ChatGPT Desktop Passes Forwarded SSH Keys to Its Remote Coding Agent

Article Details

Attack Vectors

• When SSH agent forwarding is enabled in the user's SSH configuration, the ChatGPT desktop app links the forwarded agent socket on the remote server and makes it available to commands run by Codex.
• A coding agent that reads a booby-trapped README or issue could be prompted to follow untrusted instructions and use the forwarded keys while the session is active.
• A user with access to the remote host, including root, may be able to use the forwarded agent to authenticate as the key owner while the connection remains active, although the keys cannot be copied out.
• With ForwardAgent yes under Host *, the forwarded agent may be exposed to every server the user connects to; connections from multiple computers to the same server account can also replace the shared socket link.

Defensive Notes

• Check the effective setting with `ssh -G <alias> | grep -i forwardagent`; use `ForwardAgent no` for the app's SSH alias and place it before any matching `Host *` block.
• Check whether the forwarded socket link exists on the server with `ls -l ~/.codex/app-server-control/forwarded-ssh-agent.sock`.
• Use `ssh-add -c` to require confirmation for key use, or `ssh-add -h` on OpenSSH 8.9 and later to restrict the hosts for which a key may be used.
• Avoid forwarding personal keys; use a separate server-side key with only the required access, such as a repository-specific GitHub deploy key.
• Codex reportedly runs with network access off by default and asks before commands requiring it, but the article cautions that this confirmation is only protective if the user reviews it.