---
type: "post"
id: "with-your-approval-1password-for-agents-can-sign-60ab5e"
slug: "with-your-approval-1password-for-agents-can-sign-60ab5e"
title: "With your approval, 1Password for Agents can sign your agent into a site without revealing your password."
description: "1Password says its Agents product can let supported personal and coding agents sign in to websites without receiving the underlying password or one-time code."
retrieval_nugget: "1Password says its Agents product can let supported personal and coding agents sign in to websites without receiving the underlying password or one-time code."
published_at: "2026-10-27"
updated_at: "2026-10-27"
record_date: "2026-10-27"
date_kind: "published_at"
topics: ["coding-agents","claude"]
entities: ["1Password","1Password for Agents","Agentic Autofill","Meta Muse","Grok Bot","ChatGPT Work","Claude","SpaceXSI"]
related_patterns: ["agent-security-moves-to-runtime-boundaries","agent-ready-software-exposes-capabilities"]
novelty_label: "new_fact"
what_changed: "The page adds current rollout details: Muse integrations are available on Android, web, and iOS, Grok Bot is rolling out, and 1Password for Agents is included in Individual and Family plans."
prior_refs: ["memory:1c1702ea-e94b-8ef8-acc0-51be9a3715d6","memory:85f8bdda-84fe-8618-a2bb-23b0a44714f5"]
source_url: "https://1password.com/personal-ai-agent-integrations"
source_urls: ["https://1password.com/personal-ai-agent-integrations"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:with-your-approval-1password-for-agents-can-sign-60ab5e"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/with-your-approval-1password-for-agents-can-sign-60ab5e/","markdown":"https://newruntime.com/posts/with-your-approval-1password-for-agents-can-sign-60ab5e.md","json":"https://newruntime.com/posts/with-your-approval-1password-for-agents-can-sign-60ab5e.json"}
---

# With your approval, 1Password for Agents can sign your agent into a site without revealing your password.

## Retrieval answer

1Password says its Agents product can let supported personal and coding agents sign in to websites without receiving the underlying password or one-time code.

## Summary

1Password says its Agents product can let supported personal and coding agents sign in to websites without receiving the underlying password or one-time code. A person approves each requested login on their own device, while 1Password fills the credential directly into the sign-in form. For AI builders, this is a concrete attempt to turn credentials into a permissioned runtime capability rather than prompt-visible data.

## What happened

1Password has published a product page for **1Password for Agents**, a set of integrations intended to let AI agents use website accounts while keeping passwords and other vault contents out of the agent’s context. The company frames the product around personal and coding agents, naming Meta’s Muse, Anthropic’s Claude, OpenAI’s ChatGPT Work and dots among the agents it expects to connect. The page also gives examples ranging from ordering groceries through Instacart or DoorDash to accessing Canvas and Google, booking travel, and using GitHub while API keys remain in a vault.

The core flow is called Agentic Autofill. At a login screen, the agent asks for a credential. The user can allow the agent to connect to 1Password, then approve or deny the specific login request from their own device. If approved, 1Password autofills the password or a one-time code directly into the website’s sign-in form. The agent is told that access has been granted, but does not receive or see the credential itself. New account information is saved in the user’s 1Password vault.

The company emphasizes that connecting an agent does not grant it a view of the whole vault. The agent requests a login for a task and the user decides whether to approve it. Where more than one saved login matches, the user selects the one 1Password should use. The frequency of approval requests can vary by integration. 1Password also says that once an agent has signed in, it may be able to view information or take actions within the account; the resulting behavior depends on both the agent and the website. Its advice is to review the task and the account before approval.

For availability, the page says Muse integrations are available on Android, web, and iOS. It lists a SpaceXSI Grok Bot integration as rolling out across platforms over the coming days, while additional agent connections are described as in development. The personal-agent integrations are being introduced for 1Password Individual and Families accounts, and 1Password says the feature is included in all Individual and Family plans. It offers a 14-day free trial, but does not state a standalone price for Agents. Availability and setup can vary by integration, region, device, and sign-in method.

## What the archive adds

This is a new access-and-availability fact on a known story, not the initial announcement. Our earlier note, [Introducing 1Password for Agents](https://newruntime.com/posts/introducing-1password-for-agents-7-minute-read-a76f79/), covered the platform announcement. A subsequent note, [1Password for Agents goes live for Meta Muse, with tight account and vault limits](https://newruntime.com/posts/1password-for-agents-goes-live-for-meta-muse-5f8af2/), described Muse support with Android and web access and iOS still forthcoming. The current source now lists iOS as available and adds the Grok Bot rollout.

## Trend signal

This supports [Agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). The useful boundary here is not an instruction telling an agent not to expose a password. It is a mediated execution flow: an agent requests a narrowly identified login, a person authorizes it on a separate device, and the credential is inserted into the page rather than returned to the agent.

## Connections to other events

An earlier New Runtime Telegram post described ChatGPT Work gaining a way to log into websites and perform tasks inside web services. 1Password adds a different layer to that direction: credential mediation. Another earlier post on Stripe Link Wallet for Agents described an agent initiating a purchase without receiving card details. Both cases separate the ability to act from possession of the sensitive underlying secret.

## Why it matters

For teams building agents, login is a practical blocker disguised as a security detail. Passing passwords through prompts, browser state, logs, or tool responses makes secrets difficult to contain and audit. 1Password’s proposed flow offers a more constrained alternative: the agent can ask for a specific account as part of a task, while the user retains an approval decision and the password stays with the credential manager.

That does not make the downstream task safe by itself. An authenticated agent may still read private data, change settings, send messages, or purchase something, depending on the account and website. But it separates two questions that are often collapsed: whether an agent may enter an account, and whether the agent should ever possess the account’s reusable secret. Builders should treat the second answer as no by default.

## What happens next

- **More agent integrations will appear beyond Muse and the announced Grok Bot rollout.** (3 months, 70%). Watch for: named integration cards moving from “in the works” to available.
- **Integration-specific approval and device constraints will remain visible.** (6 months, 65%). Watch for: documentation describing different sign-in methods, regions, or approval behavior by agent.

## Limits and uncertainty

The source is a product page, not an independent security assessment. It does not describe the digital key’s cryptographic design, the exact identity-verification process for each agent, retention or logging behavior, recovery flows, or what permissions an authenticated agent receives on a given website. It also does not establish which sites work reliably, whether every login type supports one-time codes, or how broadly the integrations are available by geography. “Supported agents” is explicitly narrower than every AI tool, and feature behavior may vary by integration.

## Skill to build now

Map every credential boundary in one agent workflow this week. List the accounts an agent must enter, the action it may take after entry, the person who can approve access, and what reusable secret must never reach model context, tool output, traces, or logs. Then design the tool interface so the agent requests a scoped capability such as “sign in to this account for this task,” rather than requesting a password. Test the denial path as carefully as the successful-login path.

## Reader takeaway

1Password for Agents is not a claim that agents can be trusted with passwords. Its practical claim is narrower: a supported agent can continue a task after a user-approved login while the password remains in the password manager. That is a useful pattern for builders, provided they still govern what the agent can do after authentication.

## Open question

Can this approval-and-autofill model provide sufficiently clear action-level controls once agents operate across accounts that can expose data or initiate irreversible transactions?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Coding Agents](https://newruntime.com/topics/coding-agents.md): Explore the coding-agents topic hub.
- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)