2026-10-07 Changes confirmed medium confidence

GitHub Makes Local Copilot Sandboxing Generally Available

The release spans Copilot CLI, the Copilot app and VS Code Agent Host, with policy controls for files, networks and credentials.

Edited by Tyronne Panaino

GitHub made local sandboxing for GitHub Copilot generally available on October 7, 2026 across GitHub Copilot CLI, the GitHub Copilot app, and VS Code sessions that use Agent Host. The release gives developers and organizations a policy-based boundary for commands and tools that Copilot starts on their own machines.

The change matters to developers using more autonomous local workflows and to administrators responsible for access policy. GitHub says those policies can restrict filesystem, network, credential, and other system access instead of giving agent-run commands unrestricted reach across the host.

Where the general-availability release applies

GitHub names three covered surfaces: Copilot CLI, the Copilot app, and VS Code sessions using Agent Host. The announcement does not claim that every Copilot surface uses the same local sandbox. Its scope is specifically local execution on a developer's machine.

The model and the tool boundary are also separate. GitHub says sandbox policies apply to tool execution regardless of which model Copilot uses. Changing a model therefore does not replace the need to define what commands, files, services, networks, and credentials a local session may reach.

What the policy can restrict

Developers and organizations can limit the files and directories that agent-run commands read or modify. Policies can also control access to the internet, local networks, Git credentials, and GitHub CLI credentials. GitHub says local tools and services, including local MCP and language servers, can be covered where supported.

Enterprise-managed settings add an organizational layer. According to GitHub, an enterprise can require sandboxing and enforce policies that developers cannot weaken. That gives managed teams a way to set a floor for local agent isolation while still allowing developers to work inside the permitted boundary.

How the cross-platform layer works

GitHub says local sandboxing is powered by Microsoft eXecution Container, or MXC. The component translates a common sandbox policy into native operating-system controls across Windows, macOS, and Linux. The announcement presents this as the mechanism behind the shared policy model; it does not provide a complete compatibility table for every tool or local service.

General availability is an availability milestone, not independent proof that every policy is escape-resistant under every workload. The fetched release note contains no external security audit, escape-testing results, performance-overhead measurements, incident data, or broad reliability study. GitHub also qualifies coverage of local MCP and language servers with the phrase where supported, leaving per-environment behavior as an implementation detail to verify.

Practical implications

For individual developers, the release creates one policy concept across the three named Copilot surfaces and the major host resources that agent-run commands may need. For organizations, the notable addition is enforceability: centrally managed requirements can prevent a developer from weakening the prescribed boundary.

GitHub says local sandboxing is included with Copilot at no additional cost. The next useful evidence will be a detailed support matrix and independent testing of isolation behavior, compatibility, and overhead across the three product surfaces and supported operating systems.

Status

Confirmed. GitHub's official changelog establishes the October 7 general-availability release, its named product surfaces, policy scope, cross-platform mechanism, and enterprise enforcement. Internal confidence is medium because the evidence is actor-controlled and no independent security or performance verification was fetched.