GitHub makes Copilot local sandboxing generally available
GitHub announced general availability of local sandboxing on October 7 for Copilot CLI, the Copilot app and VS Code sessions using Agent Host. It places agent-initiated tools and commands inside an execution boundary on the developer's own machine.
Access to files, the network, credentials and other system capabilities is restricted according to policies set by the developer or organization. The announcement does not mean every existing installation already has the same restrictive policy applied.
The system uses Microsoft eXecution Container, or MXC, to translate a common sandbox policy into native operating-system controls across Windows, macOS and Linux. Platform support and the policy in force remain important when assessing a particular workflow.
GitHub says developers can limit which directories commands read or modify and control access to the internet, local networks, Git credentials and GitHub CLI credentials. Local MCP and language servers can also be covered where supported; that qualifier should not be dropped.
Enterprise-managed settings can require sandboxing and enforce policies developers cannot weaken. Tool isolation is separate from model execution: GitHub says sandbox policies apply to tool execution regardless of which model Copilot uses.
GitHub lists local sandboxing as included with Copilot at no additional cost. It is an access-control capability, not proof that an agent cannot make mistakes or that every tool is covered under every configuration. Teams should review the enforced policy and supported local services before relying on it.