1Password now lets AI agents log in for you, without handing over your password

The problem

You ask an AI assistant to reorder your groceries. It gets to the shop’s website and hits a login page. It asks you for your password.

The easy thing is to type it into the chat. Now your password sits in a chat history on someone else’s computer. The assistant can reuse it whenever it likes, for whatever it likes. You have handed a stranger your house key so they could drop off one parcel.

This is already happening at scale. In October 2026, Axios reported that big US banks, including JPMorgan, Bank of America, Citi and Morgan Stanley, had found outside AI agents logging into customer accounts, sometimes with the customer’s own password. Some went beyond what the customer asked for. Bank executives called it “horrifying”. Morgan Stanley is blocking outside agents, and the others are restricting them.

So you are stuck. Either you skip the useful chores AI could do for you, or you give away the keys to your accounts.

What we’re solving

On 22 October 2026, 1Password, the password manager, launched 1Password for Agents. The idea: an AI agent (an AI assistant that takes actions for you, not just chats) can log in to your accounts, but it never sees your password.

• You approve every login. When an agent hits a login page, you get an alert on your own device saying which agent wants in and why. You tap approve or deny.
• 1Password types the password, not the agent. The username, password and any one-time code (the 6-digit code from your authenticator app) go straight into the website’s login form.
• The agent only hears “yes”. It learns that access was granted. It never receives the password, so it cannot leak it, store it or reuse it.
• Access is short-lived. Permission covers one session and only the logins you approved. It does not carry over to next time.
• The rest of your vault stays locked. Connecting an agent does not expose your other saved items.

Which agents work with it

• Meta’s Muse: available now on Android, web and iOS, according to 1Password.
• Grok Bot: rolling out across all platforms over the coming days.
• Anthropic’s Claude: has had a 1Password integration since July 2026, on Mac.
• Named but not yet live everywhere: OpenAI’s ChatGPT Work and Dots, Claude Duet, and agents from the startup Town. Several are waitlist only.

What it does not solve

• It does not control what the agent does once inside. 1Password says plainly that a signed-in agent may view information or take actions in the account. A wrong order is still a wrong order.
• It does not make banks happy. Bank rules generally expect a human to access the account. A password manager approving the login does not change that.
• It does not cover everything. The Claude integration only fills usernames, passwords and one-time codes. Passkeys and other item types are not supported yet.

A real example

The best-documented case is 1Password’s integration with Claude, which has a public setup guide. Here is what it actually takes and what actually happens.

What you need

• A Mac. The setup guide lists it as a requirement.
• 1Password for Mac and its browser extension, both version 8.12.28 or later.
• The Claude desktop app and the Claude in Chrome extension. 
• A paid Claude plan: Pro, Max, Team or Enterprise.
• For workplaces: a 1Password Business admin must switch on a policy that allows AI agents to autofill. On Claude Team or Enterprise, an owner must also turn the feature on, because it is off by default.

What happens when Claude needs to log in

1. Claude asks. It sends a sign-in request to 1Password.
2. 1Password suggests a login. You see a prompt with the matching saved login. You can pick a different one.
3. You decide. Approve or deny. If the site uses “Sign in with Google”, Claude asks for both logins.
4. The extension fills it in. Claude pauses reading the page while 1Password fills the form, then carries on.
5. Claude learns only which login was used. 1Password says passwords and one-time codes never enter Claude’s context, memory or Anthropic’s systems.

How it compares with the alternatives

Adoption numbers are not public yet, so here is how 1Password’s approach stacks up against the other ways people let agents into accounts today.

How it works (with code)

The idea in plain words

Think of a building with a front-desk guard. A courier arrives for flat 4B. The guard does not hand over a key. The guard phones you, you say “let them in”, and the guard opens the door. The courier gets in once, never holds a key, and cannot come back tomorrow on their own.

• The courier is the AI agent. It proves who it is to 1Password with its own unique digital key.
• The guard is 1Password. It finds the matching login in your vault and calls you for approval.
• The phone call is a notification on your device. Approval happens on your device, so 1Password knows it really came from you.
• Opening the door is autofill. 1Password sends the password over an encrypted channel to its browser extension, which types it into the site. For the business version, 1Password says it built this channel on the Noise Framework, a well-known recipe for encrypted connections.
• The courier never touches the key. The password never passes through the AI model, so it never shows up in chat logs or the agent’s memory.

The code: the old way versus the new way

There is no public developer API for the consumer feature, so this is not 1Password’s code. It is a small Python model of the idea, so you can see exactly what ends up in the agent’s memory in each case. 1Password’s developer tools today focus on a different job: keeping API keys and other secrets away from AI coding assistants.

# A toy model of "approve, then fill" logins. Not 1Password's real API.
 VAULT = {"shop.example": ("asha@mail.com", "s3cret-Pa55!")}
  
 def ask_human(agent, site, reason):
     print(f"[phone] {agent} wants {site} to {reason}. Approve? yes")
     return True  # in real life, the person taps Approve or Deny
  
 def broker_login(agent, site, reason, login_form):
     """The password manager fills the form; the agent only hears yes/no."""
     if site not in VAULT or not ask_human(agent, site, reason):
         return "denied"
     login_form["user"], login_form["password"] = VAULT[site]  # into the page
     return "signed in"
  
 # Old way: paste the password into the agent's chat
 agent_memory = [f"My login for shop.example is {VAULT['shop.example'][1]}"]
  
 # New way: the agent asks the broker instead
 form = {}  # stands in for the website's login form
 result = broker_login("Shopping agent", "shop.example", "reorder groceries", form)
 agent_memory_new = [f"Login result: {result}"]
  
 print("Old way, agent remembers:", agent_memory)
 print("New way, agent remembers:", agent_memory_new)
 print("Password ever in new agent memory?",
       any(VAULT["shop.example"][1] in m for m in agent_memory_new))

Output (run on 27 October 2026):

[phone] Shopping agent wants shop.example to reorder groceries. Approve? yes
 Old way, agent remembers: ['My login for shop.example is s3cret-Pa55!']
 New way, agent remembers: ['Login result: signed in']
 Password ever in new agent memory? False

What the code does

• VAULT is your password manager. It holds the real password. Only broker_login reads it.
• ask_human is the approval alert on your phone. Here it always says yes; in real life you tap Approve or Deny.
• broker_login fills the website’s form directly. It returns only “signed in” or “denied” to the agent.
• The last line checks the agent’s memory. In the old way, the password is sitting in the chat. In the new way, it never appears: the check prints False.

What it costs

Prices were checked on 27 October 2026, in US dollars. 1Password says the agent feature is included in all Individual and Family plans, so there is no extra charge for it. But you also need an agent that supports it, and some of those are paid.

What this means for you

• Already a 1Password customer? The feature costs you nothing extra. The real cost is the agent: the Claude integration, for example, needs a paid Claude plan and a Mac.
• New to password managers? New customers buying a yearly plan directly can get a first-year discount ($2.99/month for Individual, $4.49 for Families). 1Password raised its regular prices by up to 33% in March 2026, so check the renewal price.
• Small business: a 1Password Business admin must switch on the agent policy before staff can use it. Business pricing was not checked for this post.
• Free is not free: pasting your password costs nothing today, but a leaked password, a locked bank account or an unwanted order costs far more.

Pros and cons

Pros

• Your password never reaches the AI. It cannot end up in chat logs, training data or a leaked prompt.
• You stay in the loop. Every login needs your approval on your own device.
• Access expires. No permanent keys left lying around inside agents.
• Big names have signed on. Meta, Anthropic, OpenAI and Grok’s maker are all named partners.
• No extra fee for existing Individual and Family customers.

Cons

• The agent can still do damage once inside. Engadget points out that agents can still order the wrong thing or book the wrong trip, sometimes with no way to cancel. Protecting the password does not protect your shopping basket.
• Banks may still say no. Several big US banks are blocking or restricting outside agents, whatever tool logs them in. Chase told Axios customers should not give their login details to anyone.
• Support is patchy. Many agents are on a waitlist. The Claude setup guide requires a Mac and does not handle passkeys.
• Approval could get tiring. 1Password says how often you are asked varies by agent. Constant pop-ups train people to tap Approve without reading.
• All your eggs in one basket. Your vault becomes the gatekeeper for your AI agents too. If you ever leave 1Password, your agent setup goes with it.

Key takeaways

• 1Password for Agents lets an AI agent log in to your accounts while 1Password, not the agent, types the password.
• You approve each login on your own device, and access ends with the session.
• It works today with Meta’s Muse and Claude (on Mac), with Grok Bot rolling out and other agents on waitlists.
• It is included in 1Password Individual ($3.99/month billed yearly) and Families ($5.99/month billed yearly) plans.
• It protects your password, not your account: a signed-in agent can still make mistakes, and banks are restricting agents regardless.