Products#AI safety#Device control
1Password launches 1Password for Agents, so agents can sign in without ever seeing the password
1Password for Agents (Oct 22): an agent proves itself with a digital key, you approve, and 1Password fills the password or one-time code.
1Password, the password manager, released 1Password for Agents on October 22, 2026: when an agent reaches a login page it needs credentials for, it proves its identity to 1Password with a unique digital key, the user approves the request on their own device, and 1Password fills the password or one-time code into the destination site. The company’s wording is that it “directly auto-fills the credentials in the destination site so the agent doesn’t have access to the credentials.” The agent only learns that access was granted. It costs nothing extra on Individual and Family accounts hosted at 1Password.com, and accounts on 1Password.eu or 1Password.ca are not supported yet.
Key points
- Three steps. The product page lays the flow out as the agent asking, the person approving or denying on their own device, and 1Password filling the password or one-time code. When several saved logins match, the person picks which one the agent gets.
- Two partners are moving. The official blog says integrations for Meta’s Muse and SpaceXSI’s Grok Bot are “rolling out over the coming days across all platforms.” Claude Duet, ChatGPT Work and dots, and Town’s Townie are all listed as coming soon, along with nine more partners. The product page still leads with “Join the waitlist to be notified when your agent is ready.”
- Scope is narrow. Individual and Family plans hosted on 1Password.com get it at no additional cost. Accounts on 1Password.eu or 1Password.ca are excluded, and no team or business plan is mentioned.
Background
1Password has built toward agent sign-in along three tracks in about a year. SiliconANGLE reported on October 8, 2025 that the company added Secure Agentic Autofill to its Enterprise Password Manager, available in early access only through Browserbase’s cloud browser, aimed at developers writing browser automation. The same outlet reported on July 16, 2026 that the idea reached consumers as 1Password for Claude: credentials scoped per session, a biometric prompt for each request, and the password and any one-time code kept outside the model, its memory and Anthropic’s systems. A third track came on September 28 with NVIDIA’s OpenShell runtime, where 1Password’s own post says custody of a credential goes to the runtime for a fixed time to live; the agent sees placeholders, real values resolve only for approved hosts, and resolution stops at expiry while the sandbox keeps running. Each track served a different crowd: developers writing automation, ordinary Claude users, and teams building their own agents.
The identity work predates all of it. On April 8, 2026 a post signed by Jacob DePriest, Nancy Wang and Jeff Malnick answered NIST’s concept paper on agent authorization, splitting agent identity into identification, attestation, enrollment, authentication and authorization, and promising interoperability with existing systems. The phrase “digital key” appears in the product page’s FAQ, not in the launch post, which describes the same handshake as the agent requesting, the user approving and 1Password filling. Same mechanism, different level of caution in the wording.
Our Claude Duet entry from October 22 carried this integration as a single table row reading “coming soon,” with no date. This entry expands that row into a full story, and it covers more than Duet, which the launch blog still lists as coming soon.
The facts
The public record sits on two pages: the launch post (October 22, by John Torrey, marked seven-minute read), which covers the motive and the partner list, and the product page, which covers the flow, eligibility and an FAQ. Together they give this.
| Item | Detail |
|---|---|
| Release date | October 22, 2026 |
| Identity check | The agent uses a unique digital key to verify itself to 1Password (product page FAQ) |
| Approval | Approve or deny on the person’s own device; pick among matching logins |
| Filling | 1Password enters the password or one-time code; nothing is sent to the agent |
| Rolling out | Muse (Meta) and Grok Bot (SpaceXSI), “over the coming days” |
| Coming soon, named at launch | Claude Duet, ChatGPT Work, dots, Townie |
| Coming soon, nine more | Instinct, Browserbase, Browser Use, Dana, KERNEL, Perplexity, Ramp, Tomo, Wajo |
| Eligibility | Individual and Family accounts on 1Password.com |
| Price | No extra cost; Individual $2.99/month annual, Family $4.49/month, checked Oct 22 |
| Not supported | 1Password.eu and 1Password.ca accounts; team and business plans unmentioned |
The price needs unpacking because it is the one number most coverage got half right. MacRumors, in Juli Clover’s October 22 piece, writes that “1Password is priced starting at $3.99 per month with annual billing,” which reads like the going rate. Open the password manager pricing page on October 22 (US time) and Individual shows “Original price: $3.99” beside “Current price: $2.99,” with Family at $5.99 and $4.49 the same way; the page’s own FAQ calls those promotional prices for new customers’ first year and names $3.99 and $5.99 as the regular ones. So $3.99 is the list price, not what a new subscriber pays this month. The launch post itself carries no dollar figure at all, only the promise of no additional cost for Individual and Family.
Launch status is where reporting drifted further. The blog tags each partner: Muse and Grok Bot are “rolling out over the coming days across all platforms”; Claude Duet is “integrations coming soon”; ChatGPT Work and dots likewise; Townie is “web and iOS integrations coming soon”; and the nine additional partners are all coming soon. The product page gives a “Rolling out over the coming days” card only to Muse and Grok Bot, and tops the page with a waitlist button.
TechCrunch’s Lucas Ropek lists Claude Duet, Dots, ChatGPT Work, Grok Bot, Muse and Town as the agents a user can choose from, six names in a row with no status attached. SiliconANGLE’s Duncan Riley goes further, saying OpenAI has already connected ChatGPT Work and Dots, Town has signed up and Grok Bot can sign in, while also noting 1Password “did not say when each partner integration will reach users.” Both readings run ahead of the official blog. Going by the two official pages, two integrations are on their way now and the rest are names on a list.
What others say
PCWorld’s Ben Patterson is the only reporter in this batch who describes using one of these integrations himself, and he is explicit that it predates this release: he tried 1Password for Claude when it shipped in the summer, and Claude Cowork logged into his FreshDirect account, picked groceries and checked out. He draws his own line at sensitive accounts, writing, “would I give Claude access to my bank account or MyChart with 1Password? Not so much.” He quotes 1Password’s John Torrey twice: “The user is involved in every decision,” and “The agent can’t approve its own access.” He also flags what is missing from the launch list: Gemini Spark and Microsoft Scout.
SiliconANGLE adds the business detail. 1Password chief product officer Aashish Tripathi says agents are “starting to do real work on our behalf”; Anthropic chief product officer Ami Vora says 1Password will “soon” fill in Claude Duet’s sign-ins, and that Anthropic wants this within reach of people “who’ve never before let an agent near their accounts.” Nine more companies beyond the launch partners are building integrations. Perplexity’s and Browserbase’s browser agents have been connected to 1Password since late 2025 according to SiliconANGLE, yet the launch blog still lists both under coming soon. No timeline was given for any of them.
The Hacker News thread on the launch is a very small sample: it was submitted at 21:21 UTC on October 22 and about three hours later still stood at one point and three comments. walski, the submitter, wrote the sharpest of them: “How can they guarantee that the agent does not see the password and username in a browser they fully control?!” The other two ask for an OpenBao-style policy implementation and mock the idea. Three comments are not a community verdict, so treat that question as a fair objection to test rather than as consensus.
The banking context arrived the same day. Axios reported on October 22 that several U.S. banks had detected third-party agents operating inside customer accounts. The Axios page returned an HTTP 403 on every fetch attempt during this reporting, so the details below come from Cyber Security News’ account of it. Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo are named as institutions working to contain the risk, with JPMorgan, Bank of America and Citi restricting access. Morgan Stanley’s spokesperson told Axios the bank had not observed “rogue AI agents accessing our platforms,” a denial that covers only that bank. A Chase spokesperson warned customers not to share usernames and passwords with anyone, and the same account cautions that the report does not establish that every bank named actually detected unauthorized agents. TechCrunch, summarizing the same report, adds that bankers described the situation as “horrifying” and that most banks cannot tell whether agent activity was requested by the customer.
Our take
For anyone building an agent product, the part worth copying is the authorization model. An agent cannot approve itself; the request lands on a person’s device; what gets approved is one specific credential for one specific task, revocable at any time. The product page adds one caveat, that how often a person is asked to approve access varies by integration. That replaces a vague question, whether to hand an agent your password, with three concrete ones: which credential, for what task, for how long. Enterprises have had versions of this for a while. This release bundles it into Individual plans at no additional cost, with the promotional annual price at $2.99 a month for a new customer’s first year.
The hard part starts after the signature. The Hacker News objection holds because the agent controls that browser session, and 1Password’s own FAQ concedes the point: asked what an agent can do after signing in, it answers that the agent may be able to see information or take actions inside the signed-in account, depending on the agent and the site. Keeping the password out of the agent’s hands protects the credential. It does nothing about what the agent does with the session it was just granted. The remaining controls sit on the site’s side, in the account’s activity log, and in whether the person approves the next request.
Several limits apply today. Accounts on 1Password.eu and 1Password.ca cannot use it, which covers customers hosted in Europe and Canada. Team and business plans are absent from the launch. Of the partners the blog lists, only Muse and Grok Bot have started rolling out. Claude Duet, ChatGPT Work and dots, Townie, and nine more are all still coming soon, and the product page still asks people to join a waitlist. Developers who want to build their own integration have nothing to read: developer.1password.com/docs/agents returned a 404 on October 22 (US time), and the blog closes with an invitation to talk to the partnerships team.
What to watch
- How fast the rollout finishes. Muse and Grok Bot are promised “over the coming days,” with no exact date and no per-platform schedule.
- When Claude Duet connects. Anthropic says soon; 1Password gives no date. Duet is itself still in research preview, so two timetables have to line up.
- Public integration docs. Right now there is a partner list and a sales contact form. A third-party agent cannot self-serve.
- Team plans and .eu/.ca hosting. Personal plans run first; until these two are covered, European and Canadian teams are shut out.
- Banks pushing back. If more institutions restrict third-party agents inside customer accounts, delegated sign-in only solves the login step; everything after it can still be blocked.