1Password is developing safeguards for AI agents and discussing proactive security features

A 1Password representative described a system intended to limit AI agents’ access to secrets: secrets do not enter the model context, are not stored in files that other agents can find, and are delivered to an agent only for a specific task. The company is working with partners on ways to set the scope and duration of that access. The representative named Instinct, MetaMuse, and Grokbot among the partners, saying the collaborations have been underway for months.

The company is also considering proactive consumer security features. As an example, the representative raised finding reused passwords and changing them, but described this as a possible direction, not a feature already in operation. He said such capabilities would be developed with partners while preserving the zero-knowledge basis of the vault and using confidential computing when secrets need to be decrypted. Separately, he expects 1Password to develop more controls over users’ preferences and some kinds of context.

On multifactor authentication, he called hardware keys the most secure option, while noting their practical challenges. He said he uses passkeys as a second factor whenever possible; for users concerned about security, he recommended at least TOTP or passkeys and described SMS as more vulnerable because of SIM swapping. He also warned that cheaper, automated attacks make any standing access a potential risk.