Yubico has launched the YubiKey 5.8, a firmware update that extends its hardware security keys beyond secure logins into document signing, identity verification and sign-off on actions taken by AI agents.

The update marks an expansion of the passkey’s role from authentication alone to verifiable, hardware-backed authorisation, giving enterprises a way to confirm not just who is logging in, but what actions a person – or an autonomous AI agent acting on their behalf – is approving.

Securing actions, not just logins

Yubico says traditional multi-factor authentication is failing to keep pace as generative and agentic AI drive faster, more automated cyberattacks. Security teams increasingly need to secure not just who logs into a system, but exactly what actions a user or autonomous AI agent can perform once inside it.

“YubiKey 5.8 represents one of the most significant architectural updates to the modern authentication ecosystem by expanding phishing resistance into the workflows themselves,” said Albert Biketi, chief product and technology officer at Yubico. “In an era where AI agents execute high-consequence business workflows, organizations must enable dynamic verification of human intent.”

Built on open standards

The firmware introduces support for the CTAP 2.3 standard, alongside preview support for the emerging WebAuthn signing extension, letting developers build secure, privacy-preserving workflows without relying on costly backend key management systems. Other upgrades include expanded Enterprise Attestation support across 16 Relying Party IDs on a single key, persistent PIN/UV auth tokens for less frequent prompts, and support for digital identity wallets and Secure Payment Confirmation for hardware-backed payments.

• Hardware-backed digital signatures for document signing, identity wallets and workflow approvals
• Expanded Enterprise Attestation supporting up to 16 Relying Party IDs per key
• CTAP 2.3 support with preview WebAuthn signing extensions for developers
• Support for digital identity wallets and Secure Payment Confirmation

“The new signing capabilities of YubiKey 5.8 is a game changer for digital identity and credentials,” said Leif Johansson, executive director at SIROS Foundation, adding that the addition of signatures opens a range of new applications without introducing platform lock-in.

YubiKey 5.8 began shipping across all major YubiKey product lines from 22 July, supporting all existing YubiKey 5.7.4 capabilities. The FIPS and CCN series will remain on the validated 5.7.4 firmware while recertification is completed.