If an agent can open your password manager, what can a hostile web page make it do?

It can make the agent take a secret out of the vault and put it somewhere you did not mean: into a form on that page, into the chat, or into a log. The page does not need your master password if the agent is already allowed to open entries. Once the page’s text and your task sit in the same prompt, the model can treat the page as part of the job. You will not reliably spot that from the summary. The decision is to never give the agent the password manager. A hostile page can waste a logged-out browser session. It cannot open a vault the agent does not have.

This is an access choice, not a cleverness contest with the page. Remove the tool.

What “can open your password manager” includes

It includes an official integration, a browser extension the agent is allowed to drive, a desktop app left unlocked on the same machine, and a browser profile that already has saved passwords. Those are the same grant with different icons. If the agent can ask for “the login for this site” and receive it, the vault is open to whatever the agent is reading.

It also includes a vault you unlocked “just for this task” and forgot. The session stays. The next page the agent opens is still inside that session. I have seen people lock the manager at night and leave it unlocked all afternoon because a setup guide said the agent needs it to get past a login wall. The login wall was the reason not to connect it.

A human typing a password into a window the agent cannot read is not this grant. The agent can still fill other fields. It cannot fetch the next site’s password, because there is no next fetch. That difference is the whole article.

What the page can cause, once the tool exists

The agent is on the page because you asked it to read something, sign up for something, or grab a document. The page contains text. The model does not have a trustworthy line between your instruction and text that arrived from the network. A hostile page can be written so that text tells the agent to use its tools. I am not going to spell out how that text is shaped. The outcome is what matters for the decision.

If a vault tool is on the list, the outcome can be: the agent looks up an entry, and the secret appears in a form on the page, in a request the page can see, or in the transcript you might paste somewhere later. It can be an entry for that site or, worse, an entry the page asked for by name that belongs to a different site. The model is trying to finish a task. “Use the saved login” feels like finishing.

The secret can also land in the agent’s log without ever being “sent” on purpose. Tool results go back into the prompt. A log that stores tool results now stores the password. Anyone who can read that log later, or any later step that summarizes the log into a ticket, has the secret. You did not need a dramatic exfiltration story. You needed a verbose trace.

A page can also make the agent use the secret to sign in and then continue as you. That session is your account. Mail, billing, or the company admin page, depending on which entry it opened. The hostile page did not break the password manager’s encryption. It asked an assistant that was allowed to decrypt on your behalf.

Why a warning in the prompt does not fix it

I tried the sentence people want to be enough: do not take passwords from the page, only use the vault when I ask. The tool was still there. The model’s job, as it understood it, was to complete the signup. Completing the signup wanted a password. The vault was the place passwords live. The warning and the tool disagreed, and the tool is a capability, not a suggestion.

A second model checking the first does not fix it either, if both can see the vault tool and both are trying to be helpful. They will agree that logging in was necessary. The check that works is the absence of the tool. There is nothing to approve.

Vendor promises that “we filter secrets” are a backstop, not a grant. Filters miss. They also do not stop the agent from using a secret on a page without printing it in the chat, which is the case you should worry about more. If the filter is your safety, you have already connected the vault. Disconnect it.

What I leave human

I type secrets myself. The agent can reach a login page in a browser profile with no saved passwords and stop. I take the keyboard, I type, I hand it back only if the next step is still something I am willing to let it see. Often I do not hand it back. The logged-in session is the valuable part, and I do not want that session in an agent profile.

I do not install the password manager’s agent integration. I do not leave the desktop app unlocked beside an agent that can click. I do not reuse my daily browser profile “so the passwords are already there.” That sentence is the grant. A separate profile with an empty password list is the browser I will let an agent drive, and only for pages that do not need an account.

If a task cannot be finished without a login, the task is human at the login step. The agent can draft what I wanted from the site. I fetch the page while logged in, or I do the click. This is slower. It is also the line between a page that can annoy the agent and a page that can spend my accounts.

What to do if you already connected it

Disconnect the integration. Lock the vault. Close the unlocked app. Remove the agent’s permission in the password manager’s authorized-apps list, and delete the browser profile the agent was using if it had saved passwords. Do that before you try to understand how clever the page was.

Then assume entries the agent could open might have been copied into a log or a page. I rotate the passwords for accounts that matter — mail, banking, the registrar, work admin — if the agent had vault access while it browsed, even if I am not sure a bad page was involved. I would rather rotate than reconstruct a transcript. I do not go hunting through the agent’s memory by asking the same agent to “list what you revealed.” That is another prompt in a system I am trying to shut off.

After the revoke, the test is simple. Ask the agent for a password it used to be able to fetch. It should say it cannot. If it still can, you missed a path: extension, unlocked app, or a second integration. Remove that path too.

Autofill and a shared work vault

Browser autofill is the same problem in a quieter costume. If the agent is driving your everyday profile, the browser may offer a saved password without a separate “password manager” tool ever appearing in the agent’s tool list. You think you refused the integration. The profile still has the secret, and a click the agent makes can accept the fill. I treat a profile with saved logins as vault access. The agent gets a profile I created empty, and I check the password settings in that profile before the first run.

A shared work vault is worse than a personal one, because the entries are not all yours. An agent that can open the team vault can pull a colleague’s admin login or a production key the page named. Your personal caution does not shrink that list. If the team vault is connected “so the agent can reach staging,” staging now depends on a tool that can also reach everything filed next to staging. I would rather keep a staging password in a note I type than put the team vault on the agent. The note is one secret. The vault is the map.

Logs deserve a look even after you disconnect. Old transcripts can contain a tool result from last week. Deleting the integration does not scrub the file the agent already wrote. I delete the agent’s chat export and the run log for the period the vault was connected, and I do not archive them “in case.” An archive of revealed secrets is still the secret. If the product stores history on a server, I use its delete, not only the button that hides the chat in the sidebar.

The page is allowed to be hostile. The vault is not allowed to be attached.

You will not pre-approve every site an agent might open. Docs sites get compromised. Ads get weird. A search result is not a colleague. The realistic control is not a list of trusted domains plus a vault. The realistic control is a browser that can read public text and a human who types secrets.

If the agent can open your password manager, a hostile page can turn that into a revealed or reused secret, and into a session that is you. If it cannot, the same page can only mislead the reading. Misleading a summary is a bad afternoon. Handing over the vault is the account. Leave the account human.