Your Passwords Matter More Now That Agents Act for You
Last Saturday morning, my AI assistant told me that Grok Bot now has a Vault. It keeps cards, logins and personal details in one place, so my bots can fill in checkout and sign-in forms for me. It offered to open the form if I wanted to save a card or a login, and it didn’t ask for my password. I replied, “Great please remind me later would want to try it”, and it set a reminder.
Afterwards I felt a bit uneasy about that reply. I’ve no reason to think it’s unsafe. I just hadn’t really thought about who should hold my keys once agents start acting for me.
For now, I’m skeptical about handing my passwords to an AI company’s built-in vault. I’d rather keep them in a dedicated password manager like 1Password. That’s just my preference.
So I looked at what has actually happened when passwords, logins and other secrets meet AI tools. I’ve kept the stories plain and left the caveats in, because a few of them are easy to overstate.
An assistant carries your access with it
When I log in somewhere, I decide what to click. When an assistant logs in for me, it takes my access into places I’m not watching. If it’s signed in to my email, my bank or my work tools, then anything that can steer it can reach those as well.
A web page that gave orders to an AI browser
In 2025, researchers at Brave tested Perplexity’s Comet, a web browser with a built-in AI assistant. They hid instructions inside a Reddit comment. When a user clicked “summarize this page”, the assistant read the hidden text and followed it. It went to the user’s Gmail, read a one-time login code and posted it back to the attacker. That was enough to take over the account.
This was a research demo. Brave reported it to Perplexity on July 25, 2025, and it was never a confirmed real-world theft. Perplexity has since written about the fixes it made.
Still, it shows the risk. An assistant that’s logged in as you can be steered by what it reads, including a stranger’s hidden text.
Banks are saying no
This October, some of the biggest banks drew a line. JPMorgan and Schwab in the US, and RBC, BMO and TD in Canada, now block third-party personal AI agents that sign in to your account with your username and password. The US banks still allow approved, read-only connections.
It makes sense that banks went first, since they handle money. If banks won’t let an AI assistant use a password, that’s a good reason not to hand yours over either.
One reused password, millions of people exposed
This one is older, from 2023, and it has nothing to do with AI. I’m including it because it shows how far one weak habit can spread.
Attackers took passwords leaked from other websites and tried them on 23andMe, the DNA testing company. According to the company, they got into about 14,000 accounts. Through a family-matching feature, they then reached profile data of about 6.9 million people. Most of those people did nothing wrong. They just happened to be connected to someone who reused a password.
Now imagine an assistant that holds many of your logins at once. A single reused or leaked password could then open everything that assistant can touch.
Seeing someone is no longer proof
In 2024, a finance employee at the engineering firm Arup in Hong Kong joined a video call with his CFO and several colleagues. Every one of them was an AI deepfake. He made 15 transfers totalling HK$200 million, about US$25 million. Arup confirmed that “fake voices and images were used.”
No password was stolen here. The trick was about who was asking. I’m including it because it changes how I think about approvals. When a face and a voice can be faked, approving something needs a check that can’t be faked, such as a passkey, a call back on a known number, or a second person signing off.
What we paste into chatbots
Sometimes the leak comes from us. In 2023, Samsung engineers pasted internal source code and a meeting transcript into ChatGPT, and Samsung then temporarily banned staff from using generative AI tools. To be fair, what leaked was code and meeting notes, not passwords. But it’s the same habit that leads people to paste a password or an access key into a chat to “just get help with it”.
In mid-2025, some ChatGPT users who had ticked an option to make a shared chat discoverable found their personal conversations showing up in Google search results. OpenAI removed that option on July 31, 2025.
Once you paste something into an AI tool, you don’t control where it ends up, so keep passwords and keys out of it.
One number worth knowing
I’ll stick to one figure. Verizon’s 2026 Data Breach Investigations Report found stolen credentials played a part in 36% of breaches, so passwords and logins are still one of the main ways attackers get in.
Passkeys are already available
The good news is that passkeys exist today. They let you sign in with your device instead of typing a password. A passkey can’t be phished, and you can’t reuse it on another site or paste it into a chatbot.
Get Prateek Dwivedi’s stories in your inbox
Join Medium for free to get updates from this writer.
The FIDO Alliance, the industry body behind passkeys, estimates 7 billion passkeys in use as of October 15, 2026, up from 5 billion in May. It says more than a third of sign-ins at 15 major services, including Google, Amazon, PayPal and JPMorgan Chase, now use a passkey. FIDO also says passkey sign-in is nearly three times faster, and that every participant that measures phishing reported fewer successful attacks. These are FIDO’s own estimates, so keep in mind they come from the industry body promoting passkeys.
My simple checklist
This is what I’m doing, and each item ties back to one of the stories above.
- Turn on passkeys wherever a site offers them. Use a password manager for everything else, and give every site its own password.
- Never reuse a password. The 23andMe case shows how one reused password can hurt people far beyond you.
- Never give an AI assistant your bank password. Use the bank’s own approved connections, as the banks themselves now require.
- Be careful what your assistant reads while it’s logged in. If it can open your email or accounts, don’t point it at pages or files you don’t trust.
- Never paste a password, code or key into a chatbot.
- Check twice before moving money. For any payment request, even from a familiar face on video, confirm through a second channel or a second person.
- Keep approvals switched on. If your assistant asks before it sends, pays or deletes something, leave that setting on.
Over to you
As AI assistants take on more of your daily life, how are you deciding which of your logins they get to hold?
Sources
- Brave, Comet research demo: https://brave.com/blog/comet-prompt-injection/
- Perplexity on its fixes: https://www.perplexity.ai/hub/blog/mitigating-prompt-injection-in-comet
- The Register on Comet: https://www.theregister.com/software/2025/08/20/perplexitys-comet-browser-faced-prompt-injection-vuln/1267776
- CNBC on JPMorgan: https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html
- The Verge on Schwab: https://www.theverge.com/ai-artificial-intelligence/1013303/charles-schwab-is-blocking-ai-agents-too
- RBC: https://www.rbcroyalbank.com/en-ca/my-money-matters/money-academy/cyber-security/understanding-cyber-security/understanding-third-party-ai-agents-and-your-rbc-banking/
- Globe and Mail on BMO and TD: https://www.theglobeandmail.com/business/article-bmo-blocks-third-party-ai-agents-rbc-muse-october-28/
- 23andMe: https://www.23andme.org/blog/articles/addressing-data-security-concerns/
- CNN on Arup (company confirmation): https://www.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk
- CNN on Arup (Hong Kong police account): https://www.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk
- The Verge on Samsung: https://www.theverge.com/2023/5/2/23707796/samsung-ban-chatgpt-generative-ai-bing-bard-employees-security-concerns
- Ars Technica on ChatGPT shared chats: https://arstechnica.com/tech-policy/2025/08/chatgpt-users-shocked-to-learn-their-chats-were-in-google-search-results/
- Verizon DBIR 2026: https://www.verizon.com/business/resources/Te26/reports/2026-dbir-data-breach-investigations-report.pdf
- FIDO Alliance, October 2026: https://fidoalliance.org/7-billion-passkeys-and-counting-the-next-chapter-of-passwordless-authentication/
- FIDO Alliance, May 2026: https://fidoalliance.org/fido-alliance-reports-accelerating-global-passkey-adoption-on-world-passkey-day-2026/
