1Password lets AI agents like Muse, Dots and Claude Duet sign in without seeing passwords

What 1Password launched

1Password launched 1Password for Agents on 22 October 2026, a sign-in platform for personal AI agents. The idea is simple: when an agent working for you reaches a login page, it can ask 1Password for the account it needs, you approve the request on your own device, and 1Password fills in the username, password or one-time code itself. The agent never receives the credential.

The launch partners are some of the most prominent consumer agents of the moment: Meta's Muse, Anthropic's Claude Duet, OpenAI's ChatGPT Work and Dots, SpaceXSI's Grok Bot and Town's assistant, Townie. Nine more companies, including Perplexity, Browserbase, Browser Use, Kernel and Ramp, are building integrations that 1Password says are coming soon.

"Agents are starting to do real work on our behalf. The old model where you hand over a credential and hope for the best doesn't work," said Aashish Tripathi in the company's statement. SiliconANGLE and Engadget identify him as 1Password's chief product officer. "An agent should be able to do the job it's been asked to do without getting permanent access to everything behind the account," he added.

How a sign-in works without the password

1Password's product page describes three steps. First, at a login screen the agent asks for the credential for a particular account, and the user allows it to connect to 1Password. Second, the user approves or denies that specific request in 1Password. Third, 1Password autofills the password or one-time code into the page, and the agent only learns that access was granted.

Behind the scenes, according to the company's FAQ, each agent uses a unique digital key to prove its identity to 1Password when it hits a sign-in form. The person sees which credential is wanted and why. If more than one saved login matches, they can choose which one to use. Once the website accepts the login, 1Password says it removes the credential so the agent cannot read or reuse it as it carries on with the task.

The Verge compares the flow to two-factor authentication: the approval happens on the user's own device, so a person stays in the loop for each sign-in. Engadget, citing the company, reports that access is granted per session, limited to the specific items approved and not carried over, and that passwords and MFA codes travel through a channel 1Password manages rather than through the model.

1Password calls the browser part of this Agentic Autofill. Connecting an agent does not open the whole vault, the company says; the other items stay end-to-end encrypted, and the user can disconnect an integration at any time. Credentials stay in one place, so when a password changes, every connected agent uses the new one.

Which agents are covered

Availability varies by partner, and most integrations are not live yet. According to 1Password's announcement, Muse and Grok Bot integrations are rolling out over the coming days across all platforms. Claude Duet and OpenAI's ChatGPT Work and Dots are listed as coming soon, and Townie's web and iOS integrations are also coming soon.

Each of those agents is built to act on its own. Claude Duet, which Anthropic released on 21 October, asks before it acts, and Anthropic chief product officer Ami Vora told SiliconANGLE that 1Password will soon fill in Duet's sign-ins using passwords people have already saved. OpenAI's Dots are always-on agents that keep working in the background, which is exactly the situation where pasting a password into a chat would be most risky.

Claude already worked with 1Password in the browser from July, and SiliconANGLE notes that Perplexity's and Browserbase's browser agents have been connected since late 2025. What is new is a common platform with named consumer agents from Meta, Anthropic, OpenAI and SpaceXSI, plus a partnerships programme inviting other agent builders to plug in.

Who can use it and what it costs

1Password says the feature is available at no additional cost for Individual and Family accounts on 1Password.com. Accounts hosted on 1Password.eu or 1Password.ca are not supported for now, which leaves out European and Canadian customers whose data sits in those regions.

The product page also offers a waitlist for people whose agent is not yet listed, and invites developers building personal agents to contact its partnerships team. The integrations are optional, and people who never connect an agent keep using 1Password as before.

For anyone who already uses an agent for errands, the practical change is the end of a familiar workaround. 1Password's own examples include ordering groceries through Instacart or DoorDash, adding exams from Canvas to a calendar, booking flights and an Airbnb, and storing API keys for a coding project in the vault rather than in a prompt.

Why agents need a different kind of login

Until now an agent that hit a login had two options, 1Password argues: stop and wait for a person to take over and type the password, or receive the password in its prompt. The first defeats the point of an agent. The second leaves a copy of the credential in a chat history or log outside the owner's control, and gives the agent access that may outlast the task.

That second risk is not hypothetical. Attackers increasingly hunt for the keys that AI tools rely on. This week the hosting company Railway said attackers may have decrypted customer secrets while looking for AI API keys, and a poisoned release of the AI gateway library LiteLLM shipped a credential stealer to anyone who installed it. A password that is never placed inside an agent cannot leak from that agent's memory or logs.

The launch also builds on an argument 1Password chief technology officer Nancy Wang made last month at Okta's Oktane conference, as reported by SiliconANGLE: that agent access should be tied to individual tasks, and an agent should have to show it finished its last task with the right permissions before getting more.

What the agent can still do

Keeping the password away from the agent does not limit what the agent does once it is signed in. 1Password's own FAQ is direct about this: after sign-in, an agent may be able to see information or take actions inside the account, and its behaviour depends on the agent and the website. The company tells users to review the task and the account before approving.

In other words, approval is the important moment. An agent that books the wrong flight, buys the wrong item or misreads a message can still do so with a valid session. That is why retailers are adding their own controls, such as the spending limits Walmart now sets for outside shopping agents. A password manager can keep the secret safe, but it cannot judge whether the task is a good idea.

The approach also depends on each agent implementing the integration as described. 1Password says it and each partner design the integration to keep credentials separate, but adds that safeguards and controls vary by integration and that how often users are asked to approve may vary too.

Open questions

Several details are still missing. 1Password has not published a technical specification of how agents identify themselves, what stops a compromised agent from requesting many logins in quick succession, or how the system behaves when an agent runs in a remote cloud browser rather than on the user's own machine.

Timelines are also loose. SiliconANGLE reports that the company did not say when each partner integration will reach users, and Engadget noted that fuller availability details were still to come, although 1Password's own post says consumer plans get the feature at no extra cost. Support for the EU and Canadian data regions has no date.

Still, the launch marks a shift in how the industry treats agents: less like a trusted user who gets the keys, and more like a contractor who is let in for one job at a time. If the main agent makers adopt the pattern widely, pasting passwords into chat boxes could become as outdated as writing them on sticky notes.