The AI coding agent that carries your SSH keys
The Codex integration in ChatGPT Desktop — OpenAI's desktop application for macOS, Windows, and Linux — does something the official documentation has never mentioned: it forwards your local SSH agent to any remote machine where the Codex agent executes commands. The result is that whenever you run a task in Codex on a remote server, that process has direct access to your private SSH keys — the same power you would have if you were logged into that machine as your user.
How it works
When connecting to a remote host via SSH, ChatGPT Desktop does not explicitly add `-A` or `ForwardAgent=yes` to the SSH options — the app follows the default configuration from your `~/.ssh/config` for that host. The unexpected behavior appears on the remote side: each time the app connects, it executes a shell line that checks if there is a live SSH agent socket (`SSH_AUTH_SOCK`) and binds it to `~/.codex/app-server-control/forwarded-ssh-agent.sock`. The Codex app server, launched in the background by the app, points its own `SSH_AUTH_SOCK` to that symlink. Every command the agent runs inherits that socket.
The practical effect is straightforward: during the connection session, `git push` to private GitHub repositories, `ssh` to other servers, and any tool that uses SSH authentication on the remote server authenticate as you, not as the remote user. The Codex agent can push to your private repositories, create branches, and open pull requests — all signed with your keys.
What the source code shows
The proof is in OpenAI's own repositories. Pull request #28131 in the openai/codex repository, titled "Refresh SSH agent for app-server proxy", contains review comments from engineers discussing the daemon environment line `SSH_AUTH_SOCK=~/.codex/app-server-control/forwarded-ssh-agent.sock`. The `--forward-ssh-agent` flag on the Codex app-server integration does exactly what the name says: take the user's local SSH agent and make it available inside the agent's execution environment. Reviews in the same pull request discuss stale symlink edge cases after new SSH sessions — which confirms this behavior is intentional, not a bug.
An open issue (#59694) documents a derived problem: when Windows and macOS Codex desktop clients connect to the same NixOS account, a connecting client can replace the forwarded SSH socket of the other. This shows that the mechanism is not only real, but also produces observable side effects in cross-platform scenarios.
What the documentation says (and doesn't say)
The ChatGPT Learn "Remote connections" documentation details how to configure SSH hosts in Codex: adding aliases to `~/.ssh/config`, confirming connectivity, and installing the `codex` command on the remote PATH. It recommends keeping remote hosts with the same security expectations as normal SSH access — trusted keys, least-privilege accounts, and no unauthenticated public listeners. But it does not mention SSH agent forwarding in any section. The Cloud Security documentation also does not address this aspect.
In OpenAI's official launch page, "Work with Codex from anywhere", the article describes the secure relay, state synchronization across devices, and HIPAA support for Enterprise workspaces. Agent forwarding appears silently as an implementation detail, not as a security decision that would warrant prominent documentation.
Why this matters
The classic rule of SSH security is simple and long-standing: never forward your SSH agent to a host you do not fully trust. An attacker on the remote server could use your agent to sign Git commits as you, access private repositories, or impersonate you on other SSH connections. Forwarding exists to enable administrative access to servers — you log into server A and from there access server B using your local credentials. The convenience is undeniable, but the risk is widely known.
What ChatGPT Desktop does is different in one crucial point: the risk does not come from an attacker on the server, it comes from the OpenAI agent itself executing arbitrary code on that server. If Codex executes a command that triggers `git push`, your keys sign the commit. If the agent runs a script that connects to another server, your agent authenticates the connection. The user sees no confirmation that their keys are being used — the interaction is entirely invisible within the agent's environment.
Security experts have already raised warnings about similar risks. An article from Privacy Affairs details how the behavior was discovered and mapped step by step. The DEV Community article points to PR #28131 from OpenAI as irrefutable proof: three public artifacts — the `--forward-ssh-agent` flag, the stable socket at `~/.codex/app-server-control/forwarded-ssh-agent.sock`, and issues documenting side effects across multiple clients — form an open audit case. Palo Alto Networks, in guidelines for enterprise Codex teams, explicitly recommends restricting which agents can run and isolating execution environments from AI tools.
What you can do now
The good news is that forwarding is not activated automatically — it only occurs when your `~/.ssh/config` requests `ForwardAgent yes` for that specific host or for `Host *`. If you have never enabled forwarding on any of your hosts, the agent has nothing to forward. But if you use forwarded agent for server administration, ChatGPT Desktop has just become another trusted host in your chain.
To protect yourself without abandoning Codex:
1. Check for a forwarded socket. Run `ls -la ~/.codex/app-server-control/forwarded-ssh-agent.sock` on the remote server. If the link exists, your agent is being forwarded.
2. Create a dedicated alias for the ChatGPT Desktop. Add to the top of your `~/.ssh/config`, before any `Host *` block, a block like `Host devbox-chatgpt` followed by `ForwardAgent no`. This prevents the app from inheriting forwarding from other hosts.
3. Consider keys inside a secure enclave. Keys stored in secure enclaves on macOS or Windows require biometric confirmation for each use — fingerprint or PIN. Even if the socket is forwarded, the agent cannot sign without your physical interaction.
4. Monitor your repositories. Check GitHub commit logs from the past days to confirm whether any push was made while Codex was connected.
What ChatGPT Desktop does with your SSH agent is not a bug — it is an undocumented feature that turns a remote server into a direct bridge to your digital identities. The principle of "zero trust" in SSH dates back decades, but autonomous coding agents like Codex are reshaping what "trusted machine" means in 2026. The question that remains: when productivity tools start carrying your cryptographic keys into remote environments, who should approve that risk — the end user or the software manufacturer?
Sources: Privacy Affairs, DEV Community, Hacker News
✓ Independent sources cross-checked and verified before publishing
