6 common questions about 1Password for Agents

Personal AI agents can now book your vacation or send out the invitations for your next birthday party. Sooner or later, though, every agent runs into the same obstacle: the login screen. 1Password for Agents takes care of that step. With your approval, supported agents, from Muse to Instinct, can access your accounts without seeing your passwords.

KC Li, senior director of product management at 1Password, joined the Random but Memorable podcast to explain how 1Password for Agents works and why it beats pasting passwords into a chat. Here's what to know before you approve your agent's first sign-in.

Watch the full conversation with KC Li on Random but Memorable.

What is 1Password for Agents, and why should I use it?

Agents don't know your passwords, yet many of the tasks worth handing off require signing in. 1Password for Agents fills that gap. It gives supported agents what they need to get the job done and keeps your credentials protected.

When an agent reaches a sign-in page, it asks for access, and you approve or deny the request in 1Password. If you approve, 1Password fills your username, password, or one-time code directly into the sign-in form, and the agent signs in without seeing the credential.

In Li's words, it's "transparent, and you stay in control without giving up the convenience."

Until now, you had two options. The first was to watch the agent and type your credentials each time it got stuck, which eats into the time the agent was supposed to save. "If you're doing it yourself, you may also wonder, well, is the agent actually still on the screen? Is it looking at my passwords while I'm typing them in?" Li said.

Agents don't know your passwords, yet many of the tasks worth handing off require signing in.

The second option was to save your passwords in the agent app. Every app that holds a copy of a password is another place it could leak, and that number grows with each agent you add. "If you were affected by a breach and your password leaked, you would need to update it in all those places and remember where you entered it," Li said.

With 1Password, you update a password once, in one place.

How does 1Password for Agents work?

Every time an agent needs a new login, 1Password asks for your approval first, then fills it outside the agent's view. Here's how that plays out when an agent plans a birthday party on Evite. 

First, you connect your agent to 1Password. You do this once per agent, and the connection stays in place until you disconnect it. With the connection in place, the agent can request a sign-in, but it can't access your vaults. "Without a connection, that agent can never access your passwords, so you're always in control," Li said.

 “You're always in control.”

Next, you give the agent a task, like sending party invitations. When the agent realizes Evite requires a login, it asks you for access to that account.

Then you decide. Tapping Approve in the agent app opens 1Password, which verifies that the request comes from you. Li said, "You can then review what the agent wants to do and the account it's trying to access. If everything makes sense, you select approve'"

Now the agent heads to Evite in a browser running on its own computer in the cloud. When it arrives, it hands 1Password a digital signature that proves you approved the request, and 1Password verifies it. "At that moment, the agent disconnects from the browser, so it's no longer looking at the page. 1Password takes over, fills the credential and signs in for the agent," Li said.

Finally, 1Password tells the agent it's done. The agent reconnects to the browser, already signed in, and gets back to designing your invitation.

Why shouldn't I paste my passwords into an AI chat?

Staying secure is about managing risk. "Nothing is certain, but good practices can reduce your risk. Just as driving below the speed limit is a sensible way to reduce your risk of crashes, you shouldn't expose plaintext passwords," Li said.

When you paste a password into a chat, you hand it to an app without knowing exactly how that app stores or protects it. By contrast, 1Password publishes its security model, and millions of people and over 200,000 businesses trust it. 

"With 1Password, we've put a lot of craft and care into our zero-knowledge encryption approach, so every password stored in 1Password is encrypted in a way that even 1Password can't access," Li said.

“We've put a lot of craft and care into our zero-knowledge encryption.”

AI adds a second risk. Models are non-deterministic, so the same prompt won't always produce the same behavior. Agents are also goal-oriented, and a password you pasted into a chat can stay within reach long after you've forgotten sharing it. "So it might still have a goal you gave it long ago and have since forgotten. Your agent may have the best intentions, but it could access your passwords and take actions you didn't expect," Li said.

With 1Password for Agents, your passwords stay in 1Password rather than in your chats or agent apps, and you decide which accounts an agent can sign in to.

Does 1Password for Agents protect against prompt injection attacks?

Not directly. 1Password for Agents can't stop an agent from being manipulated, but it limits what a manipulated agent can reach and lets you cut it off at any time.

Prompt injection is an attack that tries to steer an AI model into acting against the wishes of the people who built it or the person using it. Because models are non-deterministic, it's hard to measure how often these attacks succeed. AI companies build protections against prompt injection, but as Li noted, "like everything in security, nothing is zero risk."

You can disconnect an agent at any time, on 1Password.com or in the agent's app. Doing so deletes the connection and every approval, so the agent can no longer access your accounts. Li compared it to "putting a giant iron gate over your door."

“It's like putting a giant iron gate over your door.” 

Even before you need that gate, an agent can only use the logins you've approved, not everything in your vault. "It only has access to the things you've given it access to," Li said. 

These controls work alongside the ones agent apps already offer, such as steering an agent mid-task or shutting it down completely.

When does the agent's access to an online account end?

1Password controls whether an agent can sign in. What the agent does inside the account depends on the agent app, the website, and the instructions and guardrails in your prompt. "What the agent can do after that access is granted is the responsibility of the agent companies," Li said.

Once the agent is signed in, the website decides how long the session lasts, just as it would in your own browser. Some sites, especially sensitive ones like your bank, sign you out after a few minutes of inactivity. Others keep you signed in until you sign out or close the window.

You can also ask your agent to sign out or end the task immediately. As Li put it, "there are controls that agent companies have already put in place to direct your agent in the same way you would personally close a browser window, shut down your computer, or sign out."

What task should I give my personal agent first?

Pick a task with a clear goal or outcome, ideally one you find frustrating, unfulfilling, or time-consuming. Li uses an agent to book tennis lessons:

"I'm always late to book, which means I miss out on lessons. So I have an agent monitor that for me. The agent knows my schedule, my tennis level, and which instructors I like and don't like. It can then tell me, okay, a lesson is available at this date and time, and it's added to your cart. Then I need to give it one last look and approve the transaction."

The agent does the watching and waiting; Li still makes the final call.

Start small, and learn which tasks your agent handles reliably. Some websites block automated access or ask for extra verification, so a few tasks may still need you.

Start small, and learn which tasks your agent handles reliably.

As agents get more capable, you can hand over bigger jobs. Your list will look different from anyone else's, and Li thinks that's the point: "I'm sure everybody has their own thing, which is why they're called personal agents, right? It's bespoke to your goals in life."