1Password for Agents

Status: Launched October 22, 2026. Partner integrations are rolling out one by one, so support depends on which agent you use.

The problem it solves

The new generation of personal agents, such as Meta Muse, Claude Duet, and OpenAI Dots, do their work on websites and in accounts that require a login. The obvious shortcut is to paste your password into the chat or store it in the agent’s settings. That works, and it is a bad idea.

An agent’s context is not a safe place for a secret. Text the agent has seen can end up in logs, in memory it keeps for later, or in the output of a successful prompt injection hidden in a web page it reads. Banks have also started noticing agent activity in customer accounts that they cannot easily tell apart from fraud; a Chase spokesperson told Axios at launch that customers should not give their usernames and passwords to anyone.

1Password’s answer rests on a simple principle: the agent needs the ability to authenticate, not the ability to read the password.

How a sign-in works

When an agent hits a login page, it stops and requests the credential it needs from your 1Password vault. You get an alert, review which login is being requested, and approve it. 1Password then fills the credential into the site itself. The agent ends up signed in, but neither the password nor the one-time code passes through the agent or the model.

You choose which logins an agent may use, and 1Password describes access as tied to the task, so an agent working on your utility bill should only reach your utility account and nothing else in your vault. You can disconnect an integration at any time. Exactly which safeguards apply varies by integration, because each partner builds its own side of the connection.

Where this sits in agent security

1Password for Agents is one piece of a larger set of controls, and it helps to be clear about what it covers.

It is a credential broker. It keeps secrets out of the model and adds a human approval step at the moment of sign-in, which is a form of authorization gate. It supports least-privilege access by letting you scope which logins an agent can use.

It does not control what the agent does once it is signed in. If you approve a login to your email, the agent can then act inside that account according to its own rules and permissions. Those limits come from the agent platform’s own approvals and from an action boundary on what the agent is allowed to do at all. Runtime tools like NVIDIA OpenShell tackle a related problem for developer agents, injecting credentials only into requests bound for approved endpoints so the agent process never holds them.

Approval prompts also have a known weakness: people get used to tapping “approve.” Treat each request as a real decision, especially if it is for an account you did not expect the task to need. That is exactly the kind of moment agent social engineering tries to exploit.

Supported agents and availability

At launch, 1Password listed integrations in three groups:

• Rolling out first: Meta Muse and Grok Bot
• Announced as next: Claude Duet, ChatGPT Work and Dots, and Town’s Townie
• Also planned: Instinct, Browserbase, Browser Use, Dana, Kernel, Perplexity, Ramp, Tomo, and Wajo

Some news coverage at launch described Duet and Dots as already supported; 1Password’s own post lists them as not yet live. Check the agent’s settings rather than assuming.

The service is available at no additional cost for Individual and Family accounts on 1Password.com. Accounts on the EU and Canadian regional servers are not supported yet. The launch post does not cover Business or Enterprise plans. Developers building personal agents are directed to 1Password’s partnerships team, and users can join a waitlist to request agents that are not yet listed.

This builds on earlier 1Password work, including Secure Agentic Autofill, which entered early access with Browserbase in October 2025.

What is still unclear

The launch materials do not describe audit logging of agent sign-ins, how passkeys are handled, or how API keys and other developer secrets fit in. 1Password has separate developer products (service accounts and SDKs) for machine credentials, which are a different use case from a personal agent logging into your bank. If you need those details for a security review, ask 1Password directly.

Alternatives and related tools

• NVIDIA OpenShell, an open-source runtime that keeps credentials out of developer agents and enforces network policy
• Cua, sandboxed desktops for computer-use agents
• Each agent’s own credential handling: Claude Duet uses a separate on-device password form, and Muse stores shared credentials on its isolated VM

For the underlying concepts, see credential broker and non-human identity. For a broader checklist, see the AI Agent Security Checklist and AI Agent Permissions.