ChatGPT’s Desktop App Lets Its Coding Agent Use Your Forwarded SSH Keys

What the App Does on Your Server

Codex, OpenAI’s coding agent, has been part of the ChatGPT desktop app for macOS and Windows since 9 July, according to OpenAI’s changelog. Under Settings > Connections you can add a machine from your ~/.ssh/config, and chats in that project then read files and run commands on it. The app connects with your host alias through OpenSSH, the documentation says.

The SSH options the app adds contain no -A and no ForwardAgent=yes. For OpenAI’s own cloud connections it even sets ForwardAgent=no. On your servers, forwarding happens when your config asks for it, for that host or for all of them.

The next step is the undocumented one. Each time the app connects, it runs a short shell line on the server: if the session has a live agent socket (SSH_AUTH_SOCK), it links it to ~/.codex/app-server-control/forwarded-ssh-agent.sock. The Codex app server, which the app starts in the background with nohup, has its SSH_AUTH_SOCK pointed at that link. Every command the agent runs inherits it. While the app is connected, git and ssh on the server can authenticate with any key loaded in the agent on your computer.

Users asked for this. A bug report on the Codex tracker complained that Remote SSH ignored ForwardAgent and broke docker buildx build --ssh. In June, OpenAI engineer Abhinav Vedmala proposed an opt-in --forward-ssh-agent flag in pull request #28131. His review comment, the one cited on Hacker News, shows the app starting the server with the forwarded socket. The flag isn’t in Codex’s main branch as of 9 November; the app now does the same with a shell script of its own.

A report from 5 November shows a side effect. When two of your computers connect to the same server account, the newer connection replaces the shared link, so the agent ends up with whichever computer’s keys connected last.

Why It Matters More With an AI Agent

Agent forwarding has always come with a warning. “Agent forwarding should be enabled with caution,” the OpenSSH manual says: anyone who can bypass file permissions on the remote host, such as root, can use your agent through the forwarded connection. They can’t copy the keys out, but they can log in as you while you’re connected. The OpenSSH project calls the agent “a desirable and frequently-exploited target for attackers.”

Here the program holding your agent takes instructions from text. “Prompt injection can cause the agent to fetch and follow untrusted instructions,” OpenAI’s security documentation warns. A coding agent that reads a booby-trapped README or issue has your identity at hand for GitHub and for every server that trusts your key.

There is a brake. By default Codex runs with network access off and asks before commands that need it, the same page says, so a git push waits for your OK. That prompt is the whole check, and it protects you only as well as you read it.

Most exposed are the setups GitHub’s own docs warn against: ForwardAgent yes under Host *, which means “you’d be sharing your local SSH keys with every server you SSH into.” With the ChatGPT app, you’d also be sharing them with the AI working on those servers.

How to Check It and Switch It Off

1. See what your config says. On your computer, ssh -G <alias> | grep -i forwardagent prints the setting that applies to that host once all Host blocks are read. forwardagent no means the app has nothing to pass on.
2. Look on the server. ls -l ~/.codex/app-server-control/forwarded-ssh-agent.sock shows whether the link exists and which socket it points to.
3. Turn it off for the app only. Give the app its own alias with forwarding off, above any Host * block, because ssh uses the first value it finds. Then add that alias under Settings > Connections:

   Host devbox-chatgpt
     HostName devbox.example.com
     ForwardAgent no

4. If you want git on the server to use your keys, narrow what they can do. ssh-add -c makes every use of a key wait for your confirmation (through an ssh-askpass program), and ssh-add -h (OpenSSH 8.9 and later) limits which hosts a key may be used for. Commenters on Hacker News suggested keys that need a touch for every use, on a YubiKey or in the Mac’s Secure Enclave with the open-source app Secretive.
5. Or don’t forward at all. A separate key on the server with only the access the job needs, such as a GitHub deploy key for one repository (read-only unless you allow writing), keeps your personal keys on your own computer.