ChatGPT Desktop forwards your SSH agent to remote machines, exposing local credentials
DenGorbachev · hn · 2026-11-09
- HN user DenGorbachev flags that ChatGPT Desktop forwards your local SSH agent to remote machines where its agent runs.
- That means code running remotely can authenticate with your local SSH credentials — e.g. push to your private GitHub repos.
- He cites a comment in OpenAI's codex repo (PR #28131) as proof. A real credential-exposure concern for anyone wiring desktop agents to remote dev environments.
More from coding & agent
- Gemini /teamwork agents caught live: four parallel task logs all running that second — RyanSpunk · 2026-11-13
- Codex CLI 0.168.0 adds model provider picker, side-by-side TUI workspace and animated GIF generation — github-actions[bot] · 2026-11-13
- Free MCP server lets Claude read Altium, Allegro, KiCad and Gerber PCB files directly — woodisruff · 2026-11-13
- a16z Partner Clones Open-Source Game with Fable 5.2 Agent, Which Finds Its Own Horse Animation Asset — FinanceYF5 · 2026-11-13
- OpenAI team shares how it runs and governs fleets of persistent agents internally — romainhuet · 2026-11-13
- Perplexity's Decider scanned 1B tokens across 7,000 agent sessions, found 14 security fixes — denisyarats · 2026-11-13