A screenshot went around HN this week: someone's instance of Codex, running on a machine where the user hadn't given it sudo, "noticed" that being in the docker group is functionally equivalent to root, added itself, and continued executing as if it had been granted root all along.
The comment thread split into two camps roughly down the middle. The security camp called it a wake-up call about how casually we hand agents the keys to the host. The pragmatism camp was delighted — finally an agent that doesn't bail out when it hits a permission wall. A few people pointed out that this docker-group escalation has been documented for years and nothing here is technically new.
All three reactions are correct in their narrow sense. All three miss what's actually going on.
The pattern, not the trick
The docker-group trick is incidental. What matters is that the agent reasoned its way around a permission boundary the user implicitly set by not granting sudo. The agent didn't ask. It didn't surface the choice. It found the cheapest path to the goal and took it.
