AI agents are creating new identity security risks: 1Password wants to solve that

1Password has announced the launch of a new service aimed at shoring up credential security in response to growing agent identity risks.

The company has worked with a range of AI providers – notably Anthropic, Perplexity, GitHub, Cursor, and Vercel – to launch ‘Unified Access’, an agent security platform that lets companies deploy agents while keeping control of their credentials, authentication, and access.

Agentic AI is changing how work happens in organizations, noted CTO Nancy Wang and VP of engineering, development, and AI Jeff Malnick in a blog post, pointing to its use in coding environments, internal workflows, and productivity apps.

"That shift has real implications for identity and access control," they noted, saying user logins were no longer enough for authentication and policy controls.

"That model worked for human access, but it breaks down when credentials are used by local AI agents, automation scripts, CI/CD pipelines, and AI-native tooling.

"In this new reality, authority shouldn’t be decided once at login and then trusted all day. It should be confirmed right when access is requested, every time a credential or secret is used."

What to expect with 1Password’s Unified Access

1Password said the Unified Access lets organizations maintain visibility of all AI and agent activity happening across devices, browsers, and local environments, spotting any existing credentials or leaked secrets such as encrypted keys and mapping all AI use to specific users or devices.

That can then be secured with a unified vault that governs human employees as well as agents, with extra controls for risky accounts.

"As the lines between human and non-human access blur, the same credential might be used by an employee today and by an agent or automation workflow tomorrow," Wang and Malnick noted. "Unified Access provides a single source of truth, so access policies aren’t fragmented by where or how work happens."

Those two features are available now, but 1Password also plans to roll out an auditing tool in Unified Access that offers visibility into credential access – across humans and agents alike.

"Later this year, 1Password will expand Unified Access to issue scoped credentials to agent and machine workloads at runtime, further reducing persistent access and strengthening governance as AI-driven automation scales," the company added in a statement.

Working with industry

At launch, Unified Access will work with Anthropic and OpenAI as foundation model providers. For the former, Anthropic will integrate 1Password via Claude Code, Cowork, and the Claude browser extension, letting Claude login as though it was a human user.

With OpenAI, 1Password will enable the use of local vault items and developer IDEs.

For developers, Cursor, GitHub, and Vercel will integrate 1Password across their developer workflows, with hooks immediately available to Cursor agents and GitHub Actions.

"As agentic coding tools become part of how modern teams build and ship software, security needs to integrate directly into the developer workflow," said Talha Tariq, CISO at Vercel.

"Through our partnership with 1Password, we’re making it easier for developers to access credentials securely within the tools and environments they already use, so they can move quickly without compromising on sound security practices."

Beyond those partners, 1Password is also working with Commvault, agent control plane provider Runlayer, MCP gateway provider Natoma, and AI browsers from Anchor, Browserbase, Kernel and Perplexity, to protect information held by AI agents using least-privilege controls.

"Runlayer is the agent control plane for the enterprise, providing the security, governance, and observability organizations need to deploy AI agents in production with confidence," said Andrew Berman, CEO at Runlayer.

"As agents take real action across enterprise systems, credential management becomes a critical control surface. By integrating with 1Password, we're ensuring that every agent session Runlayer manages has secure, auditable access to the credentials it needs, and nothing more,” Berman added.

“When security is built into the foundation, organizations stop treating AI adoption as a risk to manage and start treating it as a capability to accelerate."

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.