39 Passkey Vulnerabilities: What AI App Builders Need to Know

Passkeys Aren't Bulletproof: 39 New Attack Methods Discovered

Passkeys were supposed to be the future of authentication—a cryptographically secure replacement for passwords that eliminates phishing, credential theft, and brute-force attacks. But researchers at Token have identified 39 distinct methods for compromising passkey-based authentication systems, challenging assumptions that many developers have made about their security.

According to reporting from BleepingComputer, these vulnerabilities don't break the underlying FIDO2 cryptography. Instead, attackers can exploit weaknesses in how passkeys are implemented, synced, enrolled, and recovered—the human and system layers surrounding the cryptography itself.

Why This Matters for AI Application Security

AI applications increasingly rely on robust authentication to protect user data, API access, and sensitive model interactions. If your AI tool uses passkeys as a security cornerstone, you need to understand that the implementation details matter as much as the underlying cryptography.

The 39 methods identified include attacks on:

• Authentication prompts—tricking users into approving unauthorized access
• Synced credentials—compromising passkeys stored across devices
• Enrollment processes—injecting attackers during account creation
• Recovery mechanisms—bypassing account recovery procedures
• Trust boundaries—exploiting transitions between systems

For LLM applications and AI tools handling user authentication, this research underscores a critical principle: authentication is only as strong as its weakest implementation point.

Risks to LLM Apps and AI Guardrails

Large language model applications often require multi-layered authentication and authorization checks. If passkeys are your primary authentication method, vulnerabilities in enrollment or recovery could allow attackers to gain access without proper verification.

This is particularly concerning for AI tools that enforce guardrails. If an attacker can compromise authentication, they may:

• Bypass rate-limiting and usage controls
• Access restricted AI capabilities or models
• Impersonate legitimate users to circumvent safety policies
• Manipulate audit logs and compliance records

The gap between cryptographic strength and implementation reality creates a false sense of security that can leave systems vulnerable.

What Builders Should Do Next

1. Audit Your Passkey Implementation

Don't assume your passkey system is secure just because FIDO2 cryptography is solid. Review how passkeys are synced, recovered, and enrolled. Look for social engineering vectors and user confusion points.

2. Implement Multi-Factor Authentication

Use passkeys as one authentication factor, not the only one. Combine them with additional verification methods—email confirmation, out-of-band verification, or time-based checks—especially for sensitive operations in AI applications.

3. Strengthen Recovery Procedures

Account recovery is often the weakest link. Implement strict identity verification during recovery, require multiple confirmations, and add delays to prevent automated attacks.

4. Monitor for Suspicious Enrollment Patterns

Track unusual sign-up activity, rapid passkey additions, or recovery attempts. Use behavioral analytics to detect anomalies that might indicate account takeover attempts.

5. Educate Users

Passkey security depends partly on user awareness. Teach users not to approve authentication prompts they didn't initiate and to secure their devices.

The Bottom Line

Passkeys represent real security progress, but they're not a silver bullet. The 39 vulnerabilities documented by Token reveal that implementation matters. For AI application builders, this means treating authentication as an ongoing security concern, not a solved problem. Layer your defenses, monitor for attacks, and remember that the strongest cryptography can still fail at the implementation level.