1Password Developers

Official updates for developers building with @1Password.

Securely manage API keys, credentials, and agent access without exposing your secrets.

[1Password Developers @1PasswordDev]

The internet has a second audience: AI agents. 🤖

@Cloudflare just shared some fascinating data about how the web is changing.

Here are 3 things that caught our attention 🧵👇

[1Password Developers @1PasswordDev]

The lesson goes beyond Cursor.

AI coding-agent traces, logs, and support tickets can all become unexpected places where credentials are exposed.

We scan code for secrets.

But are we scanning what our AI agents leave behind?

Full disclosure:
https://t.co/gzdP2MkTX5

[1Password Developers @1PasswordDev]

Attackers distributed a malicious Claude Code extension through Cursor’s marketplace.

Up to 5,000 users may have received it.

But the attack didn’t start with the extension.

It started with an exposed vendor key and credentials buried in old AI coding-agent traces.

Here’s the attack chain. 🧵

[1Password Developers @1PasswordDev]

The malicious extension attempted to install a persistent SSH backdoor.

It added an attacker-controlled SSH key, collected host information, and installed persistence mechanisms.

The reverse tunnel generally failed without admin privileges.

But uninstalling alone may not remove the malware.

[Browser Use @browser_use]

Introducing: @browser_use x @1Password

Your agent can log in anywhere without ever seeing your password.

> connect 1Password once
> agent hits a login page
> you approve it in 1Password
> 1Password fills it in, agent keeps going

Try it 🔗⬇️

[David Faugno @1PasswordCEO]

Allie and KC with some great stuff here

[1Password Developers @1PasswordDev]

@birmeya Great list. One layer to add before "ship": secrets.

Every agent in this stack holds tokens, and this week showed what stolen GitHub tokens with write access can do.
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@vercel_dev Nice value for teams experimenting across models.

Wherever those calls run from, keep API keys out of plaintext .env files. Secret references (op://) make that easy:
https://t.co/gmjTQFZqs6

[1Password Developers @1PasswordDev]

@ctatedev Nice gains. Once browser agents start this fast, sign-in becomes the main speed bump.

Curious how you're thinking about logins: credentials held by the agent, or a human-approved handoff?

[1Password Developers @1PasswordDev]

@github Issue triage is a great fit for automations.

As they take on more work across repos, scoping each token to only the repos and permissions it needs keeps the attack blast radius small. 🔐

[1Password Developers @1PasswordDev]

@EpochAIResearch Thanks for publishing this in detail.

The false-identity attempts stand out. Agents acting on the web need verifiable identities and narrowly scoped access, so persistence alone can't get them further than intended.

[1Password Developers @1PasswordDev]

@ClaudeDevs Reminders are a nice fit for long-running work.

When a thread resumes hours later, credentials fetched at run time hold up better than tokens pasted in at the start. ⏱️

[1Password Developers @1PasswordDev]

@garrytan Self-improving agents are exciting. The more an agent can do, the more what it can access matters. Check out 1Password for Agents to secure your AI workflows.

[1Password Developers @1PasswordDev]

@santtiagom_ Example 2 is the one we'd underline. This week, attackers checked stolen GitHub tokens for write access before planting a CI stealer.

Read-only, scoped credentials would fail at step one.
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@ZackKorman And the token theft hasn't slowed down. This week, stolen GitHub tokens were tested with a harmless-looking PR on 61,000+ repos, then used to plant a CI secret stealer.
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@larryvc AI attacks are increasing and attackers don't always need an exploit. One pattern from this week worth knowing:

On GitHub, stolen tokens were tested with a decoy docs PR across 61,000+ repos, then used to steal CI secrets.
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@freeCodeCamp @irvingpictures Great resource. For the GitHub Actions chapter, this week's campaign is a timely case study: stolen tokens, a decoy PR to test write access, then a CI secret stealer that deleted its own logs.
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵