Claude Code will not fill in passwords or operate a password manager on a user's behalf. The behaviour is tracked in GitHub issue 65358, filed as a limitation by users who wanted an agent to complete a login flow.
It is better understood as a boundary than a gap. An agent that can type credentials is an agent that can be persuaded to type them somewhere else, and the persuasion surface for a coding agent is every file, page and tool output it reads. Refusing the capability outright removes a class of attack that no amount of prompt hardening fully closes.
The timing sharpens the point. Morgan Stanley began blocking third-party AI agents from its platforms this week, with JPMorgan, Bank of America and Citi restricting them, after finding agents operating inside customer accounts - in many cases because customers had handed over usernames and passwords. A Chase spokesperson's advice was not to give credentials to anyone. An agent that declines to accept them is implementing the same policy from the other side.
Sources
Tech Pulse Daily