Yubico has expanded its partnership with OpenAI into Australia and nine other countries as OpenAI begins requiring hardware-backed passkeys for members of its Trusted Access for Cyber (TAC) program.
OpenAI’s Advanced Account Security (AAS) program went live on 1 September 2026. Under the program, TAC members are required to use hardware-backed passkeys, a move aimed at reducing account takeover risk linked to phishing and credential theft.
As part of the expanded arrangement, Yubico said a custom two-pack OpenAI + YubiKey bundle is now available in 10 additional countries: Australia, Egypt, Japan, Malaysia, Mexico, Saudi Arabia, Singapore, South Korea, Taiwan, and the United Arab Emirates.
The announcement comes amid broader industry efforts to move away from password-based authentication. Hardware-backed passkeys are designed to reduce reliance on authentication methods that can be intercepted or manipulated, such as SMS one-time passwords and push-based approvals, which organisations have increasingly warned can be bypassed by adversary-in-the-middle phishing attacks.
According to the release, under OpenAI’s AAS program, enrolling security keys disables weaker, phishable authentication methods. Yubico said hardware-backed security keys provide a phishing-resistant root of trust using credentials that cannot be copied or silently synced between devices.
Yubico said the expanded availability is intended to support broader adoption of phishing-resistant authentication as organisations and individuals use AI technologies for sensitive research, software development and business workflows. The company also said the same approach can be used to strengthen protection for consumer ChatGPT and Codex accounts, including for personal projects and proprietary code.
The bundle includes two devices: the YubiKey C NFC – OpenAI, intended for tap-to-authenticate use across compatible mobile devices, tablets and computers; and the YubiKey C Nano – OpenAI, a low-profile key designed to remain in a laptop’s USB-C port for ongoing authentication.
Once enrolled, users can access their accounts using hardware-backed passkey authentication without relying on traditional passwords, the release said.
