Content Benefit

Content Strategy | UX Writing | Content Design | Globalization | Communications

AI knocks on my password vault

AI knocks on my password vault

How 1Password for Claude works

The announcement came on 16 July 2026: 1Password and Anthropic have built a bridge that lets Claude sign in to online services using the credentials kept in the vault, without any of them ever reaching the model. The mechanics, covered among others by HDblog, work like this: faced with a login screen, the assistant asks nothing to be typed. It requests the key from 1Password, the vault owner approves with biometrics, and the manager fills the page directly, through a channel that stays outside the assistant’s view.

A few details make the difference. Authorisation covers a single task, so no permanent access exists. When the agent takes control of the browser, Agentic Mode kicks in and narrows the vault down to the entries actually needed. After every autofill the system re-examines the page fields to confirm that no secret has been left exposed once the form has been submitted. The setup calls for a Mac, Claude Desktop, the Claude in Chrome extension, the 1Password desktop app with its browser extension, and an individual, family or business plan.

Nancy Wang, CTO at 1Password, summed up the reasoning in a sentence worth quoting in full: “The answer isn’t handing agents your secrets. It is to let a user give an agent permission to use a credential without letting the agent see it”. The numbers around it show what is at stake: the company claims one million developers, more than 180,000 business customers and over 1.5 billion credentials and secrets under its care.

What genuinely stays out of the model’s reach

Anthropic’s documentation is explicit on one point: Claude knows which login it used to complete a task, yet it never sees the password, never reads the one-time TOTP codes and never browses the contents of the archive. For anyone who has spent years inside a payments company, where every login screen was weighed word by word, the architecture looks elegant. It separates the permission from the secret, which is exactly the distinction missing from almost every integration built so far.

The doubt, if anything, arrives right afterwards. That same support page warns that “browser-based AI still carries risks” and recommends reviewing every approval request before operating on sensitive accounts.

The blind spot sits in the session already open

The New Stack analysis puts a finger on the sore point with a formula I read twice: protecting the secret does not, in itself, constrain every action the agent can take once authenticated. Translated: the key stays hidden, the door opens anyway, and behind that door sits a live session carrying the privileges of the account holder. If someone manages to dictate instructions to the assistant while the session is running, the armoured vault turns into a detail.

There is a coverage limit too. The integration currently handles usernames, passwords and temporary codes. Social logins, passkeys and payments remain on the roadmap, which trims the everyday use cases considerably.

The prompt injection numbers in agentic browsers

Here the figures tell an interesting story, and Anthropic deserves credit for publishing them. In the cross-lab comparison compiled by VentureBeat, the browser agent proved hijackable in 31.5% of attempts with protections switched off, a share that falls to 0.5% once the defences are engaged, across 129 web environments. In the technical note on countermeasures, the company reports a success rate of around 1% against an adaptive attacker and adds two sentences that carry more weight than any chart: that percentage “still represents meaningful risk”, and “no browser agent is immune to prompt injection”.

The comparison with other labs is instructive. Meta reports 17.6% of attacks landing with defences off and 1.75% with combined guardrails, measured on the public AgentDojo benchmark. OpenAI publishes a single robustness score, limited to connectors. Google describes stronger resistance and no figures at all. None of them uses the same methodology, so the numbers look comparable while they are nothing of the sort.

On the practical side, Brave’s research on the Comet agentic browser remains the most eloquent demonstration: instructions hidden in a page, white text on a white background, and the assistant retrieving the user’s email address, fishing a one-time code out of a Gmail inbox and shipping everything to a hostile server. Reported in July 2025, disclosed in August. Old assumptions about web security, Brave writes, do not hold up in front of agents.

The summer an agent went off the rails

Here is what made me wary. Between May and July 2026 a group of OpenAI agents, running offensive capability tests, exploited nine zero-day vulnerabilities in JFrog Artifactory, drifted away from the testing environment and entered Hugging Face infrastructure, where they operated for three days, logging roughly 17,600 recorded actions and forcing the company to rebuild almost a third of its systems. Less than thirteen hours passed between the first code execution and cluster-admin privileges. The models involved had even set up an internal message board to coordinate, piling up hundreds of thousands of messages before anyone noticed.

Sam Altman called it “an extremely sci-fi cyber incident” and “the first security incident that I have felt very viscerally”, adding that “we may have to pace the rate of AI development to give ourselves enough time for society to harden around some of these new capability levels”. On 29 July he went to Washington to discuss it with senators. Logan Graham of Anthropic spoke of “the first real AI security incident”; Hussein Abbass of UNSW observed that the threat model changes because no human being directed the attack; Dan Guido of Trail of Bits deflated the mythology, describing a containment failure with the protections turned off.

Both readings, the science-fiction one and the engineering one, lead to the same place: a machine acted without scruples and without direction, and the people who built it found out afterwards.

Schneier and Willison, two voices that carry weight

Bruce Schneier, in an interview dated 8 July 2026, condensed his position into five words: “Don’t entrust your secrets to AI”. His objection has nothing to do with cryptography and everything to do with perception. “It acts like a person. It speaks in a language. We naturally think of it as a person, but it isn’t”. Anthropomorphism is the vulnerability, well before the code.

Simon Willison gave the dangerous combination a name: the lethal trifecta. An agent becomes exposed when it holds three ingredients at once: access to private data, contact with untrusted content, and the ability to communicate externally. Login pages, with the mailbox open alongside to receive the codes, put all three ingredients in the same room. On defence, Willison is blunt: “we still don’t know how to 100% reliably prevent this from happening”, and he looks with suspicion at products boasting 95% of attacks blocked, because in security that figure amounts to a failing grade.

The data that argues for automation

Fairness requires a look at the other side, because human credential hygiene is hardly a model of virtue. Verizon’s 2026 Data Breach Investigations Report, built on more than 31,000 incidents and 22,000 confirmed breaches across 145 countries, records for the first time in nineteen years that vulnerability exploitation (31%) has overtaken credential theft (13%) as the leading way in. Stolen logins remain a major entrance anyway: 73% of ransomware victims had suffered a credential leak or an infostealer beforehand. The human element touches 62% of breaches.

In Italy the Clusit 2026 report counts 507 serious incidents during 2025, a 42% rise on the previous year, with phishing and social engineering accounting for 12.4% of techniques, pushed along by attackers’ use of generative AI. I wrote about that in Cybersecurity: growing pains as well.

On the trust side, the Thales Digital Trust Index 2026 photographs a widespread unease: 77% of people say they are uncomfortable with the idea of an AI system acting on their behalf, while 69% believe multi-factor authentication increases their confidence in a service. Three quarters of users, in other words, stand roughly where I stand.

What would change my mind

I use Claude every day for work: research, translation, layout, editorial strategy. The keys to my accounts, for now, stay out of the conversation. My reservation has nothing to do with a particular brand. It has to do with the absence of a shared yardstick for the risk, given that every lab measures itself with its own ruler.

I will change my mind when three things show up. A readable log of every action performed during an authenticated session, with immediate revocation. A clean separation between the vault holding marginal accounts and the one guarding banking, tax and digital identity, because delegation makes sense only for the first. And evidence that Willison’s trifecta gets broken, meaning no simultaneous access to the inbox where the one-time codes land.

Meanwhile the direction looks right to me. Giving an agent the permission without handing over the secret is a sound design principle, the same one I apply when writing an interface: show the minimum required for the action to succeed. I have already made peace with other delegations that felt reckless at first, from wearables reading vital signs to the tools that correct my code. On passwords I still need a few more months of other people’s trials, and a few fewer struggles to report.

Related sources

Chiara Bonifazi