Intel / article

Automating a YubiKey for Agentic Logins

Source: jon.oberheide.org
Author: Jon Oberheide
Date: Indexed Oct 25, 2026

From the Daily Brief

Security practitioner Jon Oberheide wrote up how he automated a YubiKey so an agent could complete headless browser logins. He starts by ranking common second-factor methods by how hard they are for an agent to automate, since sites without APIs leave agents facing the same login screens people do. FIDO2 hardware keys require a physical touch, which is the point of them and also what stops an agent. His build uses a relay host, a Raspberry Pi Pico and a reed relay to trigger that touch on request, with controls that limit who can ask the key to sign. The post is explicit that this has a cost. Giving an agent the ability to produce signatures on demand turns a factor designed to prove a human was present into a credential the agent can replay. The write-up is useful as much for that tradeoff map as for the hardware, because it shows which 2FA types an agent can pass and what protection is lost each time.

Read the 2026-10-25 Brief →

Key takeaways · AI-distilled

Oberheide argues automation difficulty does not track security: passkeys are strong yet easy for an , which stores the key material and signs on demand, while SMS and voice-call OTP need rented virtual numbers and run into VoIP blocking and shortcode delivery limits.
A YubiKey never releases its private key and its firmware will not sign without a touch, so his setup relays the FIDO challenge from headless Chromium in a Vercel to a physical host with the key plugged in, then returns the signature to the portal.
The touch is faked electrically: copper tape and a wire on the gold sensor pad, pulled to ground by a SIP-1A05 reed relay after a PC817 optocoupler never worked. The wiring must rest disconnected at power-up, because the sensor appears to calibrate then.
The relay host watches for CTAP keepalives with status UPNEEDED, then sends TOUCH 300 over USB serial to a Raspberry Pi Pico running MicroPython, which drives a GPIO pin to 3.3V for 300 ms, enough to close the 5V-rated relay.
He reports the rig is faster, more reliable and more secure than the phone-call OTP it replaced, says Claude Code wrote the browser shim, relay and Pico firmware, and warns that handing replayable credentials to non-deterministic agents is risky.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.

Read the source jon.oberheide.org