Codex SSH Agent Forwarding: Concurrent Clients Overwrite Shared Agent Socket and Expose Forwarded Credentials
Developers using OpenAI Codex remote SSH workflows face a credential-hygiene and availability problem rather than a catalogued vulnerability. Forwarded SSH agent sockets can be replaced when several client machines attach to the same remote account, so active git operations on the first workstation fail or hang. Any process on the remote host can also use a forwarded agent to sign requests, which means a forwarded key with broad write rights can be used to push code or trigger GitHub actions without human confirmation. The article reports that engineers proposed a fix in pull request 28131, but that maintainers closed it without merging. No CVE, vendor severity score or in-the-wild exploitation is stated, and the risk depends on a user enabling agent forwarding on a host that other processes or clients can reach. Only the GitHub issue 59694 page was checked in research, and the closed pull request could not be opened to confirm the article's account.
Detalhes técnicos
Agent forwarding lets remote processes ask the local SSH agent to sign authentication requests, so private keys do not need to be copied to the server. The forwarded socket, however, gives every process on the remote host ambient signing authority. In the Codex desktop bootstrap, the shared agent link is a symlink under the Codex home directory (github.com/openai/codex). When a second desktop client connects to the same account and Codex home, it can remove and replace that link. If the new socket does not answer agent requests, operations that use the shared path hang even while the first client's agent is healthy (github.com/openai/codex).
Remediação
- Disable the
ForwardAgentdirective in SSH configuration unless remote signing is strictly required. - Issue dedicated keys with the narrowest repository permissions possible for automation and AI coding agents.
- Use hardware security keys that require physical touch, so background processes cannot produce signatures silently.
- Manage persistent remote agent links by hand on multi-device setups until a vendor fix is confirmed.
Linha do tempo
-
Codex SSH Agent Forwarding: Concurrent Clients Overwrite Shared Agent Socket and Expose Forwarded Credentials
ler a análise desta fonte ocultar
Developers using OpenAI Codex remote SSH workflows face a credential-hygiene and availability problem rather than a catalogued vulnerability. Forwarded SSH agent sockets can be replaced when several client machines attach to the same remote account, so active git operations on the first workstation fail or hang. Any process on the remote host can also use a forwarded agent to sign requests, which means a forwarded key with broad write rights can be used to push code or trigger GitHub actions without human confirmation. The article reports that engineers proposed a fix in pull request 28131, but that maintainers closed it without merging. No CVE, vendor severity score or in-the-wild exploitation is stated, and the risk depends on a user enabling agent forwarding on a host that other processes or clients can reach. Only the GitHub issue 59694 page was checked in research, and the closed pull request could not be opened to confirm the article's account.
Technical Details
Agent forwarding lets remote processes ask the local SSH agent to sign authentication requests, so private keys do not need to be copied to the server. The forwarded socket, however, gives every process on the remote host ambient signing authority. In the Codex desktop bootstrap, the shared agent link is a symlink under the Codex home directory (github.com/openai/codex). When a second desktop client connects to the same account and Codex home, it can remove and replace that link. If the new socket does not answer agent requests, operations that use the shared path hang even while the first client's agent is healthy (github.com/openai/codex).
Remediation
- Disable the
ForwardAgentdirective in SSH configuration unless remote signing is strictly required. - Issue dedicated keys with the narrowest repository permissions possible for automation and AI coding agents.
- Use hardware security keys that require physical touch, so background processes cannot produce signatures silently.
- Manage persistent remote agent links by hand on multi-device setups until a vendor fix is confirmed.
- Disable the