1Password has spent two decades selling a simple promise: your passwords live in an encrypted vault and nobody else, including the company, can read them. On Thursday the Toronto-based identity security firm extended that promise to software that acts on your behalf, announcing 1Password for Agents alongside a financial milestone that shows how quickly enterprises are wiring AI agents into their systems. The company said it crossed $500 million in annual recurring revenue, up from $400 million about a year ago, while holding a double-digit free cash flow margin.
The growth numbers point at agents rather than people. 1Password added roughly 20,000 business customers over the past year for a total above 200,000, lifted the number of accounts spending more than $100,000 annually by more than 40 percent year over year, and said monthly active usage of its developer and AI security tools jumped 200 percent among human users and 500 percent among autonomous AI agents. Net-new ARR growth ran at 60 percent in 2026 and 90 percent year over year in the third quarter, and the company says it now serves 85 percent of the Forbes AI 50 list. Its enterprise vault holds more than 1.6 billion credentials and secrets.
The product answers a question that has quietly become the weakest link in agentic AI. An agent that can book travel, file expenses or reconcile invoices eventually hits a login form, and the usual workarounds are bad: hand over the password in a prompt, paste it into a chat window, or let a copy sit in an agent memory that persists long after the task ends. Under 1Password for Agents, the agent presents a unique digital key to prove its identity, the person receives a notification naming the credential requested and the reason, and approval happens on the user's own device, closer to a two-factor prompt than to a shared password. 1Password then fills the credential directly into the destination sign-in form. The agent never receives the secret, and the password never leaves the vault.
The partner list reads like a census of the personal agent market. Integrations with Meta Muse and SpaceXSI Grok Bot are rolling out over the coming days, while Anthropic Claude Duet, OpenAI ChatGPT Work and dots, and Town Townie are listed as coming soon. Browserbase, Browser Use, Dana, Instinct, KERNEL, Perplexity, Ramp, Tomo and Wajo are named as additional partners in progress. That breadth matters because credential delegation only works if it is consistent across the agents a customer actually uses, rather than requiring a different scheme per vendor.
The framing from the company is unusually direct about why the old model fails. Agents are starting to do real work on our behalf, said Aashish Tripathi, chief product officer at 1Password, and the old model where you hand over a credential and hope for the best does not work. Chief executive David Faugno, who has spent the past year arguing that the company has the profile of a public company but needs more predictable revenue before testing that thesis, put the opportunity in starker terms: the shadow AI wave, in his view, will be massively larger than the shadow IT wave that preceded it, because there are simply far more agents running online than people.
Third parties are converging on the same argument. Snowflake chief security and trust officer Mayank Upadhyay described integrations that give every agent action a compound identity, tying it to both the agent and the person it acts for, so security teams get a full audit trail without limiting the user's own access. IDC research vice president Duncan Brown framed identity as the control point for agentic AI, warning that organizations unable to see and govern what their agents can reach will struggle to scale them safely. The commercial logic is that identity, not the model, becomes the place where agent permissions are actually enforced.
What is not yet proven is whether approval prompts survive contact with real usage. A notification for every login is fine for a weekly expense report and corrosive for an agent that touches twenty services an hour, and the answer will probably be scoped, time-boxed grants that expire with the task rather than per-action consent. Still, the direction is clear: the industry spent 2026 arguing about what agents may do, and is only now building the plumbing that records who authorized it, for how long, and on whose behalf. For a company whose business is trust in credentials, that is the most natural adjacent market it could have found.
Comments (0)
Log in to join the discussion
Log InNo comments yet