agent goes back to work. The password stays in your vault.
Handing over a password
- The agent stores a copy you can't see
- Access lasts until someone rotates the credential
- A prompt injection can expose it in plain text
1Password for Agents
- The agent gets a session, not a secret
- Each login needs a fresh approval on your device
- Credentials stay in the vault and out of the model context
That's the pitch. It solves a real problem, because agents that book flights and file expense reports need logins, and copying passwords into a chat window has been the default workaround.
The digital key that lets 1Password vouch for an agent
Identity is the hard part. A password manager needs to know that the thing asking for a credential is the agent you installed, not a script pretending to be it.
1Password's answer is a separate key per agent, issued and checked by the password manager. Each agent gets its own identity, which means you can revoke one without touching the others.
It also means the approval screen can tell you something useful. Instead of "an app wants your bank login," you get the agent's name, the site, and the reason it gave. Whether that reason is accurate is another question. The agent writes it, so a misbehaving agent could describe a reasonable task while doing something else.
The human check is the control that matters. A prompt that shows up on your phone, with the site named, is hard to fake at scale.
Which agents support 1Password at launch
The partner list covers most of the big personal-agent products: Muse from Meta, Anthropic's Claude Duet, OpenAI's ChatGPT Work and dots, Grok Bot from SpaceXSI, and Townie from Town.
There's a longer list of companies building integrations, including Browserbase, Browser Use, Perplexity, Ramp, Dana, Instinct, KERNEL, Tomo and Wajo. Those are announced partnerships, not necessarily working features you can turn on today.
The quotes follow the pattern you'd expect. Aashish Tripathi, 1Password's chief product officer, framed the old approach as handing over a credential and hoping for the best. Ami Vora at Anthropic said Claude Duet asks before it signs in anywhere. Glen Coates at OpenAI described the integration as a way to avoid exposing credentials to the model.
Read those as commitments from partners, not proof the handoff works under pressure. Nobody outside these companies has tested a live agent against a hostile page yet.
Why banks worry about agent logins in customer accounts
On the same day as the launch, Axios reported that major US banks are detecting third-party AI agents inside customer accounts, some of them taking actions that appeared to go beyond what the customer asked for.
Bank executives used the word "horrifying." Several institutions are reportedly blocking or restricting agent access. A Chase spokesperson told Axios that customers shouldn't hand their username and password to anyone.
That's the gap 1Password is selling into. Banks see an agent with a password as an unaccountable user. A delegation system with per-login approval at least gives them a party to point at, and an audit trail of who approved what.
Does it fix the bank problem? No. 1Password can prove a human approved a login. It can't prove the agent will behave once it's inside, and it can't stop an agent from clicking the wrong thing in an authenticated session. Authorization and behavior are different problems.
What 1Password hasn't announced
Two gaps are worth flagging before you plan around this.
There's no public pricing, and no general availability date. The launch is a platform announcement with named partners, which usually means a staged rollout rather than a button everyone can press.
There's also no list of which sites work. Some banks and brokerages actively block automated browsers, and a password manager filling a form doesn't change how the site sees the session. Expect the usual friction on financial sites, government portals and anything with device fingerprinting.
Nor does the system cover the messy edges of agent work: password resets, account recovery, and sites that insist on a hardware key. 1Password says it handles one-time codes inside its own approval flow, which keeps them away from the model, but the details will matter once people try this on real accounts.
Should you let an agent log in for you?
If you already use 1Password, the calculation is straightforward. An agent that gets a scoped, revocable session is safer than one holding a password you pasted into a chat window six months ago and forgot about.
If you don't, this isn't a reason to switch yet. There's no price, no date, and no independent security review of the approval flow.
The practical move is to watch what the partners ship. When Claude Duet or ChatGPT Work turns this on by default, the approval prompt becomes the last line of defense between an agent and your bank account. Make sure you read it before you tap approve.
