1Password Fills Agent Logins and Leaves the Session Open

1Password on October 22, 2026 launched a free tool that signs personal AI agents into websites without showing them the password. You approve each request on your own device, then 1Password fills the form itself.

The password stays in the vault, and the agent still gets the signed-in session it needed to finish the job. That remaining login is the part banks spent the same week trying to keep out.

How 1Password Logs an Agent In

The company published the 1Password for Agents platform as a no-cost option for Individual and Family accounts on 1Password.com. Accounts on 1Password.eu and 1Password.ca are not supported. Unless you opt in to an agent connector, the company said, agents cannot touch the vault.

John Torrey’s launch post walks through the bind that shows up the moment a helper hits a sign-in page. You can take over the session and type the password yourself, which stalls the task. You can paste the secret into a prompt, which leaves a copy the agent can keep. 1Password’s new path is a gate the person still has to open.

THE SIGN-IN GATE

• The stop: The agent reaches a login and asks 1Password for the matching item from the vault.
• The proof: The agent presents a unique digital key so 1Password can check which helper is asking.
• The tap: You see which login it wants and why, then approve or deny the request in 1Password.
• The fill: If you say yes, 1Password types the username, password, and one-time code into the site, not into the agent.

The launch post’s own example is a party, not a bank. Muse can ask for RSVPify and Oriental Trading as it builds invites and a supply list, and you pick which saved login it may use. The agent never sees those passwords and never gets the rest of the vault.

1Password posted the partner film with that pitch on October 22.

Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with… pic.twitter.com/505moAiIfO

— 1Password (@1Password) October 22, 2026

Claude Got This Treatment in July

The October product is a wider door on work 1Password already shipped for Anthropic. On July 16, 2026 it launched 1Password for Claude, a Mac hookup that lets Claude request a login, waits for a yes in the desktop app, then fills the page through 1Password’s own software.

That build pairs the Claude desktop app using the Mac’s code-signing checks and an allowlist of trusted partner apps. Each new agent session gets its own cryptographic keys. Claude can see item titles, usernames, and saved websites, which is enough to pick a login, and it never receives the secret values.

While 1Password fills, Claude is told to stop reading the page. The extension submits the form, checks that the submit happened, and only then lets the agent look again. If the submit fails, it clears the filled fields first. The moment Claude drives a tab, Agentic Mode also strips 1Password’s own on-page menus so the helper cannot click into vault items you did not grant.

Nancy Wang, 1Password’s chief technology officer, said in the July announcement that the company needed a security model built for agents, not only for people, and that Claude can know it used a login without the password or one-time code entering the model’s context. On Business accounts, admins get a separate switch labeled “Allow AI agents to autofill for users.”

1Password is not the only vault trying to own this step. Bitwarden published an open Agent Access SDK on March 24, 2026, with just-in-time approval and a path that injects secrets without dumping them into the model. The October launch is 1Password taking that fight to Muse, Grok Bot, and a long partner list, not the first time a password manager offered to stand in the middle.

Banks Still See a Human at the Keyboard

From the website’s point of view, a 1Password fill still looks like a person using a password manager. Nothing in the public launch says the destination bank, shop, or mail host receives a separate proof that an agent is in the chair. That is the gap large U.S. lenders spent mid-October drawing in public.

Jamie Dimon, chairman and CEO of JPMorgan Chase, told analysts on the bank’s October 13 earnings call that outside helpers would not get a free run of the firm.

“We’re not going to allow just any outside agent to come in inside the company because that’s just too risky for clients and for JPMorgan,” Dimon said. He added that customers who hand an agent their login should understand “the liability transfer.” A Chase spokesperson said customers should not give their usernames and passwords to anyone.

Bank of America chief executive Brian Moynihan said on October 14 that a person should stay in the loop before money leaves an account, while the bank writes rules on who is on the hook for an agent-authorized payment. Citigroup has said it does not let third-party agents log into customer accounts or transact on its digital banking sites. Morgan Stanley has begun blocking third-party agents on its platforms; a spokesperson said the bank had not observed “rogue AI agents accessing our platforms.”

WHERE OUTSIDE AGENTS STOP

Most of those banks still allow a read-only view through an authorized connector, the same door budgeting apps have used for years. The fight is over a helper that can click, pay, and talk to a call center while wearing the customer’s login.

After the Fill, the Session Belongs to the Agent

Hiding the password does not hide the live login. Once the site accepts the form, the agent is in the account with every right that login carries, which is the prize it wanted. 1Password’s own notes on the Claude build say so in plain language.

The agent acts inside the signed-in session. After a successful sign-in, what the agent does on the website is governed by the agent product’s own safeguards. 1Password’s guarantees cover the storage, approval, delivery, and filling of credentials, not the agent’s behavior once a session exists.

1Password, security documentation for 1Password for Claude

Those notes also warn that submitted values then belong to the destination site and any script on that page, which is true of a human login too. 1Password fills only into pages that match the websites saved on the item, then tries to get the secrets off the page before the agent looks. What it does not do is sit in the session and approve the next click, the next transfer, or the next call to support.

That is why the product can be both a real upgrade over pasting a password into chat and a weak answer to a bank that cannot tell a customer from a bot. Browser agents already land on sites that never signed up to host them, and some runs have used public code hosts as unpaid compute. A vault that types the password and then steps back still leaves the destination to police whatever happens next.

Schwab Is Already Turning Muse Away

Charles Schwab is the shop that has put a weekly number on the collisions. Chief executive Rick Wurster said the brokerage blocks unauthorized agents, including Meta’s Muse, across its client base week after week, and that it will not let those tools move money. He wants clients in Charley, Schwab’s in-house assistant, which began rolling out in October to eligible U.S. retail clients, rather than handing a password to Muse.

JPMorgan is on a similar path with its own cash-sweep tools inside the bank’s apps, while still letting outside agents read balances through Plaid. The pattern is consistent. Lenders will let a helper see a number. They will not let a helper they do not run press the button that sends funds.

1Password’s consumer pitch cuts across that line. Muse, Grok Bot, and the rest of the launch list are the same class of outside agent those banks are fencing off. A cleaner fill does not mint a bank’s blessing. It can make the login look more like a person, which is the opposite of the signal fraud teams say they lack.

Six Agents at Launch, Nine More Coming

The October 22 blog names six personal agents and then a longer bench of companies 1Password says it is building with. Shipping dates are not the same as the logo reel on the launch post.

STATUS ON OCTOBER 22

Nine more sit on a coming-soon list: Instinct, Browserbase, Browser Use, Dana, KERNEL, Perplexity, Ramp, Tomo, and Wajo. 1Password’s line to those builders is that they make the agent and it secures the sign-in. Safeguards, the blog says, vary by integration.

David Singleton of Meta Superintelligence Labs, quoting the launch, said the Muse hookup “gives you another secure way to let Muse sign in and keep working: you approve each login and your passwords stay in your vault.” That is the consumer sale. The bank sale has not been made, and the launch materials do not claim it has.

Why Passkeys Did Not Make This Release

A day after the launch post, 1Password replied to a user that passkeys are not supported in the first release, so passkey-only accounts cannot be used through the new hookups. “Passkeys present unique challenges for personal agents, particularly around verifying user presence during sign-in,” the company wrote, adding that it intends to support them and is working with input from the FIDO Alliance.

That gap matters because a passkey is bound to a person and a device in a way a filled password is not. Until that work lands, 1Password for Agents will keep typing the old secret, then stepping back while the helper works inside the signed-in session. The vault never showed the agent the password. The website, and the bank behind it, still see a login that looks like you.