OpenAI Codex PR 28131 implements SSH agent forwarding in ChatGPT Desktop
OpenAI's ChatGPT Desktop now forwards SSH credentials to remote agents via Codex changes in PR 28131. This grants the agent authenticated access to private repositories without additional user input. The integration follows prior patterns in other AI coding tools and raises unaddressed authorization questions.
The change appears in openai/codex pull request 28131. A remote process receives the forwarded SSH_AUTH_SOCK and can therefore sign git operations or SSH connections without additional credentials. The linked discussion confirms the behavior through direct reproduction on GitHub.
SSH agent forwarding has existed since OpenSSH 2.9, yet its use inside an AI-controlled desktop session creates a new attack surface. Any prompt that reaches the remote agent can now trigger authenticated actions on the user's behalf. No rate limits or scope restrictions are documented in the PR.
Comparable patterns exist in Cursor and GitHub Copilot Workspace, where local credential delegation was added without per-action authorization. The Codex implementation follows the same path, prioritizing seamless repo access over explicit consent dialogs.
Deployment of the desktop binary containing this code began in late 2024. Subsequent releases will determine whether forwarding remains always-on or moves behind a user toggle.
Sources (2)
- [1]Primary Source(https://github.com/openai/codex/pull/28131)
- [2]Supporting Source(https://news.ycombinator.com/item?id=50422628)