Intel / article

GitHub Copilot Local Sandboxing Is Now Generally Available

Source: github.blog
Author: GitHubTop Viber
Date: Published Oct 7, 2026

From the Daily Brief

Local sandboxing changes the default risk of letting Copilot run commands on a developer machine. Instead of inheriting the user's full environment, commands execute in isolation, and access to files, network, system capabilities and credentials is granted at a granular level. Enterprises can set these policies centrally rather than relying on each developer's configuration. The feature reaches all three Copilot surfaces at once, so teams do not need different rules for the CLI and the editor. It also matters for model choice: GitHub launched Haiku 5.5 the same day and positioned it for terminal tasks and subagents, exactly the workloads that run many small commands. Teams that held back on agent command execution over credential exposure now have a supported control to evaluate.

Read the 2026-10-08 Brief →

Context

When an works on a developer's own computer, the commands and tools it starts act on that computer. GitHub has now made local generally available for Copilot in the Copilot CLI, the Copilot app and VS Code sessions using Agent Host. According to the changelog, tools and commands Copilot initiates run with restricted access to the filesystem, network, credentials and other system capabilities, under policies set by the developer or their organization. Policies can limit which files and directories agent-run commands can read or change. They can also control access to the internet, local networks, Git credentials and GitHub CLI credentials, and can extend to local tools such as servers and language servers where supported.

The sandbox is built on Microsoft eXecution Container, or MXC, which takes one common sandbox policy and translates it into each operating system's native controls on Windows, macOS and Linux, so the same rules can follow a developer across machines. For companies, the key part is that enterprise-managed settings can require sandboxing and enforce policies developers cannot weaken. GitHub also separates the model from the boundary: sandbox policies apply to tool execution regardless of which model Copilot is using. The feature is included with Copilot at no extra cost.

The changelog is a short release note. It does not say which native mechanism each operating system uses, whether protection is equally strong on all three, or whether sandboxing is on by default. For those details it points readers to GitHub's About cloud and local sandboxes documentation, which this explanation does not draw on. Intel earlier covered GitHub's guide to using local sandboxing in the Copilot CLI, which covers using the feature from the command line.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
MCP — The Model Context Protocol — an open standard that lets any AI assistant plug into any tool or data source without custom integration code.

Read the source github.blog