1Password launches AI agent password authorization feature: agents can log into accounts but cannot read passwords

As AI agents gradually shift from answering questions to performing actual operations, users have begun letting them handle complex tasks that require logging into accounts, such as managing online services, accessing work platforms, or completing cross-website operations. But traditional approaches usually require users to hand their passwords to the AI, or to personally take over the browser each time the agent needs to log in. These two approaches respectively carry the problems of credential exposure risk and low operational efficiency.

1Password hopes to change this model through a new authorization mechanism. Under the company's design, AI agents can request the login credentials for a specific account, but cannot directly read the password itself. Users still hold the authorization power and can decide whether to allow the agent to use a given credential, rather than opening the entire password vault to the AI.

Specifically, when an AI agent visits a website that requires login, it uses a unique digital key to prove its identity to 1Password. 1Password then sends a notification to the user explaining which account's credential the agent needs to use and the reason for requesting authorization. The user can approve or deny the request on their own device.

If the user approves, 1Password will fill the required login information directly into the website's login interface, rather than sending the password to the AI agent in text form. The agent can then continue performing the task, but will not directly see or handle the user's actual password.

This design has a certain similarity to traditional two-factor authentication: sensitive operations require active confirmation by the user. However, the two are not entirely the same. Two-factor authentication is mainly used to confirm the identity of the person logging in, whereas the core goal of 1Password for Agents is to enable users to authorize and control the behavior of AI agents using account credentials.

1Password CEO Ashish Tripathi said that AI agents have already begun completing actual work on behalf of users, and the old approach of directly handing over credentials and then hoping the system runs securely is no longer suitable for this development trend. He believes that agents should be able to complete the tasks users assign to them, but should not thereby gain permanent access to all of a user's accounts.

According to information published by 1Password, the feature will support a variety of AI agents and tools, including Meta Muse, ChatGPT Work, ChatGPT Dots, Claude Duet, Grok Bot, and Town. At the same time, platforms such as Browserbase, Browser Use, Dana, Instinct, Kernel, Perplexity, Ramp, Tomo, and Wajo are also advancing related integrations, and more partners are expected to join in the future.

This means that 1Password hopes to further develop itself from a traditional password management tool into an identity verification and access control layer for AI agents. As AI ceases to merely generate text and begins logging into websites, reading information, and performing operations on behalf of users, how to confirm agent identity, limit their permissions, and track their behavior in using credentials will become increasingly important.

However, this mechanism does not mean that AI agents can operate accounts without any risk. Even if the agent cannot directly see the password, it may still perform operations permitted by the user after obtaining authorization. If the AI is misled by malicious web content or affected by a prompt injection attack, it may attempt operations that the user does not want to happen. Therefore, users still need to carefully review authorization requests and remain cautious about tasks involving funds, personal information, or important account settings.

1Password has previously also reminded users to pay attention to the security risks brought by AI-assisted browsing. For example, if an AI assistant in the browser can read untrusted web content and the 1Password extension is in an unlocked state, malicious content could induce the agent to attempt browser operations that the user would originally be able to perform. In response, 1Password recommends that users turn off unnecessary auto-login features and lock the extension when browsing untrusted content or leaving their device.

The credential authorization feature for AI agents launched this time is precisely an attempt to establish a clearer boundary between automation efficiency and account security. Its core idea is not to let AI obtain more secrets, but to let AI obtain the limited permissions needed to complete specific tasks without coming into contact with secrets.

As AI agents gradually enter office work, shopping, account management, and enterprise business processes, traditional password management tools may also need to redefine their role. In the future, password management services will no longer merely help users store and autofill passwords, but may also be responsible for managing which AIs can access which accounts, the specific scope of each authorization, and when authorizations expire.

For users, this model is expected to reduce the risk brought by directly providing passwords to AI, while also reducing the trouble of repeatedly logging in manually when performing complex tasks. But whether it can truly become a universal security standard for AI agents still depends on the adoption by more platforms, the reliability of the authorization mechanism, and the security performance of different AI systems in actual use.