Agents now log in on their own. Give them the door, not the key

TL;DR. On October 21, Anthropic introduced Claude Duet, an agent that works on its own in the background and only gets in touch when something needs attention. A day later, 1Password launched a way for such agents to sign in to websites without ever seeing the password. The same day, Axios reported that large US banks are finding outside agents in customer accounts and locking them out. Agents are turning from a conversation partner into a coworker with access. What matters now is which door an agent may open and who says yes to it. Neither product is available in Germany yet, but you should write down the rules for it now.

What is new

Until now, an AI assistant waits until you ask it something. Claude Duet turns that around. It sends a short summary in the morning, then checks the connected accounts every few hours and only gets in touch when something needs attention. It runs on its own virtual machine with its own browser, so your laptop can stay closed. Anthropic lists more than 6,000 connectors, from Gmail and Slack to QuickBooks, HubSpot and Docusign. The stated audience is professionals and small businesses.

What is interesting is where Anthropic draws the lines. Duet decides a lot on its own, with a classifier approving the steps. Four kinds of actions always need your yes, though, and two are ruled out entirely.

How an agent signs in now

The second novelty came on October 22. Agents used to have a login problem: either you gave them the password, or they stayed outside the door. 1Password for Agents sits in between. The agent stops at the sign-in page and identifies itself to 1Password with its own digital key. You see on your own device which login is requested and for what, and you approve. Then 1Password fills in the form itself.

1Password's chief product officer, Aashish Tripathi, explains the reasoning in the press release: the old model of handing over a credential and hoping for the best no longer works.

The fine print

• It is not available here yet. Duet launches as a research preview with a waitlist, starting with Pro and Max customers in the US. 1Password for Agents only covers Individual and Family accounts on 1Password.com. Accounts on 1Password.eu are explicitly not supported, and 1Password does not mention business accounts at all.
• More is announced than is running. Of the 15 agents 1Password names, two are rolling out. Duet, ChatGPT Work and all the others are marked "coming soon".
• The password stays secret, the session does not. After signing in, the agent keeps working in the signed-in account. What it does there is not governed by 1Password, but by the agent.
• The agent can get it wrong. Anthropic itself writes that Duet may misread a thread or misjudge what is urgent. It cannot show its browser yet either. So you see what it decides, but not what it saw.
• The risky combination is complete. Developer Simon Willison names three capabilities that become dangerous together: access to private data, exposure to untrusted content and a way to communicate externally. An agent that reads your inbox has all three, and a crafted email can talk it into something. That is why the approval before sending is not a convenience feature. It is the lock.

The banks draw the line tighter

An Axios report from October 22 shows how delicate this is. Large US banks are finding outside AI agents in customer accounts, it says, some taking actions that do not trace back to any instruction from the customer. Most of them sign in with the customer's credentials, which breaks the banks' rules. Morgan Stanley is locking such agents out, while JPMorgan, Bank of America and Citi are restricting them. Many banks are moving to read-only access. No losses have been reported so far, and the sources are anonymous. Chase puts it simply: customers should not give their usernames and passwords to anyone.

In Germany, too, Section 675l of the Civil Code (BGB) obliges bank customers to protect their security credentials from unauthorized access. Before an agent ever sees one of your company's bank accounts, put the bank's terms on the table.

What this means for a mid-sized company

Both products target individuals and small businesses, not the IT department. That is why the first agents will come into companies through private subscriptions, not through a tender. If you have no rule today, you will soon have agents with company logins that nobody knows about. The good news: the vendors ship the template with the product. What an agent may do alone, only after a yes, and never, translates to any company.

The agent gets the door, not the key. And whoever opens the door says yes first.

What you should do now

1. Issue one clear rule. No company passwords in agents, chat windows or browser extensions. If an agent needs to sign in, then only through a route where the password stays hidden.
2. Define the three tiers for your company. What may an agent do alone (read, summarize, draft), what only after a yes (emails to customers, orders, deleting) and what never (bank transfers, signing contracts)? Duet's list is a good start.
3. Give agents their own logins. Wherever a portal allows it, the agent gets its own account with as few rights as possible, ideally read-only. That is exactly what the banks are doing.
4. Check the terms. Bank, payment provider, supplier portals: what do they say about sharing login details? When in doubt, ask before an agent tries it.
5. Want to see, not just hear. An agent that works at night has to show in the morning what it based its work on. Ask every vendor whether you can trace what the agent saw.

Agents that work on their own are arriving faster than most companies have rules for them. The technology for the yes at the door exists now. Which doors there are at all is something every company has to write down itself. If you would like to go through that list with someone once, we are happy to help.