Developers propose scoped password access for Codex, Devin, Claude, and Cursor

• Agent-scoped browser auth got the clearest pitch in LLMJunky's OAIPsswrd concept, which asked Codex, Devin, Claude, and Cursor to let agents use selected passwords, passkeys, and TOTPs without opening the whole vault.
• The missing workflow is GUI-first web work: LLMJunky said many apps still lack APIs in one reply, then narrowed the ask to an isolated in-agent browser with only some credentials in another reply.
• Claude connector sprawl is already live enough to surprise users: trq212's warning said connected Gmail, Calendar, and Slack can also be used from Claude Code and Artifacts.
• Codex is moving in the same connector direction, with bentossell's screenshot showing recommended plugins for Atlassian Rovo, Box, Figma, Outlook, SharePoint, and Teams in app context.
• Safer agent workflows are starting to look like narrow verbs, not broad credentials: nicklaunches lets an agent open a launch draft but never publish it, while nicklaunches' backlink post keeps both sides masked until both accept.

1Password already has a Claude browser-fill flow where Claude pauses while 1Password injects the login and one-time code. Claude's help center says connectors work across Claude, Claude Desktop, Claude Code, and the API, while OpenAI says Codex plugins can add skills, connectors, and MCP tools. Nick Launches is testing the opposite permission shape: no API key in the transcript, just a browser approval link and draft-only agent actions.

LLMJunky's mockup is the cleanest version of the ask: a password-manager-style extension inside the agent's own browser, with per-agent entries instead of full vault access.

The thread sharpened the requirements:

• Selective access, not every password, per LLMJunky's scoped-access reply.
• Web UI support because not every webapp has an API, as LLMJunky put it.
• Native agent GUI support, not a separate workaround, according to LLMJunky's GUI reply.
• Codex support without handing Codex the whole vault, per LLMJunky's Codex reply.
• Native quality-of-life over existing tools, which LLMJunky's QoL reply said was the point.
• No CLI secret path, because LLMJunky worried command-line tools could be exfiltrated.
• An isolated browser session with only some credentials, the version LLMJunky landed on later.

The creator workflow underneath this is mundane and constant: log into WordPress, Stripe, Webflow, Shopify, Beehiiv, Notion, or a client's admin panel, then let the agent do the task that starts after login.

Claude already has a broad connector surface, and trq212 said the boundary is easy to miss.

The claim: connect Gmail, Calendar, Slack, or another Claude Connector once, and Claude Code can use it too, including inside Artifacts. trq212's follow-up pointed people to the Claude sign-in flow.

Anthropic's own support page says connectors let Claude retrieve data and take actions inside connected services, inherit the user's permissions from the source app, and work across Claude, Claude Desktop, Claude Code, and the API via MCP Connector. It also warns that connecting a service grants Claude permission to access and potentially modify data within that service.

The non-dev version showed up in petergyang's trust post, where a commenter asked whether giving ChatGPT full Google Drive permission was safe. Peter Yang's follow-up framed the product pressure bluntly: consumer AI products have huge user bases and enterprise accounts, so private-data leaks are existential petergyang's follow-up.

Codex surfaced a connector inventory in app context, according to bentossell's screenshot.

The listed recommended plugins were:

1. Atlassian Rovo
2. Box
3. Figma
4. Outlook Calendar
5. Outlook Email
6. SharePoint
7. Teams

OpenAI's Codex plugin docs say plugins bundle reusable workflows and can include skills, connectors, or both. The same docs say installed plugins can add skills, connectors, and MCP tools to new chats, with availability in ChatGPT Work on web, ChatGPT Work or Codex in the desktop app, and Codex CLI's plugin browser.

When asked whether the recommendation was targeted, bentossell said it was random bentossell's reply. Random connector suggestions in an agent context still change what users think the agent can touch.

The 1Password pattern already answers part of OAIPsswrd: let the agent ask for a login, then keep the secret out of the model context.

1Password says its Claude integration lets Claude sign into websites and fill one-time passcodes without the credential entering the model, Claude's memory, or Anthropic's systems. In the support flow, Claude asks 1Password for access, the user approves or denies in 1Password, and 1Password fills the page through a channel outside the agent's view.

The security doc goes one layer deeper: Claude receives item metadata plus success or failure status, while credential values are decrypted and filled by 1Password software. Access is approved by a human per request.

LLMJunky's complaint was product fit, not novelty. one reply acknowledged Bitwarden-like options but asked for native app UX, and the later reply reduced the desired interaction to “click a button.”

Nick Launches shows a different scoping move: don't give the agent a credential if the task can stop at a draft.

The posted flow is small and useful:

• Connect the MCP server once.
• Ask the agent to submit a site and return the review link.
• Let the agent read the site and draft the listing.
• Keep publishing human-only.

The Nick Launches API page says search and reads are anonymous, draft creation uses a one-time browser approval link, and no token passes through the transcript. nicklaunches said the tool mix is mostly submission, drafting, and status checks, and nicklaunches' rate-limit reply said limits are generous for now.

Builders Backlinks uses a similar gate for SEO work: the agent can submit a site and find a match, but both sides accept before anything gets written. nicklaunches' match reply described a proposed match where the partner stays masked until both sides accept.

Aakash Gupta tied the credential problem to enterprise vibe coding: once an agent-built app touches data, the company has to know where the app, database, inference, packages, and generated code live.

IBM's 2025 Cost of a Data Breach coverage says 13% of studied organizations reported breaches of AI models or applications, and 97% of those organizations lacked proper AI access controls. IBM's analysis also says 63% of the 600 breached organizations studied had no AI governance policy.

Superblocks 3.0 answers that with infrastructure boundaries: the company says apps can run inside a customer's AWS VPC, use Amazon Bedrock for inference, spin up Aurora or S3 inside the customer's environment, restrict public npm through private registries, and run generated code through scanners plus specialized security agents before production.

The AWS press release frames the same partnership as governed AI-generated app development inside the customer's own AWS environment, with Amazon Aurora invoked in that environment and Smart Router on Bedrock for model routing.

Claude Skills have their own scoping switch.

Moritz Kremb surfaced disable-model-invocation, a setting that prevents Claude from automatically loading a skill. The screenshot says the setting makes a workflow slash-command-only, prevents preloading into subagents, and as of v2.1.196 also prevents the skill from running when a scheduled task fires with the skill as its prompt.

Kremb's earlier routine updated a sales-page seat counter every hour against the moritzkremb/agentOS repo with a Beehiiv connector, shown in moritzkremb's routine screenshot.