Local sandboxing for GitHub Copilot is now generally available in GitHub Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host. Local sandboxes give developers a secure execution boundary for agentic workflows on their own machines. Tools and commands initiated by Copilot run with restricted access to the filesystem, network, credentials, and other system capabilities, based on policies defined by the developer or their organization. Local sandboxing is powered by Microsoft eXecution Container (MXC) , which translates a common sandbox policy into native operating-system controls across Windows, macOS, and Linux. With local sandboxing, developers and organizations can:
- Limit the files and directories that agent-run commands can read or modify.
- Control access to the internet, local networks, Git credentials, and GitHub CLI credentials.
- Apply sandboxing to local tools and services, including local MCP and language servers where supported.
- Use enterprise-managed settings to require sandboxing and enforce policies that developers cannot weaken.
- Adopt more autonomous agent workflows while maintaining clear boundaries around what Copilot can access. Model execution and tool isolation are separate concerns. Sandbox policies apply to tool execution regardless of which model Copilot uses. Local sandboxing is included with GitHub Copilot at no additional cost. To get started, see About cloud and local sandboxes for GitHub Copilot . application security copilot platform governance Share Copied Shared Related Posts Oct.07 Release Claude Haiku 5.5 in GitHub Copilot copilot Oct.07 Release Purpose-built model for leaked secret detection application security copilot ... +1 Oct.07 Improvement Discover local models in GitHub Copilot CLI copilot Oct.06 Improvement Update your IDE to restore agent activity in Copilot usage metrics account management copilot enterprise management tools ... +2 Oct.06 Improvement Code scanning AI Scan enablement status in security overview application security Oct.05 Improvement Secret scanning adds detectors for Lovable, Supabase, and more application security Oct.02 Improvement Copilot code review: API support and new default effort level copilot Oct.02 Retired Selected models in GitHub Copilot deprecated c