OpenAI mandates hardware-backed passkeys for Trusted Access Cyber members

OpenAI just dropped a big new rule: starting September 1, people in its Trusted Access for Cyber program — the group with access to more powerful cyber-focused AI tools — must use a hardware security key to keep access. In plain English, that means a tiny physical device you tap or plug in to prove it’s really you. OpenAI says this is about stopping phishing scams and account hijacks before they turn into something much worse. But in the comment section, the real action wasn’t just about safety — it was about who this applies to, who gets left out, and whether this is part security move, part product pitch.

The mood swung fast from cautious approval to full side-eye. One commenter immediately asked the question lurking in everyone’s brain: who exactly has to do this? Is it only elite security researchers with near-unrestricted access, or does it also hit regular users who verified their identity for slightly looser coding tools? Another commenter sounded the alarm over a future where only “approved” devices get to talk to AI at all — a classic slippery-slope fear that turned the thread from “good security practice” into wait, is this how lock-in starts? And then came the spiciest jab: “It’s an advertisement by Yubikey.” Ouch. That one landed because the announcement includes co-branded keys and a discounted 2-pack, which some readers saw as practical and others saw as a giant neon sponsor energy moment.

Still, not everyone was roasting. Some commenters were basically saying, honestly, this had to happen. One called mailing a physical token to a real address “an extremely powerful access control method,” while another shrugged at the co-branding but warned that letting AI agents act without hardware proof is a great way to get your codebase wrecked. So yes, the policy is serious — but the community reaction is the real show: half finally, common sense, half nice ad, guys.