Credential Exchange lets Android password managers move passkeys without a CSV file
Google began supporting Credential Exchange in Google Password Manager in June 2026, so Android apps can move passkeys without a CSV file. Businesses should confirm that notes and attachments arrived before retiring a manager, TechRepublic advises.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher Hermes Agent v0.21.2 routes passwords around its model straight into the login page
Hermes Agent v0.21.2 fills passwords from 1Password, Bitwarden or its own vault into web pages without the model ever seeing them. Every card fill waits for a person, so the agent cannot charge a stored card on its own, cron jobs included.
Reality
- Evidence38
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence40
Muse can open a browser and click buy, but the credential at checkout is Link built by Stripe, and the only money Meta has put a price on is a $20 and $100 monthly subscription rather than a cut of what the agent spends.
Perspective Coverage
5 publishers
- Builder
- Builder 30%
- Operator
- Operator 41%
- Investor
- Investor 29%
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap+35
- Incentives70
- Confidence60
buildOne report1 publisher One Python file wraps SOPS and age to keep API keys out of an agent's context window
A new local-only vault delegates all encryption to SOPS and age, then adds an MCP server so an assistant can act on a secret without receiving it. Adoption costs three artifacts on every machine.
Reality
- Evidence28
- Adoption
- Not scored
- Hype gap+32
- Incentives85
- Confidence55
Trail of Bits says 1Password's 26% AI patch score reflects flawed prompts, no-code-execution trials, and grading errors, not true AI performance
The 26% clean-fix rate now quoted to keep coding agents out of patch work came from six hand-picked hard bugs, and 22% of the runs behind it instructed the agent to apply a fix known to be wrong.
Reality
- Evidence62
- Adoption20
- Hype gap+12
- Incentives68
- Confidence55
Refusal-stripped open-source agents broke five of a researcher's own accounts in five hours
Shrivu Shankar rented cloud GPUs, pointed about 100 abliterated open-source agents at his own name, and five hours later two weak passwords and three old side projects had fallen while his Gmail, 1Password and bank held.
Publishers:blog.sshh.io
Reality
- Evidence44
- Adoption22
- Hype gap+9
- Incentives36
- Confidence55
Investors are pricing a head start that an acquirer's legal team can delete
GrokBot Googles for users and Instinct scrapes LinkedIn, both against somebody's terms of service, and Jason Lemkin says that edge is open only to private companies. At EchoSign the same approach was ripped out the night the Adobe deal closed.
Reality
- Evidence42
- Adoption32
- Hype gap+22
- Incentives76
- Confidence54
83,000 downloads bought Meta's Muse the No. 2 spot on the App Store
Sensor Tower puts Muse past 83,000 iOS downloads in the United States in its first two days. Threads did more than 4.3 million on its launch day, and the Meta AI app did 108,000 on its first. Muse is No. 2 anyway.
Reality
- Evidence50
- Adoption42
- Hype gap+28
- Incentives58
- Confidence48
1Password's $300,000 patron badge ties its brand to DHH's Omarchy
The company told staff the money went to the Omacom Foundation rather than to a person, and cited Omarchy's rank among its users as the reason. Customers and employees are reading it as a decision about a person anyway.
Reality
- Evidence72
- Adoption38
- Hype gap+12
- Incentives74
- Confidence63
buildOne report1 publisher Omarchy Itemises $12.6M in Patron Money as Omacom Foundation's Legal Registration Remains Unspecified
Omarchy's patron ledger names twelve individuals and two companies and adds up to the dollar. The nonprofit meant to hold the trademarks has no jurisdiction, entity or headquarters on the record, and that is the part a fleet owner should be pricing.
Reality
- Evidence42
- Adoption47
- Hype gap+24
- Incentives74
- Confidence55
The QA-to-prod escalation is where agent identity taxonomies earn their keep
1Password sorts the agents it sees in production into six identity profiles. The useful test is whether any of them can lend an agent production rights mid-task and take them back afterwards.
Publishers:1password.com
Reality
- Evidence36
- Adoption
- Not scored
- Hype gap+24
- Incentives82
- Confidence44
buildOne report1 publisher Decoys in the .env file: Jitpass bets on lying to your coding agent
A Mac utility replaces plaintext credentials with fake ones and injects the real value into an approved process after Touch ID. The pattern is now on every security team's evaluation list.
Reality
- Evidence36
- Adoption9
- Hype gap+28
- Incentives68
- Confidence38
buildOne report1 publisher Pass-ta-key breaks Chrome's device trust, not WebAuthn: harden the endpoint, keep the rollout
Unit 42's three techniques all assume malware is already running on the box. That makes this an endpoint and browser-profile problem, not a reason to stall a passkey deployment.
Reality
- Evidence44
- Adoption24
- Hype gap+12
- Incentives41
- Confidence42