All posts

Blog

GitHub makes local sandboxing generally available for Copilot agents

FindAmNow
GitHubCopilotcoding agentssandboxingsecurity

On 7 October 2026 GitHub made local sandboxing generally available in Copilot CLI, the Copilot app and VS Code Agent Host sessions. Commands that Copilot runs get restricted access to files, network and credentials under policies set by developers or enforced by their organisation, at no extra cost.

GitHub announced on 7 October 2026 that local sandboxing for GitHub Copilot is generally available. It covers Copilot CLI, the GitHub Copilot app, and VS Code sessions that use Agent Host. GitHub says the feature is included with Copilot at no extra cost.

What it does

When a Copilot agent runs commands on your own machine, those commands now run with restricted access to the filesystem, network, credentials and other system capabilities, according to policies you or your organisation set.

GitHub's changelog lists what developers and organisations can do:

  • Limit which files and directories agent-run commands can read or change
  • Control access to the internet, local networks, Git credentials and GitHub CLI credentials
  • Sandbox local tools and services, including local MCP and language servers where supported
  • Use enterprise-managed settings to require sandboxing and enforce policies developers cannot weaken

The sandbox runs on Microsoft eXecution Container (MXC), which translates one common policy into native operating-system controls on Windows, macOS and Linux.

GitHub also says model choice and tool isolation are separate. Sandbox policies apply to tool execution no matter which model Copilot is using.

How to use it

Local sandboxing is off by default unless enterprise settings require it. According to GitHub Docs:

  • In Copilot CLI, /sandbox enable turns it on, /sandbox status shows whether it is active, and /sandbox policy shows the effective paths, network settings and capabilities. You can add a command, such as /sandbox policy npm install, to see what access it would get without running it.
  • In the Copilot app, sandboxing is set per project for local repository and working-tree sessions.
  • If enterprise policy requires sandboxing, /sandbox disable is refused unless the policy explicitly allows a bypass.
  • App and CLI settings are configured separately. Changing one does not change the other.

GitHub's September preview notes added one detail: if the operating system cannot enforce the requested policy, the sandboxed shell fails with an error instead of quietly running unsandboxed.

The feature first appeared as a public preview in the Copilot app on 23 September 2026.

Why it matters

Coding agents increasingly run shell commands, install packages and call tools without a human approving each step. That is useful, but a bad command, a malicious dependency or a prompt-injected instruction could reach anything your user account can reach, including SSH keys and tokens.

Sandboxing doesn't make agents trustworthy. It limits how much damage a mistake can do. It also fits a wider trend: AI labs and tool makers are tightening agent containment after a run of publicly reported incidents where agents went beyond their intended scope.

For teams, the enterprise-enforced policies are probably the biggest change. Security teams can now set a baseline that individual developers cannot quietly turn off.

What to keep in mind

  • Local sandboxing does not apply to cloud sandbox sessions or sessions on remote hosts. Those are governed separately.
  • Being off by default means individual users have to opt in unless their organisation enforces it.

Sources

Source