Credential leaks continue to happen, even though the controls for human identity have been available for years. Matt Moore, co-founder and CTO of @chainguard_dev, joins @NancyzWang and Dev Tagare to discuss how security changes when credentials belong to people, machines, and AI agents moving through the SDLC. The controls differ, but the standard is the same; credentials should be protected and scoped, and every use should be attributable. ✅ People need MFA, secure credential storage, and SSO where it fits ✅ AI agents need short-lived, least-privilege access ✅ Keep raw secrets out of agent context where possible, and broker access at runtime ✅ Trace actions to the agent and its authorizing human or service The gap sits between what teams know works and what's actually deployed. 🎧Listen to the full conversation here:

We're proud to support Herackthon 2026, a monthlong innovation challenge uniting creators, technologists, and visionaries to build for women, by women, and with everyone. Workshops along the way cover coding, infrastructure, architecture, and go-to-market strategy. 1Password is providing licenses to the members of the three winning teams, so they can continue developing their project with credential security handled from the start. 📅 Dates: Sep 14 – Oct 4, 2026 📍 Location: Vancouver + Remote 👥 Eligibility: Open to everyone · Teams of up to 5 ⏳ Deadline: Registration open until Sep 18 ➡️ Register here:

We're partnering with @TownAI to bring 1Password's secure access to their assistant, so it can log in and get the job done without ever seeing your passwords. Your team decides what it can reach, and that access can be pulled back anytime. Town handles the work, and we handle the keys. More to come!

We're excited to partner with @Meta to bring @1Password to @Muse, a new personal AI agent that helps you get things done across every part of your life. Muse is built with a secure credential store, and soon with 1Password, that extends to the password vault you already have. You’re in control of every request to access these credentials. More coming soon!

AI agents are a new class of identity. Meet 1Password at Fal.Con 2026, booth #1852#. On Sept. 1, @NancyZWang (CTO, 1Password), @talperetz_ (Co-founder and CPO, @Runlayer) and David Tsao (CISO, @NotionHQ) will also discuss securing rogue agents with identity, access, and runtime visibility. Register here:

ChatGPT Work can now use its computer and browser to sign in to websites on web and mobile, without ChatGPT ever seeing your username or password. That means you can ask it to: • Set up utilities for a new apartment • Book a DMV or passport appointment • Check reimbursement costs through your insurance • Find and book an in-network doctor around your availability • Check when your car registration expires and prepare the renewal paperwork • Compare your rental insurance policy with an issue you’re emailing your landlord about • Find and save apartment listings that match your criteria • Restock something just by uploading a photo • Schedule a package pickup for a return • Cancel tickets for a rescheduled trip • Book a vet appointment • Submit reimbursement paperwork for medical treatments • Check resale sites for new drops and save things you might like • Find candidates with specific experience and draft outreach • Take invoices from your email and submit them to your accounting software • Draft replies to rental property inquiries • Fill out permit applications for your small business • Add action items to a vendor portal based on a recent client call • Analyze the latest ad campaign for your small business

Basically: if it’s something you’d normally have to open a browser and click through yourself, try asking ChatGPT Work to do it. Logging into websites is rolling out today on web and mobile for Plus, Pro, and Business users.

AI can fix code but can it fix a security flaw without creating another one? @1Password’s Off-By-1 Labs tested leading models on vulnerabilities they hadn’t seen before. Many failed to fix the flaw. Some introduced new bugs or made the problem worse. Watch @JacobDePriest explain why verification still matters on the Zero Signal Podcast:

As organizations grow, IT teams need secure systems that can keep pace without adding more manual work. 1Password is announcing four updates to Enterprise Password Manager (EPM) that help admins reduce lockouts, simplify provisioning, and support complex organizational structures: 🔷Entra ID Secret Expiration: Track secret expiration dates and receive reminders before an identity provider connection breaks. A guided workflow helps admins rotate secrets and restore connectivity. 🔷Multi-Tenancy and Hosted Provisioning integration: Use Hosted Provisioning across multi-tenant environments to automate provisioning and deprovisioning for parent and child accounts. 🔷Vault Migrations: Copy vaults from a parent account to one or more child accounts in a single workflow. Vaults are re-encrypted in the browser, access starts with secure defaults, and each migration is recorded in the audit log. 🔷Hosted Provisioning for managed service providers: Connect an identity provider to client accounts in minutes, with users automatically created, updated, and deprovisioned across managed tenants. 👉Learn more here:

Code is the easy part. When agents write code in minutes, the bottleneck moves to CI, review, deployment, and verification. @TheRohanVarma from @OpenAI’s Codex team joins @NancyZWang (CTO @1Password) and Dev Tagare (Head of Engineering, @GeminiApp) on Zero-Shot Learning to talk about what comes next. Listen to episode 8:

The unlock for agents will not come from trusting the model. It will come from building a system that understands what “done” means and improves its ability to verify it. Imagine asking an agent to write release notes across 1,247 commits. It returns a polished draft, but the comparison API paginated at 1,000 commits and the agent never followed the cursor. The result looks complete even though 247 commits never entered the context. These checks do not prove that the release notes are well written. They establish something more fundamental: that the agent received the complete inputs and produced an internally consistent result. Verification produces the fact, and authorization consumes it. Do not promote the model. Promote the loop, and let the loop learn. Illustrative code: Blog:

A plausible result is not the same as a verified result. Verified loops give agents job-specific identities, bounded authority, and only the permissions they earn through trusted evidence.

In episode 7 of Zero-Shot Learning, @NancyZWang (@1Password CTO), @JeffWang (@Cognition President of New Enterprise), and Richard Liu (@AnthropicAI Head of API Products) explore what happens when an agent receives a bug report, checks whether it’s real, and works toward a fix without interrupting the team. #ZeroShotLearning# #AgenticAI# #1Password# #podcast#

Zero. Standing. Access. That should be the new security baseline for teams adopting AI agents. Watch Random but Memorable to learn: 🔹 How vibe coding creates more privileged users 🔹 Why overprivileged agents are a security risk 🔹 How to reach zero standing privileges Full episode 👉

Write code or use AI to build? Secure your daily workflows with 1Password’s developer tools. Learn how to: 🔹 Secure your local environment 🔹 Eliminate plaintext secrets 🔹 Protect SSH keys and Git commits 🔹 Build secure AI-powered workflows Start learning 👉

Join @gattaca, Global Advisory CISO at @1Password, live on the #BlackHat2026# PULSE_STAGE/05: "Standing Access Is the Problem. AI Agents Just Made It Worse." If your agents still have standing access, this is the session to drop in with your questions. 📅 Today | 11:25AM 📍 PULSE_STAGE/05 Add to your schedule: #BlackHat2026# #IdentitySecurity# #ZeroTrust# #AIAgents# #BlackHat#

AI can generate a patch. That doesn’t mean it fixed the vulnerability. In our new Off-by-1 Labs research, 53.9% of analyzed LLM-generated patches failed to resolve the vulnerability, introduced a new one, or both. Explore the paper, dataset, and tooling: