1Password for Claude: Agents Log In Without Ever Seeing Your Password

1Password and Anthropic launched 1Password for Claude on July 16, 2026, giving Claude's browser agent the ability to complete tasks that require signing in — booking travel, managing subscriptions, filling out forms behind a login wall — using credentials pulled from a user's 1Password vault. The headline detail isn't that an AI agent can now log in for you. It's *how* it does it: the credential never touches the model.

The architecture: injection, not disclosure

Most "agent with your passwords" designs work by handing the model the secret as text — a pattern that's one prompt-injection or logging bug away from leaking a credential into a transcript, a training pipeline, or a support ticket. 1Password's design avoids that class of failure entirely. When Claude needs to authenticate, 1Password surfaces which credential is being requested and why, requires biometric user approval, and then injects the value directly into the destination page's form fields — bypassing the model. Per 1Password, the system also verifies the secret wasn't exposed after autofill and clears the filled value if submission fails.

This is scoped access control applied to an agent instead of a person: the agent gets *permission to use* a secret for one task, not *possession of* the secret. Nancy Wang, 1Password's CTO, put it directly: "The answer isn't handing agents your secrets. It is to let a user give an agent permission to use a credential without letting the agent see it."

Agentic Mode: a kill switch for the extension itself

The integration ships alongside Agentic Mode, a standalone feature in the 1Password browser extension. When a compatible AI agent takes control of the browser, the extension automatically locks down — the interface hides, and the agent's reach is limited to the specific logins and one-time codes approved for the current task, with the rest of the vault staying inaccessible. Notably, Agentic Mode works even without the Claude integration configured, which reads as 1Password treating "an AI agent is now driving this browser" as its own distinct security state worth defending, independent of which vendor's agent it is.

Why this matters beyond password managers

For anyone building agentic systems — trading bots that need exchange API keys, ops agents that touch admin panels, coding agents that need to authenticate to internal tools — this is the reference pattern for the next year of "agent needs a secret" problems: broker the credential through a system the agent doesn't control, scope it to one task, and never let it land in the context window. Stuffing an API key into a system prompt or a .env an agent can read is the equivalent of the old handing-the-model-your-password design. Treat this launch as a signal that credential brokering, not credential storage, is becoming the expected baseline for agentic tooling.

The rollout is deliberately narrow for now: Mac only, and it requires both the 1Password and Claude desktop apps alongside their respective browser extensions, available to Business, Family, and Individual 1Password plans. That's a sensible way to ship a capability this sensitive — small surface area, real user confirmation step, expand once the failure modes are understood.