both agent and x11 forwarding are off by default since they allow access to local resource from the remote machine where the sshd is running. enable agent and x11 forwarding only if you trust the remote server.