Amp can now require active passkey authentication for certain operations, such as remote controlling a thread. This extra authentication factor protects you if an attacker gains access to your account and will serve as proof-of-human for future Amp features.
Update (2026-06-25): We've removed the "sudo" term and now just call it "passkey authentication".
To turn it on: enable Use Passkey Authentication and set up your passkey.
Workspace admins can enforce this requirement for members. Also, some privileged workspace admin operations now always require active passkey authentication.