{"generated_at":"2026-11-12T18:49:11.960Z","source":{"name":"Hacker News public API","url":"https://github.com/HackerNews/API","attribution":"Stories and comments are public Hacker News submissions by their respective authors. HackerHub is an independent reader, not affiliated with Y Combinator.","content_is_untrusted":true},"story_id":50422628,"hn_url":"https://news.ycombinator.com/item?id=50422628","total_comments":79,"returned":19,"scope":"Up to the requested number of top-level comments in Hacker News ranked order. Deleted comments are omitted. Nested replies are not fetched; this is not the complete thread.","comments":[{"id":50423388,"author":"recsv-heredoc","created_at":"2026-11-09T09:51:36.000Z","text":"It's amazing how often product decisions head this way for the purposes of 'removing friction'.\nIn security, friction is a GOOD thing. You want to have some ceremony to do things. It's pretty much inevitable that people will give up control for convenience.\nLook at Artifacts for example.","parent_id":50422628,"replies_count":7,"hn_url":"https://news.ycombinator.com/item?id=50423388"},{"id":50423130,"author":"littlecranky67","created_at":"2026-11-09T09:19:14.000Z","text":"I'd suggest to use ssh keys inside the secure enclave on macOS that require your fingerprint for every new session [0]. That way agents cannot initiate anything, and you will always be aware when a new ssh connection is being made.\n[0]: https://gist.github.com/arianvp/5f59f1783e3eaf1a2d4cd8e952bb...","parent_id":50422628,"replies_count":4,"hn_url":"https://news.ycombinator.com/item?id=50423130"},{"id":50425575,"author":"Lukas_Skywalker","created_at":"2026-11-09T13:50:43.000Z","text":"The Bitwarden desktop app has a built in SSH agent [1], which lets you store SSH keys inside Bitwarden. I have set the app to always ask me for confirmation when the key is requested.\n[1] https://bitwarden.com/help/ssh-agent/","parent_id":50422628,"replies_count":4,"hn_url":"https://news.ycombinator.com/item?id=50425575"},{"id":50425064,"author":"yfontana","created_at":"2026-11-09T13:07:08.000Z","text":"I don't understand what the linked pull request is supposed to prove, considering it was closed and not merged.","parent_id":50422628,"replies_count":1,"hn_url":"https://news.ycombinator.com/item?id=50425064"},{"id":50423464,"author":"m000","created_at":"2026-11-09T10:00:36.000Z","text":"At this point, should cases like this even be news? Isn't that a fundamental security design issue? Local agent security guardrails appear to always be built around blacklists, which will always be unreliable and leaky. It is left as an exercise to the user to properly sandbox them.\nThere may be some limited form of whitelisting, but often it is just a facade, as it is very coarse-grained. So, with tools with very broad capabilities (ssh, kubectl, gcloud, etc) you end up with the agent performing unwanted actions.","parent_id":50422628,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50423464"},{"id":50426454,"author":"carterschonwald","created_at":"2026-11-09T14:52:02.000Z","text":"this is a normal ssh feature meant to allow keys to be used while keeping keys local …\nits actually a keystone of secure infrastructure setups, aka jump hosts.\ngranted its meant for human or scripted uses, as is everything else","parent_id":50422628,"replies_count":3,"hn_url":"https://news.ycombinator.com/item?id=50426454"},{"id":50427621,"author":"otterley","created_at":"2026-11-09T16:17:52.000Z","text":"If this bothers you, it can be guarded against in your ssh config file:\n\n Host trusted-server\n HostName server.example.com\n ForwardAgent yes\n\n Host another-trusted-server\n HostName another.example.com\n ForwardAgent yes\n\n Host *\n ForwardAgent no","parent_id":50422628,"replies_count":1,"hn_url":"https://news.ycombinator.com/item?id=50427621"},{"id":50424220,"author":"eosis","created_at":"2026-11-09T11:39:04.000Z","text":"Things are awful for this at the moment. [Was the same for docker desktop at some point.](https://rupertrutledge.com/posts/docker-sbx-s-ssh-security-i...)\nSame for [devpod](https://devpod.sh/) for sshing to devcontainers. They are particularly annoying because they just dump it into your config. Use an include statement to your own file for goodness sake.\nIt was often not ideal in the old world. Now agents are doing everything in those boxes, it is kind of mad.\nI have my own utilities now for managing these sockets and files now to deal with this stuff.","parent_id":50422628,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50424220"},{"id":50458757,"author":"u2secured_team","created_at":"2026-11-11T21:14:38.000Z","text":"I don't trust agentic systems with prod; rules always leave room for ambiguity and misinterpretation. There have been cases where agents have gone rogue, exposed data or even deleted production databases. Not worth the risk. This is where human software engineers are still required.","parent_id":50422628,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50458757"},{"id":50428754,"author":"TacticalCoder","created_at":"2026-11-09T17:39:00.000Z","text":"> The agent running on a remote machine can authenticate using your local SSH credentials.\nNo it doesn't. I'm using and enforcing SSH U2F keys. You physically press on a Yubikey (or similar) or you don't authenticate.\nAs for my own Git server, it's of course over SSH and it requires pressing the Yubikey too. As a sidenote as I do it from Magit I modified Magit to add a small but obvious message stating that the Yubikey probably awaits touching (otherwise it's easy to miss / not realize).\nThe great thing with all these hacks and bad practices is that I believe, eventually, people are going to learn better security hygiene.","parent_id":50422628,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50428754"},{"id":50447236,"author":"wizardashwin","created_at":"2026-11-10T22:31:15.000Z","text":"I wonder if they skip running security reviews before every release. The latest models catch these while building and its surprising to see that end products are shipped with vulnerabilities","parent_id":50422628,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50447236"},{"id":50424999,"author":"VCFundedGenYer","created_at":"2026-11-09T13:00:36.000Z","text":"Regular reminder to never download/install AI chatbot apps - they all work in a browser where they can be isolated.\nDo not let these things loose on your computer.","parent_id":50422628,"replies_count":2,"hn_url":"https://news.ycombinator.com/item?id=50424999"},{"id":50450788,"author":"khalidahmad","created_at":"2026-11-11T07:52:02.000Z","text":"yes I was also surprised, back then the codex response the changes already deployed on production, which is codex doint commit, push, merge to master, and deployed to the server through ssh credential alone. which I dont told to do it.","parent_id":50422628,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50450788"},{"id":50429544,"author":"cyberpunk","created_at":"2026-11-09T18:33:47.000Z","text":"This is why your ssh key should be on a yubi and you should have to touch it (confirm presence) to use it.\nyou dont even need anything special anymore to do this just ssh-keygen -t whatever-sk and the magic happens.\nsame key can sign commits...","parent_id":50422628,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50429544"},{"id":50427920,"author":"mbreese","created_at":"2026-11-09T16:36:06.000Z","text":"I’m not sure this is quite the smoking gun. This PR was closed as not merged and the entire process is described as opt-in. Is there other evidence of Codex abusing or surreptitiously extending an ssh agent?","parent_id":50422628,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50427920"},{"id":50427994,"author":"UndividedDev","created_at":"2026-11-09T16:41:05.000Z","text":"Setting up fingerprint / password authentication via secretive for ssh key access made me realize how often these tools try to do something without explicitly asking","parent_id":50422628,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50427994"},{"id":50433483,"author":"stemc43","created_at":"2026-11-09T22:54:24.000Z","text":"Opencode open chamber and just using openrouter models.\nNobody needs codex or Claude these days.\nDeepseek 4.1 is just as good.","parent_id":50422628,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50433483"},{"id":50428746,"author":"viccis","created_at":"2026-11-09T17:37:53.000Z","text":"Back in my pen testing days, agent forwarding was a gift from heaven when I was on a Linux machine.","parent_id":50422628,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50428746"},{"id":50425315,"author":"simoncion","created_at":"2026-11-09T13:27:42.000Z","text":"This sucks, a lot, but you've gotta never run these tools as your ordinary daily-driver account. These tools are rather unpredictable and -because of the nature of the incredibly reckless development methodology- it's nearly impossible to understand every behavioral change in new versions of the ones that are largely or entirely vibecoded. [0]\nAs others have said, it looks like the primary way the Major LLM Manufacturers have chosen to control these things is with a combination of great big blacklists and voluminous pleading, begging, and scolding. Most of us know the problems both with enumerating badness and with attempting to appeal to something that's incapable of care, sympathy, or shame.\n[0] For another example of this principle, go read the recent Jepsen report on ParticleDB.","parent_id":50422628,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50425315"}]}