Anthropic's Claude AI has gained the ability to access user passwords and use them to log into websites, complete purchases, and carry out other tasks that require authentication. The feature, reported by The Independent, represents a meaningful expansion of Claude's autonomous capabilities and brings fresh questions about how much access users should hand over to an AI assistant.
How the Credential Access Works
The integration allows Claude to retrieve stored login credentials and use them during agentic browsing sessions, meaning the model can navigate a retailer's website, add items to a cart, and check out without the user lifting a finger. This builds directly on Claude's existing integration with 1Password credentials, which gave the AI a secure pipeline to retrieve passwords from a user's vault on demand. The shopping use case is one of the more concrete demonstrations of that pipeline in action.
Key Facts
- Claude can now retrieve stored passwords to authenticate on third-party websites during agentic tasks.
- The feature works alongside the 1Password credential integration announced earlier this year.
- Users must explicitly grant permission before Claude can access credential vaults.
- The capability is part of Anthropic's broader push into computer-use and agentic workflows.
- Security researchers have flagged credential-sharing with AI agents as an area requiring careful oversight.
Anthropic has framed the capability as user-directed and opt-in, with explicit permission required before any credential vault access takes place. The company has invested heavily in its computer-use architecture, which underpins how Claude interacts with browsers and desktop interfaces. That infrastructure got a significant boost when Anthropic acquired Vercept to advance Claude's computer-use capabilities, giving the team specialized tooling for exactly these kinds of autonomous, multi-step web interactions.
"The goal is to make Claude useful for the kinds of tasks that currently require you to sit at your computer and click through everything yourself."Anthropic spokesperson, via The Independent
Security and Trust Concerns
Handing an AI model your login credentials, even through a password manager, is not a decision most users will take lightly. Security professionals have long warned that any system with access to authentication credentials becomes a high-value target. If Claude's agentic session were hijacked or manipulated through a technique like prompt injection, an attacker could in theory direct it to carry out unauthorized transactions or extract account information. Anthropic has not published detailed technical documentation on how it isolates and protects credential access during agentic runs, and independent audits of the system have not yet surfaced publicly.
The broader context here is that Anthropic has confirmed AI is now building AI systems internally, which signals how quickly the company is scaling autonomous capabilities across the board. As Claude takes on more real-world tasks with real-world consequences, the margin for error shrinks. A mistaken purchase is recoverable. A compromised account is not.
Where This Fits in the Agentic Race
Every major AI lab is pushing toward agents that can do things, not just answer questions. Shopping is an obvious early target because it is a well-defined task with a clear success state. But it also involves financial transactions, personal data, and third-party systems that Claude has no direct control over. How Anthropic handles failures, disputes, and unintended purchases will shape how quickly users are willing to extend this kind of trust to the model. For now, the feature is available to users who opt in and connect a compatible credential manager, and Anthropic says it logs agentic actions so users can review what Claude did on their behalf. Users interested in the full scope of what Claude can do today can explore Claude's model family to see which versions support agentic features.
The capability is arriving at a moment when Anthropic is under pressure on multiple fronts, from competition with OpenAI and Google to the broader question of what responsible deployment of powerful AI actually looks like in practice. Credential access for autonomous shopping is a small but telling indicator of the direction the company is heading.
