News · High impact
ChatGPT Desktop forwards your SSH agent to remote machines
Hacker News: Front Page ·
The Brief
- ChatGPT Desktop forwards the local SSH agent to remote machines.
- An agent running on a remote machine can authenticate with the user's local SSH credentials.
- Per the source, this lets it push to private GitHub repositories; a proof is linked in an openai/codex pull request discussion.
Why it matters
Developers who use ChatGPT Desktop with remote machines may be giving agents running there access to their local SSH identities, including write access to private repositories.
Who’s affected
- ChatGPT Desktop users who connect to remote machines over SSH
- Developers with GitHub access via SSH keys
- #ssh
- #chatgpt-desktop
- #openai
- #credentials
- #github
- #agent-forwarding
The agent running on a remote machine can authenticate using your local SSH credentials. That means it can push to your private repos on GitHub, for example. Proof: https://github.com/openai/codex/pull/28131#discussion_r3410013180 Comments URL…