1Password Agentic Mode for Claude: agents log in, never see secrets

1Password has shipped an integration for Claude on Mac that lets the agent sign into websites without ever seeing your password or one-time code. When a compatible agent takes control of the browser, the extension switches into a restricted state called Agentic Mode: the agent cannot browse or search the vault, gets only the credential approved for the current task, and loses access when the task ends. For anyone trying to put agents near real accounts, this is the first credible answer to “what can this thing actually reach?” that you can install today.

What happened

According to 1Password’s launch post for Claude, the integration is built on what the company calls a zero-exposure architecture. When Claude hits a login page, 1Password shows the user which credential is being requested and why. After biometric approval, 1Password injects the credential directly into the page. Claude never sees the vault item, the password or the one-time code, and access is scoped to the current task and ends when it completes.

The New Stack’s write-up of the agent authentication framework adds the engineering detail. 1Password CTO Nancy Wang told the outlet that decryption and filling happen locally on the user’s Mac using 1Password’s standard autofill engine, and that 1Password “does not return the plaintext credential to Claude or place it in the model’s context.” Each session is approved or denied with a single Touch ID prompt or a password, and there is no standing access between sessions. After every autofill, 1Password scans the page to check nothing has been left exposed; the launch post adds that if a submission fails, filled values are cleared before control returns to Claude.

Agentic Mode is the second half. It hides the extension’s interface when an agent takes over, so the agent cannot poke at the extension itself. 1Password says it works even when the Claude integration isn’t set up, supports agents beyond Claude, and requires nothing new to configure for qualifying enterprises.

It is available now on Mac across business, family and individual plans, and needs the 1Password desktop app and browser extension alongside the Claude desktop app and browser extension. The New Stack reports support for usernames, passwords and TOTP codes today, with passkeys, payment cards and identity details on the roadmap. One discrepancy worth checking before you rely on it: the launch post describes social logins working through the same flow, while The New Stack lists social logins as roadmap.

What it means for builders

Until now, the honest answer to “what does this agent have access to?” was “whatever the person running it has, with no clean audit trail.” That answer keeps agents out of finance dashboards, admin consoles and anything a security team signs off on. Separating use of a credential from possession of it is the right primitive. The model knows it logged in; it never holds the secret, so a leaked transcript, a poisoned memory or a verbose log cannot leak the password.

Our read is that this is less a Claude feature than a bid for a layer. 1Password frames it as one part of an access layer for agents across browsers, IDEs, repos, terminals and CI/CD, alongside its MCP Server for developer credentials, and Wang told The New Stack she expects the principle to extend to other agent frameworks. Whoever brokers credentials for agents ends up sitting on the trust boundary of every agentic workflow. That is a platform position, and it mirrors the wider fight over agent identity we covered when Google gave Gemini its own email address.

Be clear about what it does not solve. Wang was explicit with The New Stack that protecting the secret does not constrain what the agent does once signed in. The agent acts inside your authenticated session, so prompt injection is still a live risk: a malicious page could push the agent to request access you didn’t intend, or do something unexpected after login. The 1Password-controlled approval prompt narrows the blast radius, but someone still has to read it rather than reflexively tapping Touch ID.

What to do now

If you are building or piloting agents that touch logins, treat this as the reference pattern even if you never use 1Password. Concretely:

• Never put secrets in context. Credentials should be injected at the edge (browser, tool runtime, secrets broker), never passed through the model or stored in agent memory.
• Scope access to the task, not the user. One approval, one task, then expiry. Standing access for agents is the thing to design out.
• Put approvals in a UI the agent cannot control. We do the same with human-in-the-loop action tags on our own agents; the approval channel must sit outside the agent’s reach.
• Guard the post-login session separately. Read-only accounts where possible, spending limits, and logging of what the agent did, not just what it logged into.

For teams on Macs already using 1Password, the cheapest experiment is a low-risk read-only task, such as the Stripe revenue summary 1Password uses as its own small-business example, run with a dedicated agent account. Watch what the approval prompt tells you and what the agent does afterwards. That second part is where the remaining risk lives, and it is the part no credential manager will fix for you. If you want a fuller picture of layering controls between agents and accounts, our write-up on two Claude accounts and six locks in between walks through one practical setup.

Frequently Asked Questions

Does Claude ever see my password with 1Password for Claude?

No. According to 1Password and its CTO's comments to The New Stack, the credential is decrypted on your Mac and injected directly into the website. Claude can ask 1Password to sign in, but the plaintext password or one-time code is never returned to Claude or placed in the model's context.

Does this protect against prompt injection?

Only partly. It stops the secret leaking and limits which credentials an agent can request, but once the agent is signed in it acts inside your authenticated session. A malicious injection could still push it towards unintended requests or actions, so review approval prompts and restrict what agent-used accounts can do.

What do I need to use it?

A Mac with the 1Password desktop app and browser extension, plus the Claude desktop app and browser extension. It is available across 1Password's business, family and individual plans.