The report
Approval to sign in is not approval for every site action
1Password's agent security documentation describes item-level requests approved by the human in the password manager. Credentials are decrypted through 1Password's confidential computing environment and filled by an extension in an agent-hosted browser. The agent cannot approve the request itself. The developer, however, controls the hosted browser context and its connection key material.
The critical limit is stated explicitly by the vendor: once an item has been filled and submitted, the agent's actions on the website are outside 1Password's credential-delivery guarantee. Disconnecting the integration revokes its connection keys and approvals, but it does not establish that a web session created on a third-party site has been terminated. The product documentation also permits limited reuse of previously approved items, so a consent decision is not necessarily one browser request.
This is not a report of a breach. It is an important effect-bound approval distinction, similar in principle to the wallet OTP self-approval benchmark: authentication proves possession of a credential, not authorization for arbitrary later transfers, deletions or purchases. Those side effects need their own enforceable checks.
The revocation test belongs to the website too
A credential broker can revoke its own connection keys while an existing browser session cookie remains valid at the destination service. A meaningful test therefore uses a synthetic account: authorize a login, complete it, disconnect the credential integration, and attempt a separately prohibited action with the previously created site session. Only the destination service can demonstrate whether it revoked that session or demanded fresh authorization. This is a distinction between capabilities described in 1Password's documentation and a verified security guarantee about a third-party website. The documentation alone does not establish a stolen credential or a successful attack.
The consent is narrower than the account session
1Password's published flow contains distinct stages: the human authorizes named vault items, a confidential enclave decrypts only the approved material, and the extension fills matching browser pages. The agent developer still operates the browser where the eventual site session lives. That architecture leaves an important boundary outside the credential broker: consent to fill a login does not determine which invoice, transfer or deletion the logged-in website will later permit. A meaningful evaluation would audit the destination application's separate authority and revoke its session explicitly after a broker disconnect. The 1Password entity and the wider effect-bound approval concept cover the division of responsibility. The vendor does not report a compromised deployment here.