1Password has launched an integration that allows Claude to authenticate on websites using credentials stored in the manager. The password and one-time codes are not sent to the Anthropic model: the user authorizes each request, and 1Password’s software enters the values directly into the webpage while the agent remains temporarily separated from the page.
Getting 1Password keys for Claude in 30 seconds
- Claude can use protected accounts without receiving the password or a one-time code.
- The user must authorize access through a separate request in 1Password.
- Agentic Mode hides the manager’s interface while the AI controls the tab.
- Authorization is limited to the session and approved credentials.
- The architecture protects secrets, but does not guarantee the decisions Claude makes after logging in.
The launch addresses a growing need as assistants move from drafting text to operating within browsers. An agent can compare prices, prepare reservations, or consult an enterprise app, but needs identity when encountering a login screen. Copying the password into chat would expose the secret to the model’s context; manually logging in would interrupt automation.
1Password’s proposal separates credential possession from authorization. Claude can request access and complete the task, but the 1Password app retains control over the secret value. The integration is now available on Mac for compatible individual, family, and business accounts.
How the Zero Exposure Architecture Works
1Password calls a “zero exposure” design a setup where the password does not appear in the conversation, does not enter the context window, and does not cross Anthropic’s infrastructure. Claude receives enough metadata to request the appropriate account and, after the process, knows whether login succeeded or failed. It does not receive the contents of secret fields.
When the agent visits a protected website, it sends a request to the 1Password desktop app. The user sees which credential is requested and must approve or deny access. There are no permanent permissions: a new agent session requires a new authorization.
After approval, 1Password decrypts the item within its own environment and transmits it to the extension via a end-to-end encrypted and authenticated channel. The extension uses the usual autofill engine, which verifies the domain matches the addresses stored with the credential.
| Step | What Happens |
|---|---|
| Claude finds a form | Requests access to a specific account |
| 1Password shows the request | The user reviews the reason and credential |
| User authorizes | The permission is limited to the session |
| 1Password fills the fields | The agent stops observing the page |
| Web processes login | Claude only receives the result |
| Request fails | The values are erased before returning control |
The most sensitive moment is during autofill, as the password must exist briefly within the form. To prevent Claude from capturing it, the agent ceases reading and following the page while 1Password introduces and transmits the values.
After the attempt, the extension analyzes the form. If submission is incomplete, it erases the data before reactivating the agent. The same logic applies to authentication codes, which also stay outside Claude’s context.
The initial version supports login items and OTPs. 1Password plans to add payment cards and identity data later, but those categories are not part of the initial release. To use this feature, desktop apps for 1Password and Claude, along with their respective browser extensions, are required.
What Claude Can Receive and What Remains Hidden
| Information | Agent Access |
|---|---|
| Requested account or item | Limited metadata |
| Associated site | Yes, to identify the destination |
| Password | No |
| One-time code | No |
| The rest of the vault | No |
| Login result | Yes |
| Post-authenticated session | Yes, within the controlled tab |
The integration also supports working across multiple websites during a single task. The user can approve a specific set of items for that session, but authorization does not carry over to future tasks or provide blanket access to the vault.
How Agentic Mode Protects When the AI Controls the Browser
Allowing an agent to control a tab introduces another risk: it could attempt to open the manager’s extension, click autofill suggestions, or access UI elements intended for the user.
To mitigate this, 1Password incorporates Agentic Mode. When it detects a compatible agent taking control, the extension removes suggestions, credential-saving prompts, and other interactive elements from the page. Claude can only use the authorized flow and cannot access other vault elements.
The lock applies to the controlled tab and ends when the session finishes or the tab is closed. Users can see when Agentic Mode is active and have the option to cancel.
This protection does not solely rely on Claude integration. 1Password designed the mode to extend to other browser agents, indicating that this feature is not an isolated connector but part of a broader access layer for autonomous systems.
| Measure | Risk Reduced |
|---|---|
| Hiding the 1Password interface | Prevents agent from clicking normal controls |
| Session-based authorization | Avoids persistent permissions |
| Limiting approved items | Keeps the rest of the vault out of reach |
| Pausating the agent during filling | Prevents observing secret values |
| Clearing fields after failure | Reduces exposure on the page |
| Domain verification | Limits autofill to associated sites |
This design is safer than giving a password directly to the model, but it does not make the agent fully trustworthy. 1Password’s protection ends once authentication is complete.
The Agent Does Not See the Password but Can Act Within the Account
Once logged in, Claude has the same capabilities as permitted by the account and the product of Anthropic. It can view data, modify settings, or complete transactions on the website.
1Password secures storage, authorization, and delivery of the credential. The company explicitly states it does not control the agent’s behavior after access. It also reminds that, once the form is submitted, values are in the hands of the destination website and any scripts running there, as in any conventional login.
| Scenario | Does 1Password Solve This? |
|---|---|
| The password appears in chat | Yes |
| The secret enters Claude’s context | Yes |
| The agent opens another credential without permission | Agentic Mode attempts to prevent it |
| Claude misinterprets an instruction | No |
| The agent modifies incorrect data | No |
| A website tricks the agent | Not fully |
| The target site is compromised | No |
| The user’s device is compromised | No |
The main security risk for browser agents remains injection of instructions. A text, email, ad, or document can contain prompts designed for the model to ignore the original request and execute another action.
Anthropic considers these attacks among the biggest security concerns for AI-based browsing. The company has strengthened defenses but does not claim absolute protection. An authenticated agent could be manipulated without the attacker knowing the password.
For example, a hidden instruction could try to make Claude copy account info, change a shipping address, or open another page. Zero exposure architecture prevents directly revealing the 1Password secret but does not stop all actions capable within an already-authenticated session.
Ambiguous commands also remain a risk. Asking the agent to buy the “cheapest option” does not specify details about quantities, returns, dates, or extra costs. Credential confirmation shows the user allows login but does not necessarily approve subsequent decisions.
Therefore, the next stage of agent-based identity management should incorporate more precise authorizations. A password grants full account access; a permission for agents should distinguish between reading, modifying, preparing, and executing.
1Password Aims to Become an Credential Intermediary for AI
The integration with Claude is part of a broader strategy. In May, 1Password introduced a local server based on the Model Context Protocol for OpenAI Codex. This system allows programming agents to use API keys, databases, and other secrets without copying them into files like .env, repositories, or messages.
In that flow, Codex can create and manage environments, query variable names, and run applications. Values are injected directly into the authorized process during execution, remain in memory as long as needed, and are not returned via the MCP channel.
The main difference lies in the destination:
| Integration | Type of Credential | Usage Method |
|---|---|---|
| Claude in browser | Users, passwords, OTPs | Auto-fill on a website |
| Codex via MCP | API keys and development secrets | Injection during execution |
| Future integrations | Personal and machine identities | Temporary, task-limited access |
Both solutions follow the same principle: the agent can utilize a capability without holding custody of the secret that enables it. The manager thus becomes an intermediary that authenticates the user, requests authorization, delivers the credential to the destination, and logs the access.
This evolution will be especially significant in enterprise environments. Agents will need to access SaaS apps, dashboards, databases, and internal services. Copying credentials into prompts or local files increases exposure and complicates revocation or auditing.
1Password seeks to transfer concepts already used for people and workloads—temporary access, minimal privileges, explicit approval, and traceability. Its integration with Claude shows that this model can also apply to conventional webpages, though it still depends on a traditional password.
The key is not simply handing over the vault to an AI. It’s allowing the manager to act on its behalf briefly. The credential stays outside the model, but the session it opens remains valuable and risky. Security now extends beyond protecting a password—it must also monitor what the agent can do with the identity just received.
FAQs
Can Claude read stored passwords in 1Password?
No. 1Password inputs the values directly into the form while Claude stops observing the page. The agent only receives limited metadata and the login outcome.
Is authorization required for each request?
Yes. There are no persistent permissions across sessions. The user must approve which credentials Claude can use for each task.
Does Agentic Mode prevent all risky actions?
No. It protects the extension and vault, but does not control the decisions Claude makes within an already-authenticated account.
Where is 1Password available for Claude?
The initial release works on Mac for individual, family, and business plans. It requires the desktop apps and browser extensions of both 1Password and Claude.
