1Password lets AI agents sign in without ever seeing passwords

1Password launched a credential broker for AI agents on Thursday, a system that lets a personal agent log into your accounts while the password stays sealed inside your vault. The product is called 1Password for Agents, and it arrives at the moment agents are finally capable of finishing tasks that require a real login.

How the approval flow works

When an agent reaches a sign-in form, it presents a unique digital key to verify its identity to 1Password and requests the credential it needs. 1Password notifies you, naming the account the agent wants and why. You approve on your own device, a step the company likens to two-factor authentication.

After approval, 1Password fills the login directly into the destination site. The agent continues its task without holding your username, password, or one-time code, and each approval covers one specific login rather than blanket vault access. The integration can be disconnected at any time.

"Agents are starting to do real work on our behalf. The old model where you hand over a credential and hope for the best doesn't work," 1Password CEO Aashish Tripathi said.

Launch partners and availability

Meta's Muse and SpaceXSI's Grok Bot are rolling out over the coming days. Anthropic's Claude Duet, OpenAI's ChatGPT Work and dots, and Town's Townie are listed as coming soon. Instinct, Browserbase, Browser Use, Perplexity and Ramp are queued behind them.

1Password for Agents is free for Individual and Family accounts on 1Password.com. Accounts on the European and Canadian regions are not supported at launch, and the company is explicit that safeguards and controls vary by partner integration.

Why the agent trust layer is the real prize

This is the consumer-facing tip of a buildout 1Password has run all year. Unified Access for agent security shipped in March, an OpenAI Codex integration in May, and secure credential access for Claude in July. Each targeted a different context: coding agents, enterprise workflows, and now the personal assistants ordinary users talk to.

The sequence matters because the agentic stack is consolidating around three layers: the model, the tools, and the trust boundary that decides what an agent may touch. Whoever owns the third layer sees every login and every scope decision, a more defensible position than selling another wrapper around somebody else's frontier model.

Builder impact

For teams building agents and automations, credentials pasted into a prompt or an env file are now the amateur approach. The pattern to copy is a credential broker: the agent holds an identity, requests scoped access at the moment of use, and never receives the secret. Workflow builders already do this with vault-backed credentials and short-lived tokens; 1Password is extending the model to consumer agents.

Watch the fragmentation risk. Controls differ per integration and availability varies by region, so an automation tied to one agent's sign-in behaviour is brittle by design. Keep the credential provider swappable, log every approval, and separate the agent's identity from the human's account.