Grok Build 0.2.66 Adds Glob-Pattern Sandbox Deny Lists and Kernel-Level File Protection: What Operators Must Audit Now

Grok Build sandbox controls gained two structural upgrades in version 0.2.66 (June 25, 2026): glob-pattern support for deny lists and kernel-level deny for custom sandbox profiles. For operators running Grok Build agents in production or through a model router, these are not cosmetic changes — they affect how filesystem access policies are written, applied, and enforced at the OS level.

What changed in Grok Build 0.2.66

The release delivers three changes relevant to operator sandbox governance:

Sandbox deny lists now accept glob patterns. Previously, operators writing sandbox deny rules had to list exact file paths. With 0.2.66, deny lists accept shell glob patterns — for example, **/*.pem to block all PEM certificate files across any directory. This changes the authoring model from a path enumeration exercise to a pattern-matching policy.

Custom sandbox profiles can now kernel-deny specific files and directories. Where earlier sandbox profiles could block paths at the application layer, 0.2.66 introduces a kernel-deny mechanism for custom profiles. Reads and writes to kernel-denied paths are blocked at the OS level rather than being intercepted by the Grok Build process. This is meaningfully different for security posture: application-layer deny lists are bypassable if the agent process can spawn a child that doesn't inherit the deny context; kernel-level deny is not.

Local MCP servers now auto-recover after disconnects or session expiry. Grok Build's MCP integration previously required manual intervention when a local MCP server dropped — typically because the server process crashed or the session token expired. Auto-recovery means the agent continues operating without operator-side restart handling.

The same release also fixes authentication to prefer session credentials over API keys when both are present, fixing a regression that caused incorrect auth routing in dual-credential environments.

Why these changes matter for Grok Build sandbox deny list policies

The shift from exact-path to glob-pattern Grok Build sandbox deny lists has a direct impact on policy maintenance overhead. Deny lists built with exact paths grow linearly with the number of files an operator wants to protect; glob patterns let operators express the same coverage in far fewer rules.

The practical operator implication: existing configs written with exact paths still work, but teams should audit whether the same intent can now be expressed more robustly with globs. A config that enumerates fifteen specific .env files does not automatically become a **/.env rule — operators must make that migration explicitly. The risk of not doing so is a false sense of completeness: a path-enumerated policy that blocks known sensitive files but misses new secrets added to the repo.

For operators deploying Grok Build through a model router that enforces sandbox configuration at agent launch time, the glob support also changes validation logic. A router that previously validated exact-path rules against an allowlist of known paths will now need to handle glob patterns, since a pattern like **/*.key is not a path but a policy expression.

Kernel-level vs application-layer sandbox protection: the governance difference

The addition of kernel-level protection for custom profiles in Grok Build 0.2.66 reflects a pattern emerging across coding-agent platforms: application-layer sandboxing is necessary but not sufficient for high-trust deployments.

Application-layer sandbox rules work by intercepting file operations inside the agent process. If the agent code respects the policy, the file is not accessed. If a subagent, shell command, or MCP tool invoked by Grok Build bypasses the main process — for example, via a direct exec call that spawns an unmonitored child — the application-layer rule may not apply.

Kernel-level protection operates at the syscall level, below any process boundary. A file or directory protected with kernel-deny is inaccessible to any process that inherits the sandbox, including subagents spawned via GROK_AGENT=1-tagged terminal commands (added in 0.2.68) or MCP tool calls.

For operators choosing between the two protection modes: application-layer rules are appropriate for general hygiene — avoiding accidental access to config files, limiting scope of file writes. Kernel-level protection is appropriate for secrets, credentials, and audit-critical data where you need to assert that no path through the agent stack can reach the protected resource.

MCP auto-recovery and operator session management

The MCP server auto-recovery change in 0.2.66 addresses a friction point that affects how operators size and monitor production Grok Build deployments.

Before 0.2.66, a local MCP server disconnect — whether from network instability, server process crash, or OAuth token expiry — left Grok Build agents in a degraded state requiring external restart. This created an implicit requirement for operators: either maintain high-availability MCP server infrastructure or accept that agents would require manual intervention after any connectivity event.

Auto-recovery removes that requirement for local MCP servers. The agent reconnects automatically when the server comes back. This is relevant for routing configurations where the MCP toolset available to an agent determines which downstream model or provider is appropriate — an agent that loses its MCP tools mid-session may have been getting routed to a capable model unnecessarily, or producing lower-quality output, without the operator knowing.

What TheRouter operators should check

If you route Grok Build traffic through TheRouter or a compatible AI gateway, three configuration audits are warranted following 0.2.66:

Sandbox policy format. Review whether your sandbox configs use exact paths or could benefit from glob patterns. The routing configuration guide covers sandbox policy authoring for coding agents deployed through a model router. Pay particular attention to secrets paths: private keys, certificates, and credential files are the highest-priority targets for glob-pattern migration (e.g., **/*.pem, **/*.key, **/*.env).

Custom profile kernel-protection candidates. If you operate custom Grok Build sandbox profiles, identify which file and directory categories warrant kernel-level protection rather than application-layer rules. Credential stores, signing keys, and audit log directories are standard candidates. Kernel-level protection should be reserved for data where you need OS-enforced guarantees rather than agent-convention guarantees.

MCP session failure alerting. If you have alerting configured for MCP server disconnects that relied on agents stopping to report errors, you may need to update your monitoring. With auto-recovery, agents will continue silently after a reconnect. Depending on your observability setup, a silent reconnect could mask an underlying MCP server stability issue.

The Grok Build /goal autonomous agent release covered how Grok Build's two-model pipeline changes the routing surface for agentic verification tasks. The 0.2.66 sandbox changes sit one layer below that: they define what the agent is allowed to touch at the infrastructure level, regardless of which model or pipeline is executing.