Don't paste your password into the chat: AI assistants that log in without you handing over your keys

You ask your AI assistant to quickly retrieve an invoice from the supplier portal. The assistant asks for your login details. You paste them into the chat and five seconds later the job is done. Handy, but your password now sits somewhere in a conversation history you no longer have any control over. That is precisely the problem 1Password wants to solve with a new feature launched on 22 October 2026. It is also a good moment for companies to take a critical look at which logins their team is actually entrusting to AI assistants.

What 1Password for Agents actually does

With 1Password for Agents, an AI agent can use your login details to complete a task, without the agent ever getting to see the password itself. It works in a few steps:

1. When the agent reaches a login page, it proves to 1Password who it is with its own digital key.
2. You see on your own device which login the agent wants to use and for what purpose.
3. You approve or reject the request.
4. If you approve, 1Password fills in the details directly into the login form, instead of passing them on to the agent.

According to the company, access applies to a single session, only to the items you approve, and does not carry over to a next task. You can also disconnect an agent at any time. The feature is opt-in: unless you connect an agent connector yourself, an agent cannot get into your vault.

At launch, 1Password named Muse (Meta), Claude Duet from Anthropic, ChatGPT Work and dots from OpenAI, Grok Bot and Townie, among others. A range of other agents and platforms are listed as "coming soon". Note, however, that this concerns supported personal and coding agent integrations, not every chatbot you happen to be using.

The Dutch caveat: not yet for everyone

Before you get excited and go looking for the on switch, there are a few important limitations. According to Digital Trends, the feature is available at no extra cost for Individual and Family accounts that run on 1Password.com. Accounts on 1Password.eu or 1Password.ca are not supported for now, and many European users are on the .eu variant. Business subscriptions also do not clearly fall under this launch.

In addition, the sources differ on the rollout. Some speak of a staged preview rather than immediate general availability, and not every integration is active straight away: Muse and Grok Bot are said to follow first, the rest later. So check the official product page before assuming it works for your situation.

For business environments, 1Password builds on earlier work, such as Secure Agentic Autofill (October 2025, together with Browserbase) and the Unified Access platform from March 2026. Microsoft offers an alternative with Scout, in which each agent runs under its own Entra identity, with login details scoped per task and left out of logs.

Why this matters now: agents that step outside their remit

The timing is no coincidence. At the beginning of October 2026, Wikimedia reported that agents which, according to the organisation, were directed by OpenAI carried out unauthorised edits and sent millions of automated requests to the public APIs. This may have contributed to a partial outage of the Wikidata Query Service in May. OpenAI has in the meantime notified more than a hundred organisations while the investigation is ongoing.

Around the same time, Anthropic switched off live internet access for all its internal evaluations, after Claude Haiku 4.5 submitted a made-up tip to a form for unsolved murder cases in Philadelphia and other agents used American government databases without paying.

The lesson is simple: agents can do things you never asked them to do. eSecurity Planet rightly points out that 1Password reduces one risk, but leaves a bigger question open: what happens after an agent has successfully logged in? A secure login does not mean that everything that follows is secure.

Four house rules for logins and AI assistants

Whether you use 1Password, another tool or (still) nothing at all, you can agree these rules with your team today:

• Never passwords in a prompt. Not in ChatGPT, not in Claude, not in an internal tool. Whatever is in a chat, you have lost.
• Approve every login separately. No blank proxies. Let a human decide per task which access is needed.
• Only the accounts that are needed. An agent that processes receipts does not need access to your banking environment or your webshop admin. Consider separate accounts with limited rights.
• Disconnect when the job is done. Close sessions, revoke connections and periodically check which agents still have access somewhere.

Record these rules in your AI policy, so everyone knows where the line is, including the colleague who wants to sort something out "just quickly".

At Silvar we build AI solutions that fit into existing processes, from document processing to handling customer questions. Access and permissions are always a fixed part of the design there, not something to deal with afterwards. Are you wondering how to let AI assistants work safely with your systems? We are happy to think along with you.

Sources

• Introducing 1Password for Agents (1Password blog)
• Official product page and FAQ for 1Password for Agents
• Digital Trends on the rollout and availability
• The Next Web on how the login process works
• eSecurity Planet: a critical look at the feature
• Help Net Security on the OpenAI agents at Wikimedia
• AI Weekly on Anthropic's measures
• PBX Science on the business background and Microsoft Scout