The plaintext password handed to an agent was always the wrong answer, and a password manager is a sensible place to fix it. On 22 October, 1Password announced 1Password for Agents, a platform that lets personal AI agents sign in to sites using credentials the agent never sees or stores.
What happened
The flow 1Password describes is a four-step exchange:
- An agent reaches a sign-in form and uses a unique digital key to verify its identity to 1Password.
- The person is shown which credential the agent is asking for and why.
- The approval happens on the person’s own device, which 1Password presents as confirmation that the permission came from them.
- 1Password fills the sign-in form directly rather than sending the credential to the agent, and the password stays in the vault while the agent continues the task.
The launch is backed by an unusually broad set of integrations for a first release: Muse (Meta), Claude Duet (Anthropic), ChatGPT Work and dots (OpenAI), Grok Bot (SpaceXSI) and Town’s Townie, with Browserbase, Browser Use, Dana, Instinct, KERNEL, Perplexity, Ramp, Tomo and Wajo named as additional partners.
The framing from 1Password’s chief product officer, Aashish Tripathi, is the KYA framing almost word for word: “The old model where you hand over a credential and hope for the best doesn’t work. An agent should be able to do the job it’s been asked to do without getting permanent access to everything behind the account.”
Why it matters for KYA
It separates permission from possession. KYA is often described as knowing who an agent is and what it may do. Most consumer agent deployments collapse both into “here is my password.” Splitting them means an agent can be granted use of an account for one task without ever holding the secret — and the secret remains revocable in one place, by the human, without changing it on twelve websites.
A per-agent key is the beginning of agent identity at the consumer layer. The agent authenticates to 1Password with its own key, so the vault — not the website — is the relying party that can tell one agent from another. That is a meaningful step: it creates a record of which agent asked for what, and gives the person something to approve, deny or revoke per agent rather than per password.
Approval on the user’s device is the strongest part of the design. Requiring the human to confirm on hardware they hold is a presence check, and it closes the obvious attack — a prompt-injected agent quietly requesting a bank login from inside an unrelated task — better than any in-chat confirmation.
But this is credential delegation, not agent identity to the relying party. When 1Password fills the form, the website still sees the human’s session. The site learns nothing about which agent acted, under whose authority, or for what purpose. From the site’s point of view this is still impersonation with better hygiene — and that is precisely the distinction KYA draws between an agent acting as you and an agent acting for you with a verifiable mandate.
Scope and lifetime are the open questions. The announcement says the agent verifies with a unique key and the person approves a request, but does not describe how the key is bound to a particular agent build, how long an approval lasts, or whether grants can be constrained to a single site action. Those details decide whether this is a durable control or a well-designed convenience. Agents that can retry a sign-in flow will test the answer in practice.
It also raises the value of the vault as an audit point. If most personal agent access flows through one password manager, that manager accumulates the closest thing to a consumer agent audit trail: which agent, which account, when, approved by whom. Whether 1Password exposes that as evidence to the user — and eventually to relying parties — is the thing to watch. The press release does not say that it does.
Caveats: partner availability varies by plan and platform, and no independent security review of the key exchange has been published. The quotes are 1Password’s own and from its launch partners.
Sources
- 1Password, “1Password for Agents Launches as the Trust Layer for Personal AI Agents”, press release, 22 October 2026 — 1password.com.
- 1Password, “Introducing 1Password for Agents”, product blog — 1password.com.
- 1Password, 1Password for Agents: secure AI agent integrations (product documentation) — 1password.com.
Note: the mechanism described is 1Password’s published description of the product; technical details of the agent key and approval lifetime were not disclosed at launch.
Know Your Agent (KYA) explains agent identity, verification and accountability. This is an explainer, not legal or compliance advice — see our Sources & methodology. New to KYA? Start with What is Know Your Agent? and the glossary.