The fastest way to make an AI agent useful is also the fastest way to make it dangerous: give it your passwords. 1Password took direct aim at that bargain on October 22 with 1Password for Agents, a system that lets a supported agent sign in to your accounts without ever seeing, handling, or storing the password itself. Chief executive Aashish Tripathi put the problem plainly in the launch statement: agents are starting to do real work on our behalf, and the old model, where you hand over a credential and hope for the best, does not work.
The flow is deliberately boring, which is the point. When an agent reaches a login page, it identifies itself to 1Password with its own unique digital key and requests a specific credential. You get an alert on your own device saying which login it wants and why, and you approve or deny it. Only then does 1Password fill the password, and any one-time code, directly into the sign-in form itself. The agent learns only that access was granted. The rest of your vault stays out of reach, and the credential is not left sitting in a prompt, a chat transcript, or the agent memory where a later prompt injection could go looking for it. At launch, Meta Muse and SpaceX Grok Bot are rolling out over the coming days, with Anthropic Claude Duet, OpenAI ChatGPT Work and dots, and Town Townie listed as coming soon, and partners including Browserbase, Perplexity, and Ramp working on support.
The timing is not an accident. Agents are now booking, buying, and browsing inside accounts that hold money and personal records, while banks report agentic activity they cannot always verify as genuinely requested, and Chase has warned customers never to share credentials with an agent. That is the gap 1Password is selling into. People are already delegating logins by pasting passwords into chats. The question is whether the credential ever has to leave a custodian built for the job, with human approval attached to every use.
Google made the same argument for data on October 24, taking its Data Agent Kit to general availability. The free, open-source kit connects the coding agent you already use, whether that is Claude Code, Codex, Cursor, or Antigravity, to more than 15 Google Data Cloud services through Model Context Protocol servers, and adds support for BigQuery Graph, Bigtable, and Managed Service for Apache Spark. Its guardrails come in two tiers that builders should copy: 37 advisory skills, including one that demands explicit consent before a destructive command such as a table drop, and a second, enforceable tier in IAM, where a deny policy or a read-only service account can block a tool outright, whether the model cooperates or not. Advice a model can ignore is not a control. A policy it cannot bypass is.
Distribution, meanwhile, is not waiting for the controls to mature. SpaceX launched its Super Intelligence Partner Network this week with more than 130 companies in early access, including Apollo, Nvidia, Snowflake, Databricks, Bain and Company, and Booz Allen Hamilton, to deploy Grok inside businesses, days after President Gwynne Shotwell said Grok Bot passed 800,000 paid weekly users in October, roughly double September. For builders, the lesson is practical. Never hand an agent a raw credential if a custodian can fill it instead, require approval per login, put hard limits in identity policy rather than in a prompt, and keep an audit trail you can read. Agents are getting the keys to everything. Who holds those keys is now a product decision.
