AI agent passwords: how agents sign in without seeing them

The safest way to handle AI agent passwords is to make sure the agent never sees them. Instead of typing a password into a chat, the agent asks for access, you approve the request on your own device, and a separate secure system fills in the login for that one task. Since March 2026, several security companies have released tools built around this idea, and joint government guidance from May 2026 points the same way.

That matters because the login screen is where most AI agent projects quietly take on risk. A dental clinic wants an agent to pull reports from its booking portal. An HVAC company wants one to check supplier price lists. A property manager wants one to download statements from a bank or a tenant portal. Each job starts the same way: the agent hits a sign-in page and needs a password.

Why shouldn’t you give an AI agent your password?

Because a password typed into a chat can outlive the task. 1Password said in its October 22, 2026 announcement that pasting a password into a prompt gives an agent access “potentially beyond the task at hand.” As TechCrunch reported, the company called it a common shortcut that can leave sensitive information in places people can no longer control.

Security standards say the same thing. The OWASP Top 10 for large language model applications, the 2025 edition, says credentials should not be contained within the system prompt, the hidden instructions an agent runs on, because those instructions can leak. A password in a chat history, a shared document or an agent’s settings is a password stored somewhere nobody is watching.

How can an AI agent sign in without seeing the password?

Through brokered sign-in. A trusted system holds the password, and the agent only receives the result: a signed-in page or a temporary token. On October 22, 2026, 1Password launched 1Password for Agents, where a person approves the request and the login or one-time code is autofilled without being shown to the agent.

1Password is one example among several:

• Bitwarden released an open source Agent Access SDK on March 24, 2026, giving agents just-in-time access to specific credentials, with a person approving each one. Bitwarden calls it an early alpha.
• Microsoft made its Entra Agent ID platform generally available in April 2026, so agents can have identities of their own instead of borrowing an employee’s login. We covered the related idea in our post on AI agent identity and permissions.

These products differ, and some are new. The pattern is what matters: the password stays in a vault, and the agent gets only what one task needs.

What should happen every time an agent asks to log in?

Five things, based on the May 1, 2026 joint guidance from Canada’s Cyber Centre, CISA and four partner agencies. The Cyber Centre’s guidance recommends credentials that “expire when the job is complete” and entitlements limited to “the exact resources, operations and timeframes needed.”

1. The request is specific. The agent asks for one named login, such as the supplier portal, not the whole password vault.
2. You approve it where you can see it. The approval appears on your phone or computer, outside the agent, so the agent cannot approve itself.
3. Access is temporary. The session or token ends when the task ends.
4. It is written down. Each request, approval and sign-in is logged somewhere the agent cannot edit.
5. You can switch it off. Removing one agent’s access should take minutes and should not mean changing every password in the business.

If an online store owner approves an agent to download yesterday’s orders, the agent should be able to do exactly that and nothing more, and the record of it should still be there next month.

Which logins should an agent never use on its own?

Any login where a mistake would be expensive or hard to undo: online banking, payroll, the admin account for your email or website, and anything holding health records or customer payment details. The May 2026 joint guidance says agents should be prevented from autonomously executing high-impact actions, and that the people running the system, not the agent, decide when approval is required.

OWASP’s excessive agency guidance lists “require user approval” for high-impact actions as a core safeguard. In practice, a clinic’s agent might read the day’s appointments without asking, but it should stop and wait for a person before it signs in to the payment processor. When in doubt, keep a person in the loop and widen access later.

What should you ask a provider about AI agent passwords?

Ask where the passwords live, who can see them and how you take access away. Key questions include whose account the agent uses and how fast access can be removed. The CISA summary of the May 2026 guidance also recommends starting with low-risk, non-sensitive tasks.

• Will any of our passwords ever appear in a prompt, a chat or a log?
• Does each agent have its own identity, or will it use an employee’s login?
• Which sign-ins will need our approval, and who receives the request?
• How long does access last after a task finishes?
• How do we revoke one agent’s access, and how fast does it take effect?

Clear answers sound like the controls on our security page: credentials kept in an encrypted vault and never included in prompts, approvals before outbound messages are sent, and audit logs of every action. For email in particular, our post on giving an AI agent email access safely covers OAuth tokens and approval workflows.

Frequently asked questions

Is it ever fine to paste a password into an AI chat?

It is best avoided. Even if the tool is trustworthy, the password may be saved in chat history, logs or shared conversations. If a password has already been pasted, change it and turn on multi-factor authentication for that account.

What if a website does not support anything except a username and password?

Many sites still work that way. Brokered sign-in tools are designed for exactly this case: the password stays in a vault and is filled in on the sign-in page after you approve, so the agent does not need to read it.

Should an AI agent use my login or its own account?

Its own, wherever the service allows it. A separate account makes it clear in the logs what the agent did versus what you did, lets you limit its permissions, and means you can switch it off without locking yourself out.

Do these tools work everywhere?

Not yet. Availability depends on the product, the plan and sometimes the region. For example, 1Password says its agent feature does not currently support accounts hosted on its European or Canadian services. Check before you plan a workflow around one.

Want to know which of your logins an agent should touch?

Before any agent signs in to anything, it helps to map which systems a workflow needs and which of those deserve an approval step. An Agent Opportunity Audit does that mapping with you, so access is planned before anything is built.