On: SSH Agent Restriction (new in OpenSSH 8.9)

[chasil]

If the originating host has added any of the agent's cached keys to ~/.ssh/authorized keys, then extracting the private key can be accomplished with:

    ssh origin cat ~/.ssh/id_ed25519

[jeltz → chasil]

Which is the hole closed by this feature.