1Password

In March 2025, attackers compromised a GitHub Action used in the development pipelines of more than 23,000 repositories. The malicious code exposed API keys, cloud credentials, SSH keys, and other tokens in workflow logs. Affected teams were advised to review their workflow runs and rotate any credentials the logs exposed. Affected organizations had to determine which credentials had been exposed, what those credentials could reach, and how to replace every one of them without halting development. Many could not confidently answer the first question alone. The incident illustrates the problem those responsible for a team's credentials face today: the credentials that carry the most risk are often the ones nobody is tracking. Security tools cannot govern credentials they never see Unmanaged credentials are simply a byproduct of the modern software development environment, where developers are under pressure to constantly ship code. A developer standing up an application needs a database

Listen to the episode on Apple Podcasts null Listen now Listen to this episode on Spotify null Listen now This week on the Chasing Entropy Podcast, host Dave Lewis sits down with Keith Hoodlet, Director of Security Research at 1Password and leader of the newly formed Off-by-1 Labs . Keith’s mission? “To throw stones at glass houses, not to hear the crash necessarily, but to help people build better and more secure houses.” A villain-turned-hero origin story As Keith puts it, “I’ve always been really focused on skill acquisition over formal titling or formalized skillsets in many ways.” After all, he got his start as a self-proclaimed “unpaid punk on the internet, messing with video games, mostly.” As a teen, Keith would spoof other Diablo players by using a trial key from the back of a CD case, and taught himself Visual Basic so he could spam StarCraft opponents. He realized early on that he was “pretty good at the whole computer thing.” That’s why he decided to major in psychology – i

How AI coding agents are changing software development Zero-Shot Learning is a podcast about how AI gets built, secured, and deployed. Hosted by Nancy Wang, 1Password CTO, and Dev Tagare, Senior Director of Engineering at Google, it’s a builder’s view of the architecture and the complex decisions it takes to ship with AI. This episode features guest co-host Richard Liu , Head of API Products at Anthropic, who sits in for Dev. The IDE has been the center of software development for decades, but Jeff Wang thinks its time in the spotlight is ending. On Zero-Shot Learning, the President of New Enterprise at Cognition described how his team’s workflows are shifting from manually writing every change to delegating work and verifying the results of AI coding agents. After leading Windsurf and now working with Devin at Cognition , Jeff has seen developers across industries explore how to implement AI. From interactively collaborating with coding agents to deploying long-running agents in the c

It happened again. We blinked, and suddenly summer’s over and it’s time to register for classes. The horror! While the start of a new school year has always been a stressful time for parents and students, the growing number of accounts, apps, and devices students have been responsible for in recent years has made it even more complicated. To help manage the stress, 1Password is sharing our favorite back-to-school security tips for parents and students of all ages, so you can start the 2026 school year secure and organized. School security 101: From AI to user IDs With more AI tools emerging every day, it can be difficult to track which ones are trustworthy. AI tools and agents need access to a lot of data in order to function; AI adopters, and concerned parents, should take care about what data is being shared with the AI. It’s worth learning what AI-based tools your kids are using, and educating them about what kinds of information they should never share with a chatbot. That includes

AI agents have crossed an important line from making suggestions to taking actions. They can read a repository, call internal systems, change code, open a pull request, and keep working while the human moves on. In this world, it is no longer enough to ask whether a model is capable. We have to ask: Who is acting, a person or their agent? What authority did they receive? Which systems could they reach? What evidence did the run produce? What permission should that evidence earn? And who remains accountable for the next consequential action? At 1Password, the pattern we use to answer these questions is the verified loop. In a verified loop, an agent works under a job-specific identity, through tools governed by an access control gateway, and earns a given permission by proving that it satisfies the conditions of a human-defined policy. This is how an organization can begin converting human-owned procedures into production tasks for agents. A verified loop doesn’t make the agent infallib

AI is changing how products get made. For user experience teams, that means the very shape of the work is changing. There are two key elements of user experience design. On one side is craft: the interaction, nuance, visual judgement, emotional texture, and other qualities that make a product feel considered. On the other side are systems, strategy and behavioural thinking: journeys, concepts, mental models, product architecture, behavioural patterns, and the shared systems and languages that help teams make better products. AI tooling has created opportunities to deepen both of these skillsets. Designers can now get closer to the front-end experience using real components, real data, and realistic prototypes, instead of hoping that important details survive the process. At the same time, we now have more ability to work upstream, shaping product decisions at the strategy level. Now, rather than strategy and execution conflicting with each other, they can harmonize more closely, held t

It's 6:30am and you hear the door of the nightclub you've spent the last 8 hours inside shriek as it closes behind you. You watch bleary-eyed as an overly bright sunrise illuminates the business-suited people as they glide effortlessly along the sidewalk, their obnoxiously well-rested faces talking about work on their fully charged phones. You wonder, "Where did all the fun people go? And what happened to my wallet?" This feeling is what many CFOs, CTOs, CEOs, and AI program managers will imminently be experiencing in their board rooms, as they finally wake up to the realities that unrestricted and unmoderated AI use has wrought on their bottom lines and the stability of their core technical assets. You can already feel the party ending and the hangover setting in. The first warning sign came when Uber’s engineering org burned through its annual AI budget by April, and then capped its engineers at $1,500 a month per tool. At Meta, an internal leaderboard nicknamed "Claud

AI has changed the calculus of a credential attack. Before, finding and exploiting credentials in an enterprise environment required time, patience, and human judgment. An attacker had to decide which accounts were worth testing and which systems were worth reaching. Many credentials never made the list. By contrast, an autonomous system that gains a foothold in a victim’s systems has no need to be picky. It can sweep an environment in moments, scooping up API keys, service account tokens, OAuth tokens, cloud credentials, and plaintext secrets on developer devices. It authenticates with whatever it finds and moves laterally as far as standing access allows, one credential opening the next, at machine speed. An attacker with AI doesn't need to choose targets. Everything accessible is worth exploiting. Recent high-profile incidents with experimental AI models have shown that pattern in action. Entry points differed: software exploits in two cases, weak passwords in a third. But what foll

We studied what happens when Large Language Models (LLMs) generate vulnerability patches for recently disclosed, complex vulnerabilities. Our data shows that LLMs produce Fix-Like Artifacts with Embedded Defects (FLAWED) 53.9% of the time when complex patches are required. By sharing the results of our research, our goal is to provide defenders with the tooling and methodology necessary to improve vulnerability remediation outcomes at scale. Along with this blog, we are releasing our tooling , datasets , and an in-depth research paper to share what we’ve learned. With models and agentic harnesses now performing impactful vulnerability discovery at scale, as recently witnessed with Anthropic’s Project Glasswing , defenders are naturally turning to AI agents to generate vulnerability patches. Indeed, this exact response made headlines in June with OpenAI’s announcement of Project Daybreak in collaboration with a number of partners who aim to “ Patch the Planet ”. But how effective are LL

On August 2, 2026, Productiv told customers its SaaS management platform was shutting down on August 6, with account data deleted once access ended. Four days is not much time to pull years of app inventory, spend, and usage data out of a system you've come to depend on, especially with AI tools now adding a fast-moving new layer of spend and access to track on top of everything else. If you're facing that deadline, or just taking stock of what you'd do if your own platform disappeared tomorrow, here's why 1Password SaaS Manager is the strongest place to land. A Leader you can build on 1Password SaaS Manager is a Leader in the 2026 Gartner® Magic Quadrant™ for SaaS Management Platforms, for both Completeness of Vision and Ability to Execute. That recognition reflects work we've been doing deliberately since acquiring Trelica in 2025. We’ve brought AI and SaaS discovery into our broader Unified Access platform, alongside the credentials, identities, and access controls that secure every

Zero-Shot Learning is a podcast about how AI gets built, secured, and deployed. Hosted by Nancy Wang, 1Password CTO, and Dev Tagare, Senior Director of Engineering at Google, it’s a builder’s view of the architecture and the complex decisions it takes to ship with AI. In this episode, 1Password VP, GM of Developer and AI, Jeff Malnick sits in for Dev. When Maxim Fateev, CTO and co-founder of Temporal, joined Zero-Shot Learning, he brought a historical perspective to the challenges developers face when building agentic systems today. From vanishing state to retry storms, Fateev saw that the failures of deploying long-running agents have parallels to the problems he’s been working on for decades. Maxim joined Amazon in 2002, where he co-created Simple Workflow Service, the internal orchestration platform that became one of the most widely used services at Amazon. At Uber, he built Cadence, the open-source predecessor to Temporal , the durable execution platform, which he co-founded in 20