GitHub Adds Local Sandbox Controls to the Copilot App
The public preview lets projects restrict local Copilot sessions across filesystem, network, and credential access, with enterprise policy able to impose tighter limits.
Edited by Tyronne Panaino
GitHub released a public preview of local sandboxing in the GitHub Copilot app on September 23, 2026. The change lets developers configure per-project limits for local repository and working-tree sessions, covering access to files, networks, and credentials on the machine. It matters to developers and enterprise administrators because those local sessions can now request a defined containment policy before commands run.
The release is deliberately narrower than a universal Copilot security switch. GitHub says the feature is off by default, applies to new local sessions when enabled for a project, and does not cover cloud sandbox sessions or sessions running on a remote host.
What the project policy can constrain
The filesystem policy can add read-write locations, add read-only locations, and deny folders. Network settings cover outbound internet access and the local network. Credential settings separately cover Git credentials used for authenticated HTTPS operations and GitHub CLI credentials used for GitHub authentication.
These settings describe the policy the Copilot app requests when a sandboxed session starts. GitHub says enterprise-managed settings can make the effective policy more restrictive, so a project-level configuration is not necessarily the final authority in a managed environment.
The operating system is also part of the enforcement boundary. If it cannot enforce the requested policy, GitHub says the sandboxed shell fails with an error instead of silently running without a sandbox. That fail-closed behavior is an important implementation detail: the preview is designed to reduce the potential impact of unintended commands, not to present every command as inherently safe.
Activation is scoped to sessions
Turning on Sandbox new sessions in a project's app settings affects sessions created after the change, not sessions already running. Changes to filesystem, network, or credential settings take effect for new sessions or when an existing session restarts. GitHub also documents a `/sandbox on` command for enabling the control inside an active local session without changing the project's default.
The Copilot app and Copilot CLI maintain separate sandbox settings. Teams using both therefore need to review each surface rather than assuming that an app policy automatically carries over to the CLI.
Practical boundary for teams
The preview gives teams a concrete place to express least-access preferences for local agent work. A repository that does not need internet access can request a narrower network policy, while sensitive folders can be denied or exposed read-only. Enterprise administrators can then impose stricter managed settings where required.
The current limitations remain material. Sandboxing is opt-in, GitHub labels it a public preview subject to change, and the fetched announcement does not provide independent testing of escape resistance or compatibility across operating systems. The feature also does not change the policy for cloud or remote-host sessions. The next useful checkpoint will be general availability documentation, supported-platform details, and evidence about how the controls behave under real development workloads.
Status
Confirmed. GitHub's official changelog documents the September 23 public preview and its configuration boundaries. Internal confidence is medium because this article relies on GitHub's own release note and no independent security assessment was fetched.
Sources
Update note: Last reviewed 2026-09-24. We will revise this post if GitHub changes the preview's availability, enforcement model, or supported-session boundaries.
Sources
- GitHub Changelog — official
Drafted with AI assistance from source briefs; reviewed for citation completeness and label accuracy.