I just logged into GitHub and used my Yubikey #U2F security key when prompted -- but I swear I didn't actually get to tapping the button! It just logged me in after I inserted the key...
It's possible I slipped and touched the button. Maybe. But this is also a fairly flaky USB port, so I wonder if the key is susceptible to power glitching.
Wouldn't be a huge issue in this case, I think, but it makes me wonder.