1Password has launched "1Password for Claude," a browser integration that lets Anthropic's Claude chatbot access stored credentials on behalf of users without the AI agent ever seeing the actual passwords or MFA one-time codes. The announcement came on July 16, 2026, via a 1Password blog post authored by Mitchell Cohen and Horia Culea titled "1Password for Claude: Give Claude access without giving up your credentials" (The Verge).

The integration is built on what 1Password calls a "zero-exposure security framework." Credentials are injected through a secure channel that the Claude agent cannot view. Claude can use stored logins to authenticate on a user's behalf, but the plaintext secret and any MFA one-time codes remain invisible to the model throughout the process (The Verge).

Access is granted per task rather than as a blanket permission. Each time Claude needs a credential, the user approves or denies the request through a single biometric prompt. When an AI agent takes control of the browser, 1Password locks down automatically, restricting access to only those credentials explicitly granted for the current task. After every autofill event, 1Password scans the page to ensure nothing in form submissions remains exposed before returning control to Claude (The Verge).

At launch, Claude's credential access from 1Password is limited to login-related details. Support for payment cards and identity details will follow after launch. The feature is available to 1Password users on Mac across business, family, and individual plans. It requires the 1Password desktop app, 1Password browser extensions, the Claude desktop app, and Claude browser extensions (The Verge).

This browser integration extends a relationship between 1Password and Anthropic that began earlier this year. In March 2026, 1Password launched "Unified Access for AI Agent Security," a broader initiative whose integration with Anthropic covers the Claude browser extension, Cowork, and Claude Code (1Password press release, March 17, 2026). On the developer side, 1Password offers a Claude Code shell plugin that authenticates the Claude CLI using an Anthropic API key stored in 1Password, with biometric authentication via fingerprint or Apple biometrics (1Password developer docs).

The architecture here matters because it addresses a specific failure mode that has shadowed AI agent autonomy from the beginning. When an LLM-based agent operates a browser, any credential it can read is, by extension, a credential that could be exfiltrated through prompt injection, a compromised page, or model behavior that deviates from the intended task. The standard approach of handing a plaintext password to an agent process and trusting it to use the password correctly is the thing 1Password is trying to make obsolete.

The zero-exposure framework works by keeping the credential injection entirely outside the agent's read path. Claude requests access to a login; 1Password presents a biometric prompt to the user; on approval, 1Password injects the credential into the target form field through a channel the agent cannot inspect. The agent gets the outcome it needs (an authenticated session) without ever holding the secret. The post-autofill page scan adds a second layer, checking that no residual credential data remains exposed in the DOM before the agent regains control.

This is a meaningfully different trust model from giving an agent a stored API key or a session token. The agent never possesses the secret at any point in the workflow. The blast radius of a prompt injection that successfully manipulates the agent is limited to what the agent can do within the scope of the explicitly granted credential, not to the credential itself. And because access is per-task with biometric gating, a compromised or confused agent cannot silently accumulate credentials across sessions.

The constraints at launch are worth noting. Mac-only availability limits the initial footprint. The requirement for both the 1Password and Claude desktop apps plus their respective browser extensions means the integration has a non-trivial setup surface. And the restriction to login credentials means that, for now, the integration handles authentication but not the broader set of tasks that would involve payment or identity data.

The Claude Code shell plugin is the more mature artifact of this partnership. It has been available in 1Password's developer documentation and handles a narrower problem: authenticating CLI access to the Anthropic API using a key stored in 1Password rather than in an environment variable or a plaintext config file. That plugin uses the stored API key to authenticate the Claude CLI, gated by biometric verification (1Password developer docs). The browser integration announced today generalizes that pattern from a single CLI use case to the broader, messier problem of an agent navigating live web sessions.

The trajectory from the March 2026 Unified Access launch to this browser integration suggests 1Password is positioning itself as the credential intermediary for AI agent workflows. The question that will determine whether this architecture gains traction is whether the per-task biometric prompt holds up under real usage. An agent that needs to authenticate across multiple services in a single workflow could generate several approval prompts in quick succession, and user fatigue with biometric prompts is a known friction point in security UX. How 1Password handles that tension between granularity and convenience will shape whether zero-exposure credential injection becomes the default pattern for agent authentication or remains a niche capability for security-conscious users.