GitHub Copilot local sandboxing is generally available, but off by default
GitHub has made local sandboxing generally available in GitHub Copilot CLI, the Copilot app, and VS Code sessions using Agent Host, letting developers set limits on agent-run commands’ access to local files, networks, and credentials.
Local sandboxing is included with GitHub Copilot without an additional sandbox charge. It is off by default: GitHub’s current documentation says commands have the same access as the user account until it is enabled. The CLI and Copilot app have separate sandbox settings; enabling it in one does not enable it in the other.
Developers can restrict which directories commands read or modify, which networks they reach, and which credentials they use. Enterprises can require sandboxing and control its configuration through managed settings. Microsoft eXecution Container (MXC) translates the policy into operating-system controls. This restricts local processes and file access without placing commands in a separate virtual machine or container. Tool isolation is separate from model execution and does not mean the model runs locally.
Coverage has limits. GitHub’s documentation says the CLI’s built-in file tools run inside the CLI process, outside direct operating-system sandbox enforcement. They check and honor the policy themselves on a best-effort basis. Local MCP tool servers and language servers are sandboxed by default, but this is configurable; remote MCP servers are not sandboxed.
In the CLI, network enforcement differs by platform. On macOS and Linux, outbound connections are restricted to the local proxy, so programs cannot connect directly by ignoring proxy settings. Windows proxy and host rules rely on programs honoring those settings, require a supported operating-system version and local network access, and do not offer equivalent protection. Linux cannot independently control local network access for spawned commands and local services.
An unsupported computer does not always stop work. The CLI turns off a saved user preference for sandboxing in the current session and warns that commands and services will run without it. When effective enterprise-managed settings enable both sandboxing and sandbox.failIfUnavailable, the CLI blocks model requests and tool execution if it cannot enforce the sandbox. In the Copilot app, a sandbox-configured session may start, but commands and other sandboxed processes fail to launch on an unsupported host.
Check the operating-system requirements before enabling it. GitHub recommends macOS 15 or later; the backend is untested on older releases. Linux needs bubblewrap 0.5.0 or later and additional dependencies for outbound networking. Windows requires a recent, supported Windows 11 update. General availability applies to local sandboxing. The separate cloud sandbox, which runs sessions in GitHub-hosted infrastructure, remains in public preview and is billed by usage.
Sources
- Local sandboxing for GitHub Copilot now generally available — GitHub
- About cloud and local sandboxes for GitHub Copilot - GitHub Docs — GitHub