
Securing Developers & AI @1Password
Manhattan, NY
Joined July 2009
- Tweets1.2K
- Following1.4K
- Followers368
- Likes12K
Ash Kamel retweeted
1Password Surpasses $500 Million in Revenue as AI Agents Drive Growth on.wsj.com/4zKSeOG
The team had been cooking these last few months. Proud of the work we did to line up our partners to secure agents in with the next wave of personal agents.
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉
We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly.
1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials.
The agent gets the task done, but it doesn’t get your passwords..
You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault.
➡️Learn more: bit.ly/487da6J
Ash Kamel retweeted
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉
We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly.
1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials.
The agent gets the task done, but it doesn’t get your passwords..
You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault.
➡️Learn more: bit.ly/487da6J
Ash Kamel retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
the right way to use model capabilities is not to ship 10x more features to prod
it's to spend more time understanding your users, trying experiments, building prototypes, learning about things you don't understand so that you can ship things that actually work
High love and high structure.
I grew up in a home that was high structure but low love. My father's rules were absolute, enforced by the threat of conflict, but there wasn't warmth underneath. When I started building teams, I instinctively swung the other way: high love, low structure. I wanted everyone to feel supported. I avoided setting hard expectations because I didn't want to be my dad. It didn't work. People didn't know where they stood. Standards were fuzzy. The team drifted. What I eventually learned is that the optimal isn't one or the other — it's both. Genuine care for people combined with clear expectations and real accountability. Most people need structure to thrive. They want to know what's expected, how they're doing, and where the boundaries are. That's not mean. That's respectful. High love without high structure is actually a form of neglect.
Ash Kamel retweeted
Aid must be permitted to reach people in Gaza. There is no justification for keeping food and water away from civilian families. nytimes.com/2025/07/24/world…
Ash Kamel retweeted
The Affordable Care Act (aka Obamacare) implemented a bunch of cost controls.
It's remarkable how little credit this legislation gets for finally bending the curve of health care costs in America, all while providing health care coverage for millions of additional people.
Still one of the best in the game. Kudos to the Anthropic team.
The great thing about these conspiracy claims that keep cropping up every few months is that it’s a fantastic filter on who to block.
Ash Kamel retweeted
Advice for Food Companies
Since we launched PlasticList, we’ve been heartened to have quite a few food companies reach out and ask for help interpreting their results and tracking down and eliminating their contamination. I’ve had calls with a bunch of these.
I am happy to report that no food company wants this stuff in their food and they are all eager to figure out what’s going on and how to remove it. After a while I noticed the advice we were giving was pretty similar for every company, so I thought it would be useful to write it down and share publicly.
So, here are some notes:
1. To track down the source of your contamination, don’t just test a few samples of your product with varied production processes. Instead, test every single one of your inputs: every ingredient and input in the form you receive it before any processing steps, including water and any other consumables.
2. Then, test the food before and after every step in your production process. If you boil something in tap water, test before and after boiling. If you chop something on a plastic cutting board (because wood cutting boards are outlawed in commercial kitchens, apparently), test before and after chopping.
3. You may have to go deep into your supply chain to figure out the source of your contamination. One food company founder we spoke to said that some of the fruit they include in their product is picked, put into plastic bags, and then steamed in the bags before the bags are cut open and the fruit is transferred into another plastic bag, while still warm, for shipping. Whoops.
4. Run at least three samples of every test due to sample-to-sample variation. You can see in our report and in our data that sample-to-sample and lot-to-lot variation should be expected: plasticlist.org/report
5. You should also test any intermediate or final packaging that your product ships in, as leaching can also occur post-production.
6. There are a lot of steps that you need to carefully follow to prevent contaminating your samples during collection and transportation. It’s really easy to miss one of these and mess up your data. We describe many of these on our methodology page: plasticlist.org/methodology
7. You should consider running longitudinal tests, maybe quarterly, as we have heard that there can be seasonal variation in contamination from suppliers, due to things like summer heat, suppliers switching their processes, and suppliers switching their own backend suppliers for their inputs.
8. And most importantly: PICK A GOOD LAB. Unfortunately not all labs are good, and we think many ISO-certified commercial labs will not give reliable results. We rejected many certified labs because we weren’t confident in their work; all-in-all, we spent about 10 weeks finding a lab that we trust for our tests. You can see our lab’s internal methodology here: docs.google.com/document/d/1…
Our lab has recently permitted us to identify them publicly, and they are IEH: iehinc.com/
We also worked with Light Labs to produce this study and they can be a big help: lightlabs.com
And Million Marker is able to work with food companies to debug their supply chains as well: millionmarker.com/
9. You should consider hiring an analytical chemist as a consultant to validate that the testing methodology is accurate and to double-check the lab’s results. We hired John Brock to do this and it was well worth it; we would not have been confident in our choice of lab or our results without John.
10. We couldn’t find a lot of evidence that the phthalate substitutes are bad; if you have high-percentile detections in phthalates or bisphenols, though, it’s probably worth figuring out how those chemicals are getting into your products.
This 100 percent. Among the other litany of character flaws this is just straight anti American. Well said @paulg
Ash Kamel retweeted
Replying to @tomowenmorgan
Surprised a bit by this one but very true after much though.
The best part of all these supporters coming out in support of a convicted felon is my block list just got that much larger.



















