1Password launches tool letting AI agents log in without seeing passwords

New 1Password tool delegates logins to AI agents

1Password on Thursday launched 1Password for Agents, a platform that lets users allow AI agents to log into personal accounts on their behalf without the agent ever having access to the user's credentials. The company said handing over a password, secret, or credential is a common shortcut to an agent, but can leave people with sensitive information in places they can no longer control as a copy gets saved for the next time. It said 1Password for Agents gives people a trusted way to delegate tasks to personal AI agents while keeping control of the passwords, secrets, and credentials those tasks require.

The platform creates a system of communication between the agent, the user, and the password manager. When an agent attempts to log in on a user's behalf, a unique digital key is sent to 1Password to confirm the agent's digital identity. The user is then sent an alert about the login attempt and can personally confirm the request. 1Password then signs in the agent, filling in the credentials on the digital assistant's behalf, which allows it to log in and complete whatever task is at hand.

Supported agents and wider rollout

1Password for Agents allows users to choose their agent of choice. Supported options include Claude Duet from Anthropic, OpenAI's Dots or ChatGPT Work, Grok Bot, Meta's Muse, and agents from Town, which is an AI assistant startup. The company says it is working with other companies to expand the service.

Banking context raises concerns

The new platform is launching on the same day that Axios reports U.S. banks have begun to detect agentic activity inside user accounts. This is not necessarily a case of rogue agents pilfering accounts, but rather an example of how consumers are increasingly allowing automated services to act on their behalf, including on financial matters. However, the potential for agent-related problems is still large. The big issue appears to be that most banks cannot tell if the agentic activity is tied to user requests or not. Bankers interviewed by the outlet described the situation as "horrifying," and a Chase spokesperson interviewed by Axios additionally told the outlet that customers "should not give their usernames and passwords to anyone."

Sources: TechCrunch