1Password

Its flows, and where AI agents are in them

How work moves through 1Password's product, as its public pages describe it, and the steps where an AI agent acts (4 steps with an AI agent in it, marked AI agent here). Each step cites its source.

A personal agent signs in to a website (1Password for Agents)

For an individual or family account: a person delegates a task that needs a sign-in, such as booking a flight, and 1Password fills the login in the agent's browser instead of the person sharing the password with the agent. Opt-in, for supported agent apps. (support.1password.com/1password-for-agents/, read 2026-11-06)

1. The person: Connects 1Password to a supported agent app. Connecting lets the agent ask 1Password to sign in; it does not give the agent access to the person's vaults. (support.1password.com/1password-for-agents/, read 2026-11-06)
2. The agent: Reaches a step of its task that needs a sign-in and asks 1Password to sign in. AI agent here: Carries out the delegated task (for example booking a flight or shopping for groceries) and asks 1Password for a sign-in when it needs one. (support.1password.com/1password-for-agents/, read 2026-11-06)
3. 1Password: Shows the person which agent is asking to sign in, with suggested logins for the website. (support.1password.com/1password-for-agents/, read 2026-11-06)
4. The person: Reviews the request and chooses whether to approve it. (support.1password.com/1password-for-agents/, read 2026-11-06)
5. 1Password: Fills the username, password and one-time password directly into the website's sign-in form in the agent's browser; the agent app makes sure the agent cannot see the sign-in page. (support.1password.com/1password-for-agents/, read 2026-11-06)
6. The agent: Continues the task, signed in. The person can disconnect the integration at any time. AI agent here: Completes the task without the credentials entering its chat. (support.1password.com/1password-for-agents/, read 2026-11-06)

An AI agent in a browser gets a credential (Secure Agentic Autofill, with Browserbase)

1Password's first implementation for browser-use agents, through Browserbase: credentials are injected into the agent's browser by the 1Password browser extension only when required and always authorised by a person, so the agent and the underlying model never see them. (1password.com/blog/closing-the-credential-risk-gap-for-browser-use-ai…, read 2026-11-06)

1. The person: Sets it up: 1Password shows a prompt that details what the agentic browser will be able to request from 1Password; Browserbase cannot access, see or modify anything in a vault without approval. (1password.com/blog/closing-the-credential-risk-gap-for-browser-use-ai…, read 2026-11-06)
2. The agent: Runs a workflow in the browser and, when it needs to sign in, informs 1Password that a credential is being requested. AI agent here: Executes the browser workflow and requests a credential from 1Password instead of receiving one in its prompt. (1password.com/blog/closing-the-credential-risk-gap-for-browser-use-ai…, read 2026-11-06)
3. 1Password: Identifies the appropriate credentials and asks the person for approval; where a site has more than one login, the person chooses which to use. (1password.com/blog/closing-the-credential-risk-gap-for-browser-use-ai…, read 2026-11-06)
4. The person: Approves or refuses in real time; every credential request needs a person's approval by default. (1password.com/blog/closing-the-credential-risk-gap-for-browser-use-ai…, read 2026-11-06)
5. 1Password: If, and only if, the person approves, injects the credential into the browser over an end-to-end encrypted channel (a protocol built on the Noise Framework) between the approving 1Password device and the extension in the remote browser, just in time. (1password.com/blog/closing-the-credential-risk-gap-for-browser-use-ai…, read 2026-11-06)
6. The agent: Carries on with the workflow, signed in; the credential never enters the model's context. AI agent here: Completes the workflow with access limited to the credentials that workflow needs (least privilege). (1password.com/blog/closing-the-credential-risk-gap-for-browser-use-ai…, read 2026-11-06)

Our question for them

As for every company we follow, three questions, not claims. We have not asked 1Password yet. When they answer, it goes here.

1. Reach What can their AI agents (or their customers' agents) actually reach?
2. Mandate What were they authorised to do?
3. Gap Who controls the gap between the two?

Where this comes from

• websummit.com/appearances/lis26/3ba8a8ea-2e10-48d9-84e3-fada56f21fd4/…, read 2026-11-01 by the team's curator: LIS26 appearance page: name, country, industry, website.
• websummit.com/partners/event-partners-2026/, read 2026-11-01 by the team's curator: listed on the 2026 event partners list with its elevator pitch (the "what" field).
• websummit.com/tracks/developer-summit/, read 2026-11-01 by the team's curator: Developer Summit track page names 1Password (Nancy Wang) among featured speakers; may be a past-edition highlight.
• support.1password.com/1password-for-agents/, read 2026-11-06 by the team's curator: 1Password Support, "Use 1Password to sign in to sites with supported agents": how 1Password for Agents fills a login when a person's agent needs to sign in (the flow agent-sign-in).
• 1password.com/blog/closing-the-credential-risk-gap-for-browser-use-ai…, read 2026-11-06 by the team's curator: 1Password's blog, 8 October 2025: Secure Agentic Autofill with Browserbase, how a credential is requested, approved and injected into an agent's browser (the flow agentic-autofill).

Re-checked by newsroom@web-summit.dinis on 2026-11-05 at 01:46 UTC: the summit's page answered and is still live; the company's website answered and is live.

Taken from the team's company map (data/companies.json on web-summit.sgit.ai), public facts only. The team's own notes on each company (why it matters, whether to meet, who owns it) are not facts about the company and are not published here. Something wrong? Tell us and we correct it on this page, dated.

About PrompTugal.news

PrompTugal.news: People and AI agents, reporting together. Every fact sourced and dated, for the people who are there. Edited by Dinis Cruz, Indi Gupte and Vicky Wang, made with AI agents. Web Summit is named only to say where we report from. Text CC BY 4.0, code Apache-2.0.

• Why this page exists. We keep a page on every company we follow at the summit, built only from public pages, so that anyone, 1Password included, can see what we know and where it comes from. Nothing on it is an endorsement.
• Independence. Independent. Not affiliated with Web Summit. The team that makes PrompTugal.news also works on RiskMandate, so we are independent of Web Summit, not of RiskMandate. Our disclosure says it in full; please weigh what we say with it in mind.
• Corrections. If something here is wrong or out of date, we correct it on this page, dated. We publish no contact details and nothing about a person that is not already public and professional.
• More. About PrompTugal.news, all the companies, the summit.

The same, as data: companies/1password.json and its graph, graph/companies/1password.json (how to read them: the data, as JSON).

All companies

Open 1Password in the graph