1Password’s new browser integration for Claude changes how AI uses your credentials
The New Stack Amanda Caswell ● Covered by 2 sources
1Password now lets Claude log into sites for you without ever seeing your password. It decrypts credentials on your Mac and hands them straight to the browser, keeping secrets out of the AI's view.
Based on reporting by The New Stack, Amanda Caswell — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Password managers were built for humans clicking checkboxes, not AI agents juggling a hundred logins a minute. That mismatch is starting to get fixed. 1Password just shipped a new integration with Anthropic's Claude that lets the AI sign into accounts on your behalf while never actually touching your password, your one-time code, or anything else sitting in your vault.
The mechanics are straightforward once you see them. When Claude needs to log into a site, it asks 1Password to handle it. 1Password decrypts the credential locally on your Mac, using the same autofill engine it's always used, and injects it directly into the target site through a secure channel. Claude sees the result — a successful login — but never the plaintext password or the code itself. Nancy Wang, 1Password's CTO, told The New Stack the company designed this specifically so nothing sensitive ever lands in the model's context window.
The more interesting design choice is what happens the instant an agent grabs the wheel. 1Password flips into something it calls Agentic Mode, which locks the vault down hard. Claude can't browse your saved logins, can't search around, can't pick and choose. It gets access to exactly the credential needed for the task at hand, and nothing more. You approve each session with a single Touch ID tap or password entry, and that approval expires the moment the task is done. No lingering access between sessions, no forgotten permissions piling up.
But credential protection and behavioral safety are two different problems, and Wang is upfront that this only solves the first one. Once Claude is logged in, it's operating inside an authenticated session, and a cleverly crafted prompt injection could still steer it toward requesting things you never intended or clicking through actions you didn't approve. 1Password's answer is a second layer: every request surfaces in a 1Password-controlled interface where you can look at it and say no, and every autofill gets scanned afterward to make sure nothing leaked into a form before control hands back to Claude. It's a mitigation, not a cure.
Right now this only covers usernames, passwords, and TOTP codes, and it's Mac-only, tied to Claude's desktop and browser apps. Passkeys, payment cards, and social logins are coming later, according to Wang, and she expects the core idea — agents that use secrets without ever holding them — to spread well beyond Claude eventually. Given that companies like Coinbase are already running well over a thousand agents in production environments, that spread probably needs to happen fast.
My take — AI-written commentary, not fact-checked reporting
This is the right instinct executed at exactly the right moment — agents are already doing real work with real accounts, and shoveling plaintext passwords into an LLM's context window was always going to end badly for somebody. That said, scoped credential access doesn't neutralize prompt injection, and 1Password knows it; the UI approval layer is a patch, not a fix, and I'd bet the first big agentic-AI security incident comes from exactly that gap rather than a leaked password.
Read more about this at: The New Stack