GitHub Copilot Local Sandboxing Is Now GA—But You Must Turn It On

GitHub [announced local sandboxing as generally available on October 7](https://github.blog/changelog/2026-10-07-local-sandboxing-for-github-copilot-now-generally-available/) for Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host. The feature restricts tools and commands initiated by an agent on a developer’s own machine. It is **not enabled by default**. [Source: GitHub documentation](https://docs.github.com/en/copilot/concepts/security-governance-and-network-settings/about-cloud-and-local-sandboxes)

What changes when you enable it?

Instead of giving agent-run commands the same unrestricted filesystem, network and credential access as your user account, you can define a policy around what they may read, write or contact. Copilot CLI offers controls for paths, outbound and local network access, Git and GitHub CLI credentials, local MCP and language servers, and per-command exceptions. The Copilot app exposes a subset of those controls in project settings. GitHub uses Microsoft eXecution Container (MXC) to apply policies through operating-system mechanisms. [Sources: GitHub announcement](https://github.blog/changelog/2026-10-07-local-sandboxing-for-github-copilot-now-generally-available/); [GitHub documentation](https://docs.github.com/en/copilot/concepts/security-governance-and-network-settings/about-cloud-and-local-sandboxes)

For a practical first step in **Copilot CLI**, run `/sandbox enable` in a session, then inspect the policy before asking an agent to run builds or scripts in a sensitive repository. The setting persists in future CLI sessions until disabled. The Copilot app has its own local-sandbox settings: enabling it in the CLI does **not** enable it in the app. Organization-managed settings can require sandboxing. [Source: GitHub documentation](https://docs.github.com/en/copilot/concepts/security-governance-and-network-settings/about-cloud-and-local-sandboxes)

What does it not guarantee?

GitHub describes this as lighter-weight process, filesystem and network isolation—not a separate VM or container. Platform support and individual controls differ across macOS, Linux and recent Windows 11 builds. The CLI’s built-in file tools run inside the CLI process rather than the operating-system sandbox, and GitHub says they honor the configured policy on a **best-effort** basis. Remote MCP servers are not sandboxed by this local feature. A policy can also allow a command to run outside the sandbox. These details matter when deciding whether the boundary meets your threat model. [Source: GitHub documentation](https://docs.github.com/en/copilot/concepts/security-governance-and-network-settings/about-cloud-and-local-sandboxes)

GitHub also distinguishes **tool isolation from model execution**: the local sandbox policy applies to tool execution regardless of which model Copilot uses. It should not be read as a claim that inference runs locally. [Source: GitHub announcement](https://github.blog/changelog/2026-10-07-local-sandboxing-for-github-copilot-now-generally-available/)

Availability and price

GitHub says local sandboxing is included with Copilot **at no extra cost**. The separately documented cloud sandbox is a different, usage-billed product. GitHub lists local support for macOS, Linux and recent Windows 11 builds, with OS-specific requirements and limitations. [Sources: GitHub announcement](https://github.blog/changelog/2026-10-07-local-sandboxing-for-github-copilot-now-generally-available/); [GitHub documentation](https://docs.github.com/en/copilot/concepts/security-governance-and-network-settings/about-cloud-and-local-sandboxes)

**Bottom line:** This is a useful control for increasingly autonomous coding agents, especially when they run shell commands. Enable it explicitly, configure a least-privilege policy for the repository, and check your platform’s enforcement notes rather than assuming “sandboxed” means fully isolated.