GitHub Changelog (@GHchangelog) launched public-preview local sandboxing in the Copilot app: per-project limits on filesystem, outbound/local network, and Git/GitHub CLI credentials to reduce blast radius from unintended agent commands. Off by default; enable “Sandbox new sessions” or /sandbox on for an active session. Not for cloud/remote-host sessions; if the OS cannot enforce policy, the sandboxed shell errors instead of running unsandboxed.

Key Takeaways

  • ✓Public preview: Copilot app local sandboxing sets per-project filesystem/network/credential policy.
  • ✓Off by default; enable Sandbox new sessions or /sandbox on for one session.
  • ✓If the OS cannot enforce policy, the sandboxed shell errors—no silent unsandboxed fallback.
  • ✓Skips cloud/remote-host sessions; separate from Copilot CLI sandbox settings. Docs: configure local sandboxing.
⚡

Key Decision Metrics at a Glance

TL;DR Verdict
🏆 Benchmark RankRank
See how it ranks on the leaderboard
Full Leaderboard→
💰 Cost & PlansCompare
API & Subscription
Compare Plans↗
🛠️ Ecosystem & IDERules
GitHub Copilot (Agent Mode / Codex)
Setup IDE Rules↗
🧭

Turn your technical choice into a development budget

Compare 40 dev plans & simulate token costs vs $20/mo subscriptions

⚔️ Compare Model→💰 Compare plans & limits↗
🔗

Project Links & Resources

Direct Access
Direct access to official project resources and documentation
📝
Changelog: Local sandboxing in the GitHub Copilot app
github.blog/changelog/2026-09-23-local-sandboxing-in-the-github-copilot-app
↗
📖
Docs: Configuring local sandboxing
docs.github.com/en/copilot/how-tos/github-copilot-app/configure-local-sandboxing
↗
🔬

In-Depth Technical Analysis

Core Background & Industry Pain Points

Local coding agents with shell access can delete files, leak credentials, or hit the network by mistake. GitHub’s Local sandboxing in the GitHub Copilot app adds per-project local sandboxes so command execution is separated from accessible resources.

Architecture Highlights & Internals

Project policy covers filesystem (extra R/W, read-only, denied paths), network (outbound + local), and credentials (HTTPS Git + GitHub CLI). Enterprise-managed settings can tighten further. If the OS cannot enforce the policy, the sandboxed shell errors instead of silently running unsandboxed.

Authoritative Benchmarks & Measured Scores

Security/product preview—no public SWE-bench-style scores. The verifiable claims are policy surface, opt-in defaults, and fail-closed behavior when enforcement is impossible.

Developer Hands-on Guide

Enable Sandbox new sessions under project Sandbox settings, or /sandbox on for an active session. Not for cloud/remote-host sessions; Copilot CLI sandbox is separate. Docs: Configuring local sandboxing.

Action HubReady to adopt this in production?

Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.

⚔️ Launch VS Compare→💳 View Plans↗
Up NextGitHub Copilot Dynamic Workflows public preview: code-defined multi-agent orchestration across CLI, app, and SDK
Read Now→