GitHub Copilot’s Local Sandbox Reaches General Availability

As of October 7, 2026, local sandboxing for GitHub Copilot has left the public preview it entered in June and is now generally available to every subscriber, across GitHub Copilot CLI, the GitHub Copilot app, and VS Code sessions that use Agent Host. The feature restricts what tools and commands launched by Copilot can read, modify, or reach on the developer’s machine, based on policies set locally or enforced by an organization.

#What general availability changes

The underlying idea hasn’t moved since the preview: commands Copilot runs execute inside a restricted boundary, with controlled access to the filesystem, the network, Git and GitHub CLI credentials, and other system capabilities. Isolation also covers local tools and services, including local MCP and language servers where supported. It ships as part of the standard Copilot subscription, with no extra charge.

#Microsoft eXecution Container, the mechanism underneath

The sandbox runs on Microsoft eXecution Container (MXC), a project that translates one common sandbox policy into native operating-system controls on Windows, macOS, and Linux. That abstraction layer lets GitHub apply the same security policy regardless of the developer’s platform, instead of rewriting isolation logic per OS.

#Configuring the sandbox policy

Local sandbox settings live in settings.json, under the sandbox key, inside the Copilot CLI configuration directory. The /sandbox command opens an interactive, three-tab interface (General, Filesystem, Network), while /sandbox policy prints the effective policy for the current directory: which paths are readable, writable, or blocked, and the scope of network access.

{
  "sandbox": {
    "filesystem": {
      "includeWorkingDirectory": true
    },
    "auth": {
      "git": "allow",
      "gh": "allow"
    },
    "network": {
      "default": "deny"
    }
  }
}

As of CLI version 1.0.79, the authentication keys were renamed: sandbox.gitAuth and sandbox.ghAuth became sandbox.auth.git and sandbox.auth.gh, with no automatic migration of older config files.

#What organizations can enforce

Copilot Enterprise and Business administrators can require sandboxing through managed settings and stop individual developers from loosening that policy. Isolation applies to tool execution, not to the model doing the reasoning: a sandbox policy holds regardless of which model Copilot is using.

Isolation doesn’t depend on the model in use: it governs tool execution, not the intelligence that triggers it.

#What to remember

Local sandboxing has left preview and is now the recommended default for any autonomous Copilot workflow, across the tool’s three main surfaces. The policy is free, powered by MXC on all three operating systems, and can be locked down at the organization level. What’s left to each team is defining exactly which paths, network access, and credentials its unsupervised agents actually need.

Further reading: the official announcement on the GitHub changelog.