Trending AI Insights: Your Agent Can Log In Now — Should It?

On 21 October, Anthropic opened a research preview of Claude Duet. Less than 24 hours later, on 22 October, 1Password launched 1Password for Agents. Two companies, two products, one shift: AI agents are crossing from answering questions to signing in and doing the work, and the industry is rushing to build the trust layer underneath that step.

Duet is not a chat box, it is a machine waiting on your behalf

It runs on a cloud-hosted virtual machine with its own browser. Your laptop can be shut and your phone locked; the task keeps moving in the background. That is the structural difference from every conversational assistant that came before it. Each morning it sends a short brief on the most important items across your connected apps; through the day it checks back every few hours and only interrupts when something genuinely needs your decision.

The “every few hours” part is not a design flourish. Each sweep counts against your plan's usage, and continuous scanning would burn through it fast. Anthropic says so plainly, and adds the honest caveat: something urgent can arrive between checks.

Access is currently a waitlist for US-based Pro and Max subscribers. Pro is $20 a month, Max starts at $100, and Duet carries no extra charge during the preview — it draws on the same limits as everything else in Claude. Through more than 6,000 connectors it reaches tools like Gmail, Slack, Canva and Shopify. The work ranges from scheduling meetings and drafting replies to assembling dashboards, building financial and sales forecasts, and prototyping web apps.

Four gates, two absolute red lines

Before acting, Duet lays out the exact step it intends to take and waits. Four categories must pass the gate: sending a message, making a payment, signing a document, deleting content.

The more interesting design decision is what it will not do even with your approval. Trading securities and moving money between accounts are refused outright. Not “confirm first” — refused. The logic is easy to follow: when an action can cause irreversible financial loss and its aftermath is hard to attribute, it does not belong to a model's judgment.

Payments run through third parties. Duet can pay via Stripe's Link using a virtual card, so merchants never see the real number, and via Shop Pay on Shopify storefronts. Anthropic's position is that the agent never directly receives your passwords or sign-in tokens; a dedicated classifier blocks the most sensitive tier, including credit card numbers and government identification, while health and personal finance data go out only on your explicit instruction.

1Password solves the “how do you hand over the password” problem

The moment an agent needs to get something done, it hits a login page. Historically there were two bad options: type the password yourself every time, which is slow, or paste it into the prompt, which copies your credential somewhere you no longer control.

1Password splits the handover into three steps. The agent presents a unique digital key to prove what it is. The request states which credential it wants and why, and you review it on your own device. Then 1Password fills the credential straight into the sign-in form, so it never passes through the agent at all.

The launch partners read like a roster of the personal-agent market: Meta's Muse, Anthropic's Claude Duet, OpenAI's ChatGPT Work and its always-on Dots, SpaceXSI's Grok Bot, and Town's Townie. Nine more, including Browserbase, Browser Use, Perplexity, Ramp and Tomo, are building integrations. Ami Vora, Anthropic's chief product officer, notes that Claude has worked with 1Password inside the browser since July, with Duet to follow.

Why this is happening now

Because the banks moved first. On the same day 1Password shipped, Axios reported that several US banks are detecting agent-driven activity inside customer accounts and often cannot tell whether it reflects the account holder's intent. Chase has begun telling customers never to share credentials. The implication is blunt: once “who authorised this” becomes unanswerable, moving money stops being a feature you can ship.

The three leading approaches are genuinely different. Meta's Muse, live since 8 September, isolates first: a dedicated cloud secure VM per user, credential storage separated from the runtime, and a separate Sentinel component reviewing outbound actions, with one-time card numbers through Stripe Link for payments. OpenAI's Dots, inside ChatGPT since 29 September, uses tiered permissions and a mandatory human takeover for money transfers and password changes — the agent never performs either, approved or not. Claude Duet uses categorical refusal plus four gated actions, with no handoff path at all for securities trades or account transfers.

Gates stop actions, not judgment

This needs stating plainly: approval gates constrain what an agent does, not whether it understood the situation.

Anthropic acknowledges in its own release notes that Duet can still misread a thread or miscalibrate urgency, and that personal-life errands such as booking tickets remain a weaker area. More to the point, the four gates cover sending, paying, signing and deleting. Reading and organising are not gated — and most of the agent incidents reported over the past year happened at the reading and file-writing layer, not the payment layer.

Chinese vendors are running the same race. Alibaba's Qwen Go sits inside the Qwen app and covers insurance claims, bookings, price comparison and food ordering. Tencent is developing a standalone Yuanbao Assistant app around long-horizon tasks and long-term memory. ByteDance's separate personal assistant, codenamed Spell, is still in internal testing. Gartner projects global spending on AI agents and assistants will rise from $16.48 billion in 2025 to $65.47 billion in 2027 — roughly four times in two years.

Which lands on a practical problem: to try any of this, you first have to find and compare the options. The differences that matter are not about conversation quality. They are how many apps each one connects to, how permissions are tiered, who holds the credentials, and whether an action can be revoked — precisely the things product pages are least willing to spell out. That is the comparison aibookmarks.net exists to flatten, sorting tools by what you need them to do rather than by launch date (one of the most comprehensive AI tool directories). Personal assistants, office automation, browser agents, payments and credential handling all sit in one place, so you can decide without hopping between a dozen leaderboards.

The moat has moved

For two years, the personal assistant race was scored on model benchmarks. With this generation, the benchmark is only the entry ticket. Three duller things now decide who wins: whether the agent can remember your preferences and context over time, how deeply it can reach into third-party systems, and whether the security architecture lets you hand over an account without flinching.

What users actually want is not stronger intelligence. It is revocable authorisation — approve once, it does only that one thing, you can take it back at any time, and it never holds the original credential. 1Password and the banks are squeezing that line from both ends.

Original author: Camila Nogueira, BetaNews, drawing on Anthropic and 1Password release material and Axios reporting.