1Password brings secure credential access to Claude's browser extension

1Password and Anthropic have shipped 1Password for Claude, a new integration that lets Claude fill in stored logins during browser tasks without the password or one-time code ever entering the model's context.

What's new

The feature targets a specific gap in agentic browsing: how does an AI agent sign in to a site on your behalf without you handing it your credentials directly? Anthropic's help documentation describes the basic flow: "1Password for Claude lets Claude complete browser tasks that require signing in, using logins you've stored in 1Password." The handoff happens automatically mid-task: "When Claude reaches a login page during a task, it requests the credential from 1Password instead of asking you to type it."

The security model is the core of the pitch. Rather than exposing the plaintext credential to the agent, the system injects it directly into the page: "the password and any one-time code never enter Claude's context, memory, or Anthropic's systems." 1Password's browser extension also locks down scope for the duration of an agent session through what it calls Agentic Mode — "a feature of the 1Password browser extension that protects your vault whenever an AI agent controls the browser" — limiting access to only the credentials explicitly approved for that task, and re-scanning the page after each autofill to make sure nothing leaked into the visible DOM.

Availability is currently narrow: "1Password for Claude is in beta for paid plans (Pro, Max, Team, Enterprise) using Claude Desktop on macOS." It requires a 1Password account on an individual, family, or business plan, plus the 1Password browser extension installed.

Context

Credential handling has been one of the persistent blockers to letting AI agents act autonomously in a browser — anything that touches a login page either requires the human to intervene or forces an uncomfortable choice about exposing secrets to a model. Password managers and AI vendors have circled this problem for a while; this integration is Anthropic and 1Password's answer, built specifically around Claude's computer-use and browser-agent capabilities rather than as a generic autofill bridge.

Why it matters

The zero-exposure design — crediential injected at the browser layer, never passed through the model's context or logged in Anthropic's systems — addresses a real trust barrier for agentic AI: users have been reasonably wary of letting an agent "see" passwords, session tokens, and MFA codes, since anything in a model's context can in principle be exfiltrated, mishandled, or retained. By keeping secrets out of the token stream entirely, this pattern gives users a more concrete security boundary for tasks like booking travel or managing accounts through an agent. It's also a template other AI vendors and password managers are likely to converge on: as agentic browsing becomes more common, expect similar zero-exposure credential handoffs to show up beyond just Claude, since 1Password has said the approach will expand to other agents as the ecosystem grows.