Your AI can now book your trip. It just can't see your password.

For two years, when an AI agent tried to book a flight or pay a bill on your behalf, the choice at the login screen was the same: hand it your password, or watch it fail. 1Password just shipped a third option for Anthropic's Claude, and it is the first draft of the credential contract every AI agent will have to sign.

The product is called 1Password for Claude, and it lands in the middle of a tension that has shaped the agent era. Letting an AI act on your behalf means letting it log in for you. Letting it log in means giving it your password. The default workaround, copying a secret from a vault into a chat, defeats the point of the agent and leaves a raw password in a transcript. The other default, handing the agent a long-lived API key or a saved session token, moves the risk from the prompt to the credentials store, where it can sit for months.

1Password's answer is a credential-injection bridge. The password and the one-time MFA code flow through a 1Password-managed channel straight into the browser field, 1Password says, without ever sitting in the model's context, its memory, or Anthropic's servers. The company calls the design a "zero-exposure security framework." That is marketing language, but the underlying mechanic is real and worth understanding, because it is the pattern other vendors will copy.

Three details determine whether the pattern actually works. First, scope: access is per-session and limited to specifically approved vault items, so a user can grant Claude the login for an airline without exposing the bank. Second, lifetime: those grants do not carry over between sessions, so a previous task's credentials are not sitting around for the next prompt to find. Third, post-autofill: 1Password scans the page after every autofill for exposed secrets, an acknowledgement that the browser is the place where the credential actually lives, even if the model never sees it.

Alongside the Claude integration, 1Password introduced an Agentic Mode that triggers the same lockdown whenever any AI agent is detected in the browser. It ships with Claude first and is slated to expand "as the ecosystem grows," which is the most important sentence in the announcement. 1Password is positioning itself as the credential layer beneath every agent, not just the one Anthropic runs.

The availability frame is narrower than the ambition. At launch the integration works on Mac for business, family, and individual plans, and it requires the 1Password desktop app, the browser extension, and Claude together. The hydrated source did not surface Windows or Linux availability, exact launch date, or pricing in the visible excerpt, and 1Password's announcements are the only source for the security claims, so the guarantees should be read as vendor self-description until a third-party audit lands. Engadget's coverage and Thurrott's both carry 1Password's framing without independent technical validation.

The right question for any reader is not whether to let an AI log in for them but who is in the trust chain when it does. Today, for Claude users, the chain is the 1Password desktop app, the 1Password browser extension, the 1Password injection channel, and Anthropic's agent runtime. Move the agent, move the password manager, or change the channel, and the answer changes with it. 1Password also published a related AI-agent security benchmark that positions the company inside the agent-trust stack, worth watching as more vendors ship competing bridges.

The 1Password-for-Claude launch is a worked example of how a real agent credential contract could read: scoped, short-lived, audited after the fact, and with the secret staying on the user's side of the line. The follow-up question, the one any reader should ask before granting any agent access to anything sensitive, is who audits the injection channel, and how often that audit is published.