GitHub Copilot Local Sandboxing Tutorial: Enable, Configure, and Harden the CLI, App, and VS Code Agent Host

Introduction

Before October 2026, every shell command your GitHub Copilot agent executed ran with the same access as your own user account: every file you could read, every network you could reach, and every credential your shell could see. That made agent mode powerful and, for security-minded teams, uncomfortable. This tutorial walks you through local sandboxing, the feature GitHub took to general availability on October 7, 2026 across Copilot CLI, the Copilot app, and VS Code Agent Host sessions. You will enable it on each surface, learn exactly what it restricts, and close the gaps in its defaults. If you sign in to Copilot CLI on macOS with a work or school account, sort out authentication first: our Copilot CLI macOS Entra auth fix ends the daily browser device-code login loop with the native Entra broker in 1.0.95.

Quick answer

Enable GitHub Copilot local sandboxing with /sandbox enable in Copilot CLI, /sandbox on in the Copilot app, or "chat.agent.sandbox.enabled": "on" in VS Code. It is free, off by default, and confines agent-run commands to approved files, networks, and credentials.

Evidence

Local sandboxing entered public preview on June 2, 2026 and reached general availability on October 7, 2026, a 127-day preview period, according to GitHub’s own changelog and coverage of it. The same GitHub weekly releases post states the headline facts vendors rarely give away in one sentence:

“Limit agents’ access to files, networks, and credentials with local sandboxing, now generally available in Copilot CLI, the Copilot app, and VS Code sessions using Agent Host. This is included with Copilot at no extra cost.” (GitHub Changelog, October 5 weekly releases)

Two numbers matter for planning. First, 0 dollars: the feature costs nothing beyond your Copilot seat, so there is no licensing conversation to have with your team. Second, three surfaces: CLI, app, and VS Code Agent Host, which means one policy model to learn instead of three different containment stories.

The enforcement itself is not a new container runtime bolted on by GitHub. It is governed by Microsoft Execution Containers (MXC), which translates one policy into OS-native controls: ProcessContainer’s BaseContainer tier on Windows, Seatbelt on macOS, and bubblewrap on Linux. For the exact CLI surface, see the GitHub Copilot CLI command reference, which documents how sandboxing interacts with tool permissions and web fetching, and the GitHub Changelog weekly release that announced general availability. Every factual claim below about defaults and behavior is traceable to GitHub’s documentation or changelog entries from the October 2026 release week.

Prerequisites

• A GitHub Copilot license (any tier; sandboxing is included at no extra cost)
• Copilot CLI 1.0.93 or later for the CLI steps (/sandbox and --sandbox shipped for all users in that release)
• The GitHub Copilot app or VS Code with the Copilot extension for the respective steps
• Linux: bubblewrap and slirp4netns installed and on your PATH (reported as the Linux prerequisite in the GA week coverage; the Agent Host refuses to silently run commands unsandboxed when a dependency is missing)
• Basic comfort running a terminal session and editing a JSON settings file

Step 1: Understand what the sandbox controls before you touch it

The sandbox governs three things for commands the agent runs: files (which directories agent-run commands can read or modify), networks (outbound internet, local and private networks), and credentials (git and gh credentials, which are proxied rather than handed to the sandboxed process directly).

Equally important is what it does not cover. Sandbox controls apply to shell commands and, by default, locally launched MCP servers and language servers. They do not apply to remote MCP servers or to the agent harness’s built-in file tools. Keep this boundary in mind when you design your policy: sandboxing limits blast radius, it does not make every tool safe.

One more conceptual point, because GitHub is explicit about it: sandboxing applies to tool execution, not to the model. Which model Copilot uses, cloud or local, does not change the sandbox policy. Running a model on your own hardware does not sandbox anything by itself.

Step 2: Enable local sandboxing in Copilot CLI

Open an interactive Copilot CLI session and run:

/sandbox enable

Sandboxing starts immediately for the current session, and your choice persists: it stays on for future interactive sessions and for programmatic sessions until you run /sandbox disable. GitHub saves the preference as the sandbox.enabled setting in your personal settings file for the CLI (~/.copilot/settings.json by default), so you can also flip it there directly.

For a single session without changing your default, pass a flag instead:

copilot --sandbox

And to combine it with headless use:

copilot --sandbox -p "Refactor the auth module to use the new token API"

If sandboxing is already enabled and you need one session without it, copilot --no-sandbox overrides the default for that session only.

Sessions that were already open when you enabled sandboxing do not pick it up automatically. Either restart them (for example with copilot --continue) or run /sandbox enable inside each one. When sandboxed commands run, Copilot CLI automatically discovers the tool directories a command is likely to need (compilers, language toolchains) and grants each one read-only access, so normal development keeps working while the toolchain itself stays unmodifiable.

Step 3: Enable local sandboxing in the GitHub Copilot app

In the Copilot app, the per-session controls mirror the CLI. In an active local session, enter:

/sandbox on

To turn it off for the session:

/sandbox off

During an active local session the command creates a persistent override that applies immediately, without changing the project default for other sessions. Enter either command before a session starts and it changes the project default inherited by new sessions instead.

The app gives you a visible escape hatch with guardrails: if a tool needs access the sandbox policy denies, the app can show a Run outside the sandbox? prompt. Depending on the effective policy you may cancel, run once outside the sandbox, or disable sandboxing for the rest of the session. An enterprise owner can remove that escape hatch entirely, preventing users from running tools outside the sandbox.

Note the app’s documented defaults differ slightly from the CLI’s: in the CLI, outbound internet is enabled and local network access is disabled by default, while in the Copilot app both network options come enabled. Check your app’s sandbox settings panel after turning it on so you know which policy you actually inherited.

Step 4: Enable local sandboxing in VS Code (Agent Host)

Local sandboxing in VS Code applies to chat sessions running on Agent Host. Set it on the machine where the agent runs by adding to your settings JSON:

{
    "chat.agent.sandbox.enabled": "on"
}

The setting accepts off (default) or on. Then start a new Agent Host session. For a connected remote Agent Host, settings resolve on the remote host, so all configured paths refer to the remote file system, not your client machine.

For per-session control, open Permissions in an Agent Host session and select Sandboxing for terminal. This changes only the current session: it does not update User or Workspace settings and does not set the default for new sessions.

A behavior worth memorizing: sandboxing is independent of the permission level. Even if you choose Allow all in the permission picker, the sandbox still restricts the processes Copilot spawns. Approvals decide what the agent may attempt; the sandbox decides what the OS will allow. VS Code also notes that locally launched MCP and language servers are sandboxed by default when sandboxing is enabled.

Step 5: Verify the sandbox actually blocks things

Do not trust the toggle; test the boundary. With sandboxing on, ask the agent (or run through the CLI) to perform these checks and observe the denials:

1. File escape: have the agent run touch /tmp-outside-check.txt or write a file two directories above the workspace. The sandbox policy limits agent-run commands to the working directory, temp folders, and the repository’s .git, so the write should be denied.
2. Network: ask the agent to curl a local service on 127.0.0.1 in the CLI with default policy. Local network access is disabled by default, so this should fail. Then confirm ordinary outbound https:// traffic still works, since outbound internet is enabled by default.
3. Credential exposure: run git ls-remote through the agent and separately inspect the environment variables visible inside a sandboxed shell. Git and gh keep working because a local proxy supplies real credentials only to approved HTTPS destinations, while sandboxed commands see placeholder values.

If any check behaves the opposite of what you expect, stop and re-read your effective policy before continuing. A sandbox you cannot verify is a checkbox, not a control.

Step 6: Tighten the defaults for your threat model

GitHub’s defaults are designed so normal development keeps functioning, not so paranoid teams feel safe. Two settings deserve attention.

First, Allow dev tool access is enabled by default in some surfaces. It grants read access to development tool configuration and caches, which is what lets npm install work inside the sandbox, but it also exposes things like package registry logs and tokens those tools store. If your threat model includes credential exposure through the agent, this is the first switch to evaluate.

Second, review the Run outside the sandbox escape hatch policy in the Copilot app and whether managed settings apply to you. If your enterprise centrally requires sandboxing, your local toggle may be overridden, and startup flags that bypass permissions can be suppressed by managed settings with a policy warning. Know which policies win in your org before you promise anyone a containment guarantee.

Troubleshooting

1. “Sandbox unavailable” in the app, or the Agent Host refuses to sandbox on Linux

Cause: A platform dependency is missing. On Linux, the sandbox needs bubblewrap (0.5.0 or later is the reported requirement) and slirp4netns on your PATH. On Windows, a recent Windows 11 update is required.

Fix: Install the missing dependency, then retry. The VS Code Agent Host behavior is actually reassuring here: if an OS dependency is unavailable, it does not silently run the command without the sandbox. Follow the notification to install what is missing.

2. The agent cannot reach your localhost dev server

Cause: The default policy blocks local network access in the CLI. This is the most common “it broke my workflow” report after enabling sandboxing.

Fix: Copilot CLI 1.0.93 added localhost and loopback hosts to the sandbox local-network allowlists, so update the CLI past that version first. For web fetching specifically, set export COPILOT_WEB_FETCH_ALLOW_LOCALHOST=1 before starting the session. If the broader local network must stay blocked, keep it blocked and reach the dev server through a loopback-only listener instead of widening the policy.

3. /sandbox enable did nothing in an already-open session

Cause: Sessions open before you enabled sandboxing do not inherit the change.

Fix: Restart the session (copilot --continue) or run /sandbox enable inside that session. The same applies in the Copilot app: before-session commands change the project default for new sessions, while mid-session commands create a session override.

4. Enterprise policy overrides your local sandbox choice

Cause: Your organization uses managed settings that require sandboxing, prevent running tools outside it, or suppress bypass-permission flags.

Fix: Do not fight the policy, audit it. The CLI shows a policy warning when startup bypass-permission flags are suppressed by managed settings. If a flag like --allow-all-tools stops working, check your effective managed settings first. If you are the administrator, use Copilot managed settings to deploy the sandbox requirements centrally rather than relying on each developer’s configuration.

5. Language servers behave differently after enabling

Cause: Locally launched MCP servers and language servers are sandboxed by default when sandboxing is enabled. The copilot-cli changelog notes that warmed language servers stay running across LSP requests specifically when sandboxing is disabled, which tells you the sandbox changes their lifecycle.

Fix: Expect extra restarts or permission prompts from language servers under sandboxing, and scope any allowlist grants narrowly to the server’s working files rather than disabling sandboxing to make the noise stop.

FAQ

Is GitHub Copilot local sandboxing free?

Yes. GitHub ships local sandboxing with every Copilot license at no extra cost. It reached general availability on October 7, 2026, and works the same in Copilot CLI, the Copilot app, and VS Code sessions that use Agent Host.

Does local sandboxing restrict the AI model or only the tools it runs?

Only tool execution. GitHub separates model execution from tool isolation, so sandbox policies apply to the commands Copilot runs regardless of which model you use, cloud or local. Picking a local model does not sandbox anything by itself.

What does the sandbox not protect me from?

It does not cover remote MCP servers or the agent harness’s built-in file tools. VS Code’s own documentation says sandboxing adds a layer of protection but does not replace endpoint security or provide a standalone security boundary.

Does using –allow-all or YOLO mode disable the sandbox?

No. The sandbox is independent of the permission level. In VS Code, the sandbox keeps restricting processes even when you select Allow all, and in the CLI, blanket approvals plus sandboxing is the recommended pairing.

Why can’t sandboxed commands reach my localhost dev server?

The default policy blocks local network access. Copilot CLI 1.0.93 added localhost and loopback hosts to the sandbox local-network allowlists, and web_fetch needs the COPILOT_WEB_FETCH_ALLOW_LOCALHOST=1 environment variable to reach localhost during development.

Can my organization force sandboxing so developers cannot turn it off?

Yes. Enterprises can centrally manage sandboxing policies and require it, and an enterprise owner can prevent users from running tools outside the sandbox. Managed settings can also suppress bypass-permission flags.

Conclusion

Local sandboxing changes the default risk of letting Copilot run commands on your machine: instead of inheriting your full environment, agent-run commands execute inside an OS-native boundary governed by one policy. Enable it with /sandbox enable (CLI), /sandbox on (app), or chat.agent.sandbox.enabled (VS Code), verify it with real block tests, then tighten the defaults around dev-tool access and local networking to match your threat model. It is the single highest-leverage safety change you can make to a Copilot workflow this year, and it costs nothing to turn on.

Frequently asked questions