Concerns have been mounting over how much access consumers are entrusting to AI agents, and security services are now racing to catch up.
On Thursday, password manager 1Password launched a tool that lets users allow agents to log into their personal accounts on their behalf—without the agent ever gaining access to the user's credentials.
How 1Password for Agents Works
The new platform, called 1Password for Agents, operates through a three-way communication system linking the agent, the user, and the password manager. When an agent attempts to sign in on a user's behalf, it sends a unique digital key to 1Password to verify its digital identity. The user then receives an alert about the login attempt and can personally approve the request. Once confirmed, 1Password signs the agent in, filling in the credentials on the assistant's behalf so it can complete the task at hand.
Users can choose among a range of supported agents, including Anthropic's Claude Duet, OpenAI's Dots and ChatGPT Work, Grok Bot, Meta's Muse, and agents from the AI assistant startup Town. The company says it is working with additional companies to expand the service.
"Handing over a password, secret, or credential is a common shortcut to an agent, but can leave people with sensitive information in places they can no longer control as a copy gets saved for the next time," the company said in a blog post. "1Password for Agents gives people a trusted way to delegate tasks to personal AI agents while keeping control of the passwords, secrets, and credentials those tasks require."
Banks Are Detecting Agent Activity Inside User Accounts
Agentic activity online has increasingly unsettled major institutions. The launch coincides with an Axios report that U.S. banks have begun detecting agentic activity within user accounts.
This is not necessarily a case of rogue agents plundering accounts. Rather, it reflects how consumers are increasingly letting automated services act on their behalf, including in financial matters. Still, the potential for agent-related problems remains substantial. The core issue appears to be that most banks cannot determine whether agentic activity is tied to user requests.
Bankers interviewed by the outlet described the situation as "horrifying." A Chase spokesperson also told Axios that customers "should not give their usernames and passwords to anyone."
via TechCrunch AI