GitHub Copilot App Gains Local Sandboxing in Public Preview
The GitHub Copilot app can now run local sessions in a sandbox that limits filesystem, network and credential access per project. Off by default, in public preview.
- Published
- Reading time
- 1 min read
- Author
- VoltKit Editorial
Based on an official announcement · Source: GitHub changelog
What happened
On 23 September 2026 GitHub announced local sandboxing for the GitHub Copilot app. The feature limits what commands run by the agent can reach on the developer's machine, and it is configured per project for local repository and working-tree sessions.
What we know
- Sandbox settings cover three areas: filesystem (additional read/write folders, additional read-only folders and denied folders), network (outbound internet and local network), and credentials (Git credentials for authenticated HTTPS operations and GitHub CLI credentials).
- The project settings describe the policy the app requests when a sandboxed session starts. Enterprise-managed settings can make the effective policy more restrictive.
- If the operating system cannot enforce the requested policy, the sandboxed shell fails with an error instead of running without a sandbox.
- Local sandboxing is off by default. It is enabled per project under "Sandbox new sessions" in the app settings, and applies to new sessions rather than ones already running. Typing
/sandbox onenables it for the current session only. - It does not apply to cloud sandbox sessions or sessions on a remote host, and the Copilot CLI has its own separate sandbox settings.
- GitHub labels the feature public preview and subject to change.
What is not yet confirmed
The announcement does not say which operating systems can enforce the policy, or how the sandbox is implemented on each. Those details would be in the linked documentation, which this summary does not cover.
Why it matters
Coding agents run shell commands, and the difference between a helpful agent and a destructive one is often a single mistaken command. A per-project policy that denies folders, blocks the network and withholds credentials is the kind of control that makes it reasonable to let an agent work with less supervision. The fail-closed behaviour is notable: a session that cannot be sandboxed refuses to run rather than silently running unprotected.
Sources
This summary was written from the documents below. Read the original before relying on any detail.
- Local sandboxing in the GitHub Copilot app(opens in a new tab)
GitHub changelog · Official announcement · github.blog · published
VoltKit summarises and organises information from public and official sources; it does not have reporters on the ground. How stories are sourced and corrected.