1Password launches a way for AI agents to log in on your behalf without seeing your password. By Lucas Ropek Thursday, October 22, 2026 TechCrunch AI 1Password's new authentication tool addresses the security paradox of AI agents: granting them account access without exposing raw credentials. By using secure tokens instead of sharing plaintext passwords, the feature enables autonomous assistants to perform tasks safely. This shift is critical for scaling agentic wor TechCrunch AI

The engineering reality of HashiCorp Vault and its alternatives. HashiCorp Vault provides dynamic secrets to mitigate the 49% of breaches involving credentials. Security teams must weigh the engineering effort of managing Vault against SaaS options like Akeyless or CyberArk Conjur based on their specific integration needs. IBM completed the acquisition of HashiCorp in February 2025 for a $6.4 billion enterprise value. Business operations moved to IBM on September 1, 2025. Vault 2.0 arrived in April 2026, while version 2.1.1 shipped on September 16, 2026. You already know that hard-coded credentials in repositories represent a primary attack vector. A 2023 Verizon Data Breach Investigations Report found that credentials remain a primary attack vector in over 49% of breaches. IBM's 2023 Cost of a Data Breach Report estimates the average cost of a breach at $4.45 million. Vault addresses this by replacing long-lived static tokens and API keys in container images with dynamic secrets that generate short-lived credentials for databases and cloud providers. These credentials expire automatically to shrink the window of opportunity for leaked secrets. The platform includes 26 secrets engines, 21 authentication methods, and 23 storage backends, while providing Kubernetes support via the Agent Injector, the Vault Secrets Operator, and a CSI provider. You can authenticate via Kubernetes service accounts, cloud provider IAM roles, or OIDC tokens. The flexibility of Vault makes it a strong choice for multi-cloud environments. The management of high availability, unsealing ceremonies, and replication topology requires skilled platform engineers. If your team cannot absorb these operations, you should skip Vault. Comparing Conjur, Akeyless, and 1Password. CyberArk Conjur is now part of the Idira platform after its acquisition by Palo Alto Networks. Conjur provides a policy-driven engine for machine identity. It uses human-readable policy files in YAML or Conjur policy DSL to define permissions. Conjur follows a server-client model where a master server hosts the policy and secret store. Applications authenticate using host identity or Kubernetes authenticators. If your organization uses CyberArk for human users, Conjur uses the same policy engine and audit logs for machine secrets. 1Password provides a different use case, often as a tool to share account credentials. 1Password is not a direct competitor to Vault, and 1Password's secret automation integrates with HashiCorp Vault as a provider. Some teams use 1Password for simpler tasks where Vault is overkill. The decision between these platforms requires you to weigh the engineering effort needed to run a Vault cluster against the per-secret costs of a managed service like Akeyless or the enterprise licensing fees of Conjur. Akeyless uses a zero-knowledge Distributed Fragments Cryptography model to split secrets across multiple cloud providers. You deploy lightweight Gateways inside your own network to broker access without the secret leaving your perimeter. Akeyless supports Universal Identity, which includes AWS IAM, Azure AD, GCP service accounts, and GitHub Actions OIDC. Akeyless charges roughly $0.05 to $0.10 per secret per month on its SaaS tiers. CyberArk Conjur Cloud costs approximately $15 to $40 per authenticating workload per month. For teams with strong platform engineering capacity, Vault OSS is often the lowest total cost option. I would skip the budget savings of the free versions if your team lacks the capacity to manage a production cluster. To decide, list your five highest-priority integration targets and map them to the integration documentation for each platform. The platform with the shallowest integration path across your specific targets is usually the right answer regardless of feature marketing. Platform migration is non-trivial. The hardest part is not migrating secrets themselves but re-wiring application authentication. Akeyless maintains a Vault compatibility API path that allows some tooling to be re-pointed with environment variable changes. The licensing landscape and alternatives. Vault is source-available under BUSL 1.1, not open source. Individual releases convert to MPL 2.0 four years after publication. Because Vault 2.1.1 was published in September 2026, it will not become open source until September 2030. This licensing change pushed many teams toward OpenBao, a fork under the Linux Foundation and OpenSSF. OpenBao version 2.6.2 shipped in August 2026, and the v2.7 beta arrived in September 2026. OpenBao includes post-quantum ML-DSA support and pure post-quantum TLS. It is currently diverging from Vault by shipping namespace sealing ahead of upstream. The decision depends on your infrastructure. If your team uses Terraform, Vault is the best choice because the Terraform Vault provider is mature. The Vault Secrets Operator for Kubernetes is also actively maintained. Does the move to IBM's support lifecycle change the long-term viability of the platform for independent DevOps teams? For organizations managing hundreds of secrets across many environments, manual user management becomes a significant operational burden. Vault does not support SCIM provisioning on any plan, meaning IT teams must manually create user accounts and manage policies separately from their identity provider. This creates a gap where departing employees might retain access to production secrets even after they are deprovisioned from other systems. For teams needing dynamic secrets across clouds without running a cluster, neither Vault nor AWS Secrets Manager is the perfect fit. AWS Secrets Manager is a managed service that charges $0.40 per secret each month. The break-even point between a managed service and the labor of running Vault sits between 3,000 and 8,000 secrets, depending on your environment.

Launching post-quantum safe passkeys. by René Léveillé October 20, 2026 - 4 min Passkeys make authentication safer by resisting phishing attacks and eliminating shared secrets like passwords that attackers can steal from a website to access your accounts. By removing the secrets from servers, they reduce the risk of data breaches. However, advances in quantum computing threaten to increase the risk of those data breaches yet again by breaking the cryptography passkeys currently use. As another step in its Post-Quantum Cryptography (PQC) migration, 1Password is adding support for ML-DSA passkeys in order to preserve their benefits over the long term. By supporting this algorithm early, 1Password LLC signal websites to start supporting ML-DSA passkeys. This helps protect its customers' credentials against future attackers. Why now? 1Password LLC has talked about quantum computers and passkeys before, back in 2023 to be precise. Back then, a Cryptographically Relevant Quantum Computer (CRQC) seemed far off, so why are 1Password LLC rolling out quantum-safe passkeys only three years later? Well, because things changed and research has accelerated. 1Password LLC has been closely monitoring the research to ensure 1Password LLC act well ahead of any concerning developments. Back in 2023, governments were mandating a migration to PQC algorithms by 2035, and the estimated amount of qubits estimated to be required to break elliptic curve digital signatures was around 13 million physical qubits. Now, in 2026, improvements in error correction and recent research reduce that estimate to only 26,000 physical qubits. This is still far from the latest largest quantum computer at 6,100 physical qubits, though the gap has shrunk enough for 1Password LLC to start migrating. NIST standardized the post-quantum safe signature algorithm, ML-DSA, in 2024. The IETF standardized ML-DSA's encoding in COSE in RFC 9964 in May of 2026. COSE is the format that WebAuthn/CTAP2 uses to transfer the passkey back to the website. This means that the stage is set for ML-DSA passkey adoption. Given all these advances and 1Password's ongoing PQC migration, 1Password LLC decided to roll out ML-DSA passkeys as early as possible. By doing so, 1Password LLC can protect as many of its customers' online accounts as possible. Are my existing passkeys safe? Supporting ML-DSA is precautionary. Since passkeys are generally long-lived, 1Password LLC want its customers to have the most secure passkeys available early on so they stay secure as long as possible. That's why 1Password LLC is providing support now rather than later. But your existing passkeys are still safe because no CRQC currently exists. This support is early, earlier than most websites in fact. With this launch, 1Password LLC expect to see that change soon. 1Password LLC is engaged in the W3C and the FIDO Alliance to develop a way to update existing passkeys seamlessly. So you don't need to worry about updating passkeys now or in the future. 1Password LLC'll take care of it for you! Automatically improving the security of all of its customers' passkeys is yet another reason why 1Password LLC is so excited about them. Try ML-DSA passkeys today! Starting on version 8.12.44, 1Password will support using the post-quantum safe algorithm, ML-DSA, for passkeys. This doesn't mean that your passkeys are now all going to be made with ML-DSA going forward. Remember that both sides have to understand the same algorithm, so 1Password LLC will only create these keys for websites that support ML-DSA for passkeys. You can test it yourself at webauthn.io. Open Advanced settings, select an ML-DSA variant under Registration settings, then create a passkey and authenticate with it. Passkey authentication works on all supported platforms, but as of now, creating an ML-DSA passkey isn't supported on iOS or through the native macOS autofill extension. Thanks to Matt Miller for adding ML-DSA support to webauthn.io, the best WebAuthn test website there is! Its goal is to make this transition as seamless as possible, so 1Password LLC do all the hard work to keep you safe online, and you don't even have to worry about it. Start using passkeys with 1Password today 1Password is helping prepare passkeys for the future of cryptography. Start using passkeys with 1Password today, and let 1Password LLC handle the hard work of keeping your authentication secure as cryptographic standards evolve.