1Password Developers

Official updates for developers building with @1Password.

Securely manage API keys, credentials, and agent access without exposing your secrets.

[1Password Developers @1PasswordDev]

The internet has a second audience: AI agents. 🤖

@Cloudflare just shared some fascinating data about how the web is changing.

Here are 3 things that caught our attention 🧵👇

[Browser Use @browser_use]

Introducing: @browser_use x @1Password

Your agent can log in anywhere without ever seeing your password.

> connect 1Password once
> agent hits a login page
> you approve it in 1Password
> 1Password fills it in, agent keeps going

Try it 🔗⬇️

[David Faugno @1PasswordCEO]

Allie and KC with some great stuff here

[1Password Developers @1PasswordDev]

@birmeya Great list. One layer to add before "ship": secrets.

Every agent in this stack holds tokens, and this week showed what stolen GitHub tokens with write access can do.
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@vercel_dev Nice value for teams experimenting across models.

Wherever those calls run from, keep API keys out of plaintext .env files. Secret references (op://) make that easy:
https://t.co/gmjTQFZqs6

[1Password Developers @1PasswordDev]

@ctatedev Nice gains. Once browser agents start this fast, sign-in becomes the main speed bump.

Curious how you're thinking about logins: credentials held by the agent, or a human-approved handoff?

[1Password Developers @1PasswordDev]

@github Issue triage is a great fit for automations.

As they take on more work across repos, scoping each token to only the repos and permissions it needs keeps the attack blast radius small. 🔐

[1Password Developers @1PasswordDev]

@EpochAIResearch Thanks for publishing this in detail.

The false-identity attempts stand out. Agents acting on the web need verifiable identities and narrowly scoped access, so persistence alone can't get them further than intended.

[1Password Developers @1PasswordDev]

@ClaudeDevs Reminders are a nice fit for long-running work.

When a thread resumes hours later, credentials fetched at run time hold up better than tokens pasted in at the start. ⏱️

[1Password Developers @1PasswordDev]

@garrytan Self-improving agents are exciting. The more an agent can do, the more what it can access matters. Check out 1Password for Agents to secure your AI workflows.

[1Password Developers @1PasswordDev]

@santtiagom_ Example 2 is the one we'd underline. This week, attackers checked stolen GitHub tokens for write access before planting a CI stealer.

Read-only, scoped credentials would fail at step one.
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@ZackKorman And the token theft hasn't slowed down. This week, stolen GitHub tokens were tested with a harmless-looking PR on 61,000+ repos, then used to plant a CI secret stealer.
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@larryvc AI attacks are increasing and attackers don't always need an exploit. One pattern from this week worth knowing:

On GitHub, stolen tokens were tested with a decoy docs PR across 61,000+ repos, then used to steal CI secrets.
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@freeCodeCamp @irvingpictures Great resource. For the GitHub Actions chapter, this week's campaign is a timely case study: stolen tokens, a decoy PR to test write access, then a CI secret stealer that deleted its own logs.
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@eliz883 Many of the biggest attacks don't need an exploit at all.

This week, attackers tested stolen GitHub tokens with a boring-looking PR across 61,000+ repos, then stole CI secrets. Here's how it worked 🧵
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@johnmorganFL Stolen credentials often get validated before they're used.

This week, attackers did that at scale on GitHub with a decoy "docs" PR sent to 61,000+ repos. Here's how it unfolded:
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@snehalantani Agreed. This week's GitHub campaign is a clear example.

No zero-day. Just stolen tokens and a decoy PR to check which ones still had write access.

Our breakdown:
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@darcy Well put. Write access became the credential.

This week's campaign tested exactly that: a harmless-looking PR to see which stolen tokens could still write to a repo. We broke down how it worked 🧵
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@ClaudeDevs Self-hosting the harness raises a good question: where do the agent's credentials live?

Scoped, short-lived access per workload beats long-lived keys baked into a sandbox.

Credential Broker does this for OIDC workflows (public preview): https://t.co/mxk4Iy0cii

[1Password Developers @1PasswordDev]

New episode of Random but Memorable is live 🎙️

KC Li, senior director of product management, joins to talk about 1Password for Agents: how agents sign in for you without ever seeing your passwords.

Watch now:

https://t.co/PCgoNfWXH9

[1Password Developers @1PasswordDev]

@vinyl_bones @marianebekker we'll get it to you early next week!

[1Password Developers @1PasswordDev]

Here’s what attendees took away from our Web Summit masterclass with @marianebekker : “Let your AI agent in, without giving it your keys.”

Missed it? Reply “deck” or comment, and we’ll send you the slides.