Prevent agentic identity theft

Nancy Wang, CTO at 1Password, discusses the security risks of local AI agents like Claude Code running on personal devices. Key concerns include the massive blast radius from agents having access to files, terminals, browsers, and local tools. The conversation covers agent identity management challenges—how to verify an agent's identity at execution time when agents are ephemeral—and the concept of brokering (not giving) access via short-lived tokens. 1Password's approach uses zero-knowledge architecture, confidential computing enclaves, runtime signals, passkeys, and biometrics to govern credential access for both humans and their agents. The discussion also touches on sandboxing, MCP gateway risks, malware in open skill registries, and the future of UI as agents calling skills replace traditional browsing.