When it runs an agent on a remote machine, ChatGPT Desktop forwards your SSH agent, so the agent over there can use your local keys. That means it could push to your private GitHub repos, for example. The proof is in the linked Codex PR discussion, and there's a busy HN thread too: 

One fix people suggest is hardware-backed keys that need a touch or fingerprint for every new session. Anyone here running coding agents on remote boxes? How are you keeping them away from your keys?

tech

When it runs an agent on a remote machine, ChatGPT Desktop forwards your SSH agent, so the agent over there can use your local keys. That means it could push to your private GitHub repos, for example. The proof is in the linked Codex PR discussion, and there's a busy HN thread too: https://news.ycombinator.com/item?id=50422628

One fix people suggest is hardware-backed keys that need a touch or fingerprint for every new session. Anyone here running coding agents on remote boxes? How are you keeping them away from your keys?