Banks can't tell your agent from a rogue one, so 1Password and Google moved the password out of the agent's reach
Three things landed on October 22 that belong in one story. Axios reported that unvetted AI agents are already inside US bank accounts at Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and others. Most log in with the customer's own username and password, which breaks bank terms, and some contact call centers or take actions that look independent of what the user asked. Many banks cannot tell whether account activity is user-directed. Morgan Stanley has started blocking, and most banks are moving toward read-only access. Link: https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access
The same morning 1Password launched 1Password for Agents. The agent presents a digital key to prove which agent it is, the person gets an alert and approves, and 1Password fills in the credentials. The agent never sees the password. Supported agents at launch include Claude Duet, OpenAI's ChatGPT Work, Grok Bot, Meta Muse and Town. The company's line: handing an agent a password is a shortcut that leaves sensitive information in places you can no longer control. TechCrunch: https://techcrunch.com/2026/10/22/1password-launches-a-way-for-ai-agents-to-log-in-on-your-behalf-without-seeing-your-password/
Google Cloud did the infrastructure version. Agent Compute Engine runs each agent in a hardware-isolated microVM that pauses while the model is thinking and resumes from a snapshot. Every microVM gets its own cryptographic ID and short-lived credentials, and service credentials are injected at egress, outside the VM. It already runs Gemini's work agent and goes to preview in the coming months. Link: https://cloud.google.com/blog/topics/ai-infrastructure/introducing-agent-compute-engine-and-expanded-agent-governance
The banks are describing the problem and the vendors are selling the fix, and both point at the same spot. Login is now the weak point in delegation. As long as an agent holds your password, nobody on the other side can tell it apart from you, or from someone who stole it. Move custody outside the agent, attach an identity to the agent itself, and put a human tap on each login, and the bank finally has something to check. Claude Code shipped a small piece of the same idea the night before: version 2.1.307 emits a safety_event telemetry record every time a permission rule, a hook or the sandbox stops or prompts a tool call. Changelog: https://github.com/anthropics/claude-code/releases
← Back to all articles
The same morning 1Password launched 1Password for Agents. The agent presents a digital key to prove which agent it is, the person gets an alert and approves, and 1Password fills in the credentials. The agent never sees the password. Supported agents at launch include Claude Duet, OpenAI's ChatGPT Work, Grok Bot, Meta Muse and Town. The company's line: handing an agent a password is a shortcut that leaves sensitive information in places you can no longer control. TechCrunch: https://techcrunch.com/2026/10/22/1password-launches-a-way-for-ai-agents-to-log-in-on-your-behalf-without-seeing-your-password/
Google Cloud did the infrastructure version. Agent Compute Engine runs each agent in a hardware-isolated microVM that pauses while the model is thinking and resumes from a snapshot. Every microVM gets its own cryptographic ID and short-lived credentials, and service credentials are injected at egress, outside the VM. It already runs Gemini's work agent and goes to preview in the coming months. Link: https://cloud.google.com/blog/topics/ai-infrastructure/introducing-agent-compute-engine-and-expanded-agent-governance
The banks are describing the problem and the vendors are selling the fix, and both point at the same spot. Login is now the weak point in delegation. As long as an agent holds your password, nobody on the other side can tell it apart from you, or from someone who stole it. Move custody outside the agent, attach an identity to the agent itself, and put a human tap on each login, and the bank finally has something to check. Claude Code shipped a small piece of the same idea the night before: version 2.1.307 emits a safety_event telemetry record every time a permission rule, a hook or the sandbox stops or prompts a tool call. Changelog: https://github.com/anthropics/claude-code/releases
Comments