With ForwardAgent enabled, the remote host gets a unix socket that can ask your local agent to sign arbitrary challenges for the whole session. Any process running as root on that host, or as your user, can use it to authenticate as you to any system your keys open. The keys are never copied, but the authority is fully delegated.
ProxyJump, added as '-J' in OpenSSH 7.3, solves the common bastion case without that exposure. 'ssh -J bastion target' opens a TCP forward through the bastion and completes the SSH handshake end to end with the target, so the bastion sees only encrypted traffic and never touches your agent. In config it is 'ProxyJump bastion' under the target's Host block.
When forwarding is genuinely required, limit the blast radius: never set ForwardAgent in a 'Host *' block, use 'ssh-add -c' so the agent prompts for confirmation on every signature, and prefer per-key constraints with 'ssh-add -t' to bound the lifetime. Confirm what a session actually has with 'ssh -G host' and check the ForwardAgent line.