1Password for Agents puts your phone between AI and your bank

1Password for Agents works a lot like the two-factor prompts you already get from your bank. The agent does the task, and you hold the key. Here’s the sequence 1Password describes:

1. The agent hits a login page. Partway through a job, your assistant reaches a site that wants a username and password.
2. It proves who it is. The agent identifies itself to 1Password with its own unique digital key, so a random program can’t pretend to be your assistant.
3. You get a request. A notification on your own device shows which account the agent wants to open and why.
4. You approve or deny. Nothing happens until you decide.
5. 1Password types it in. If you say yes, 1Password fills the login straight into the form. Once the site accepts it, 1Password pulls the credential back so the agent can’t read it or use it again later.

The rest of your vault stays closed throughout. An assistant that needs your electricity account doesn’t get a peek at your email, your bank or your saved card numbers.

The launch list reads like a who’s who of this year’s agent race. 1Password named these partners:

• Meta’s Muse, built by Meta Superintelligence Labs. With the link turned on, Muse requests each login from 1Password mid-task.
• OpenAI’s ChatGPT Work and Dots, its always-on agents.
• Grok Bot from Elon Musk’s SpaceXSI.
• Town’s Townie assistant, from a work-assistant startup that raised $108 million this week.
• Anthropic’s Claude Duet, which launched on Wednesday. Its sign-ins are coming soon rather than live today.

Reports differ on exactly which of these are switched on right now, and 1Password hasn’t given dates for each partner. So if your assistant isn’t offering the option yet, that’s probably why. Another group, including Perplexity, Browserbase, Browser Use, Ramp, Kernel, Dana, Instinct, Tomo and Wajo, is building its own support, and 1Password says more integrations are on the way.

None of this is brand new for Claude users. Claude has been able to log in to websites through 1Password in the browser since July, and Perplexity’s and Browserbase’s browser agents have been connected since late 2025.

The easy shortcut, handing your password to the bot, creates a copy you don’t control. Assistants often save it so they can sign in again next time, and that saved copy can live in chat history, cloud logs or the agent company’s systems.

That matters more for agents than for normal apps because agents read things written by strangers: emails, web pages, product listings. A cleverly hidden instruction on a web page can try to trick an AI into doing something you never asked for. If the bot holds your actual password, a trick like that could leak it. If the bot never sees the password, there’s nothing to leak.

1Password’s chief product officer, Aashish Tripathi, put the principle simply: an agent doing one job shouldn’t walk away with lasting access to the whole account. That idea, access tied to a single task, is where the company thinks agent security has to go.

For everyday users, the big change is that you get a say in every sign-in. Instead of trusting an agent with standing access, you approve logins one at a time, on a device you hold. It’s the same instinct that made two-factor codes popular: a stolen password alone isn’t enough.

There are limits worth understanding before you switch it on:

• You still trust the agent once it’s inside. 1Password protects the password, not what the bot does after it signs in. If you approve a login to your bank, the agent is in your bank for that task.
• Approval fatigue is real. If you tap yes on every prompt without reading it, the protection weakens. Check the account name and the reason each time.
• Pricing is unclear. 1Password hasn’t said whether this costs anything extra or which plans include it.

You don’t need to wait for your assistant to support it to tighten things up. A few steps help today:

• Stop pasting passwords into any chatbot. If you already have, change those passwords.
• Turn on two-factor sign-in for your email, bank and shopping accounts, the ones an agent is most likely to touch.
• When your agent offers a password manager link, use it instead of typing credentials into the chat.
• Give agents access only to the accounts a task needs, and remove access you no longer use.

1Password says its business vault already protects more than 1.6 billion credentials and secrets for over 200,000 businesses, so the company has a lot riding on getting this right.