From an app preview to a shared local boundary
GitHub expanded local sandboxing to general availability on 7 October for Copilot CLI, the Copilot desktop app and Visual Studio Code sessions that use Agent Host. The 23 September preview had introduced an opt-in, project-level policy for the Copilot app; the new announcement extends the feature across more agent execution environments without requiring developers to depend only on model instructions for file and network boundaries.
GitHub says the implementation uses Microsoft eXecution Container (MXC) to translate a common sandbox policy into native Windows, macOS and Linux enforcement. Policies govern access to files and directories, public and local networks, Git credentials and GitHub CLI credentials. Enterprise administrators can require sandboxing and prevent a developer from weakening centrally imposed rules.
The model and its tools have separate privileges
GitHub says local MCP servers and language servers can also be covered where supported. That distinction matters because a prompt-level instruction to avoid a sensitive directory cannot constrain a shell command or tool service with broader operating-system permissions. Restricting execution paths independently of the chosen model limits what an agent can reach when a task or a generated command goes wrong.
Local sandboxing is included with Copilot at no additional cost, according to GitHub. General availability describes feature support, not a proof that every policy blocks every possible escape. Teams should test their permitted and denied paths, credential exposure and external-tool integrations on their actual platforms, particularly where agents can invoke local services.