As personal AI agents move from answering questions to carrying out multi-step tasks on the web, they routinely encounter the same barrier that limits most automation: the need to sign in to existing accounts.
In practice many people have responded by pasting passwords or one-time codes into a chat window, placing those secrets into model context, logs, and whatever retention systems the agent provider uses.
The alternative of skipping the task entirely leaves the agent unable to complete work that depends on logged-in services.
A platform announced by the Canadian password manager company 1Password attempts to separate those two outcomes.
The system, called '1Password for Agents,' lets a supported agent request a specific credential when it reaches a sign-in form.
The agent first proves its identity to 1Password with a unique digital key. The user then sees, on their own device, which item the agent wants and for what stated purpose. Approval or denial happens in the 1Password app.
If approved, 1Password itself fills the username, password, or one-time code directly into the destination site. The credential never travels to the agent, is not written into its conversation history, and is not stored by the agent.
Access remains limited to the requested login for that session; other vault items stay inaccessible. New account information the agent creates can be saved back into the vault under the same control model.
According to the announcement, the design removes one of the more obvious risks of agent use while leaving other risks intact.
Once the agent is signed in, it operates inside the resulting session according to whatever permissions the website and the agent itself allow. A user who approves an airline booking request has no automatic guarantee that the agent will stop at the intended itinerary rather than browsing other account sections or initiating additional purchases.
The approval step therefore functions as a gate on credential release rather than a full policy layer for every subsequent action. Regional restrictions and staggered partner rollouts also mean the feature is not yet uniformly available even to people who already store their logins in 1Password.
According to a separate post, the platform starts rolling out integrations with Meta's Muse, SpaceXSI's Grok Bot, Anthropic's Claude Duet, OpenAI's ChatGPT Work and dots, and Town's Townie, among others.
Additional connections with tools such as Browserbase, Perplexity, Ramp, and several coding-oriented agents are listed as coming soon.
Availability is currently limited to Individual and Family accounts hosted on 1password.com; accounts on the European and Canadian domains are not yet supported.
The feature is included at no extra charge for those eligible plans and is strictly opt-in; without an explicit connector the agent has no path to the vault.
Whether the approach becomes a practical default depends on how consistently agent developers implement the request-and-approve loop and how often users actually review the prompts.
Early descriptions emphasize that the agent can continue the task after sign-in without further credential prompts, which reduces friction for routine work such as updating a calendar, placing a grocery order, or saving an API key during a coding session.
It does not, however, eliminate the need to trust the agent's post-login behavior or the sites it interacts with.
In that sense it functions as a narrower trust boundary around the secrets themselves rather than a complete solution for delegated online activity.
1Password, which began in 2005 as a Mac utility. Its security model centers on a combination of the user's account password and a 128-bit Secret Key generated and stored only on the user’s devices. The company never receives the full Secret Key; the two values are combined locally to derive the encryption key that protects vault data.
These characteristics distinguish it from many other managers, yet they come with trade-offs that appear regularly in independent reviews.
The service is subscription-only with no permanent free tier. And iif a user loses both the account password and access to every signed-in device that holds the Secret Key, the vault cannot be recovered by the company.
While these weak points do not negate the encryption properties or the new agent integration, but they shape the practical decision of whether the platform fits a given user's tolerance for cost, recovery risk, and dependence on a single provider.
