[johnvaluk]

Yes, your local agent can be accessed on the destination host by any other user with the necessary privileges (including your own account -- a root compromise is not required). This has been known for a very long time and a warning is included in the documentation. No, it does not compromise any private keys.

Your private keys are more likely to be compromised when you store them on untrusted systems. SSH-Agent allows you to avoid that risk.

Another mitigation is to use a dedicated agent per private key (or group of keys) to prevent forwarding keys to destinations that don't need them.

SSH agent restriction (ssh-add -h) looks promising, but support isn't widespread and it doesn't cover all use cases.

The article assumes a remote attacker, but the attacker can more easily be your boss or team. Keep this in mind whenever you forward your agent and plan accordingly.