ChatGPT Desktop Forwards Your SSH Agent to Remote Servers — and Codex Can Push as You

A post on Hacker News this week raised a quiet but potentially serious question about the security architecture of ChatGPT Desktop: when you connect the app to a remote server via SSH, the inherited coding agent on that server has access to your local SSH agent — meaning it can authenticate in your name on private GitHub repositories and any server that trusts your keys.

What was discovered

The discussion gained traction on Monday, November 9, when user DenGaborchev posted a straightforward claim on Hacker News: «The agent running on a remote machine can authenticate using your local SSH credentials. This means it can push to your private repos on GitHub, for example.» The «proof» link was a comment on a code review in the openai/codex repository (pull request #28131), made by OpenAI engineer abhinav-oai, describing the `--forward-ssh-agent` flag and how the agent socket was linked to a stable path on disk (`~/.codex/app-server-control/forwarded-ssh-agent.sock`).

What makes the issue more interesting is that the pull request in question was closed without being merged — which led commenters on HN to question the «proof». However, PrivacyAffairs verified on the latest macOS build version (26.1103.60933, built on November 8) that the behavior does in fact exist: the app doesn't activate forwarding on its own, but when the user's SSH configuration (`~/.ssh/config`) already has `ForwardAgent yes`, the app ensures the background agent server keeps the keys accessible to the Codex running on the remote server.

How it works technically

The ChatGPT Desktop, since July 2026, has integrated Codex — OpenAI's coding agent — as part of its remote development functionality. In the app settings, the user adds a remote host from `~/.ssh/config`, and chats in that project read files and execute commands on the server. The app connects using OpenSSH, as documented.

The critical detail, however, doesn't appear in OpenAI's documentation. Every time the app connects, it executes a shell line on the server: if the session has a live SSH agent socket (`SSH_AUTH_SOCK`), it links it to `~/.codex/app-server-control/forwarded-ssh-agent.sock`. The Codex app server, launched in the background with `nohup`, has its `SSH_AUTH_SOCK` pointing to this link. Every command the agent executes inherits this environment variable.

While the app is connected, `git` and `ssh` on the server can authenticate with any key loaded in the agent on your computer. This is an intentional capability, not a bug — users reported in a bug report (issue #22567) that Remote SSH ignored `ForwardAgent` and broke `docker buildx build --ssh`. In June 2026, engineer Abhinav Vedmala proposed a `--forward-ssh-agent` flag in pull request #28131. The current behavior, although the flag is no longer in the Codex main branch, implements the same functionality through the app's own shell script.

Why it matters more with an AI agent

The difference between an AI agent and a manual script is that the agent reads text instructions — READMEs, GitHub issues, pull request comments. And OpenAI's own security documentation warns that «prompt injection can cause the agent to fetch and follow untrusted instructions». A coding agent that reads a booby-trapped README or an issue has your identity at hand for GitHub and for every server that trusts your key.

There is a brake: by default, Codex runs with network access off and asks before commands that need it. A `git push` waits for your approval. That prompt is the only protection, and it protects you only as well as you read it.

The most exposed scenarios are exactly those that GitHub's own documentation warns against: `ForwardAgent yes` under `Host *`, which means «you'd be sharing your local SSH keys with every server you SSH into». With the ChatGPT app, you'd also be sharing them with the AI working on those servers.

How to check and disable

PrivacyAffairs recommends two immediate checks. First, check if a forwarded agent socket exists for your AI tooling:

``` ls -la ~/.codex/app-server-control/ 2>/dev/null || echo "no codex agent socket" ```

Second, what keys could be signed right now:

``` ssh-add -l ```

If the output is «The agent has no identities.», nothing to abuse. If there's a list of key fingerprints, these can be signed, silently, by any process sharing your agent.

To disable forwarding only for the ChatGPT app, create a specific alias with forwarding off, above any `Host *` block:

``` Host devbox-chatgpt HostName devbox.example.com ForwardAgent no ```

Then add that alias in Settings > Connections of the app.

The broader pattern

This isn't the first time a coding agent has raised concerns about credential management. Last week, Apiiro reported that Claude Code, with the «Don't Ask Again» default activated, leaked keys in over 1,100 repositories. The underlying problem is the same: AI agent tools standardizing toward maximum credential reuse, when security by default should be the minimum necessary.

The boundary between what the agent reads and what the agent can do continues to shift. Historically, AI agents could read your files and execute authorized commands. Now, with SSH agent forwarding, they can act in your name — not just executing commands, but signing commits, pushing to private repositories, and authenticating on servers as if they were you. The question is whether the implicit trust model between user and AI agent is sufficient, or if we need an additional layer of explicit verification for each sensitive operation an agent performs with our credentials.

Sources: PrivacyAffairs, DEV Community, AI Weekly

✓ Independent sources cross-checked and verified before publishing