GitHub Copilot app adds per-project local sandboxing that fences an agent session out of files, network and git credentials

An agent session in the GitHub Copilot desktop app used to run with the same access to a developer's machine as the developer had. That changed on 23 September 2026, when GitHub shipped a public preview called local sandboxing that lets a user set, per project, what a session may read, write, reach on the network, and pull out of a credential store. GitHub says local sandboxing "helps reduce the potential impact of unintended commands by limiting access to files, network resources, and credentials on your machine".

The setting sits on the project record and describes the policy the app asks the operating system to enforce when a sandboxed session starts. GitHub notes that the effective policy can be more restrictive if enterprise-managed settings apply, so a corporate rule can tighten a user's choice but not loosen it.

What the sandbox actually fences off

Three categories are covered. Filesystem access is expressed as three lists: additional read and write folders, additional read-only folders, and denied folders, so a team can point the agent at the working tree while marking the home directory or a secrets folder as off limits. Network access is a pair of on/off toggles for the outside internet and the local network, so a session can be allowed to reach npm but blocked from an internal admin service, or the other way round. Credentials cover two specific stores: the git credentials used for authenticated HTTPS operations, and the GitHub CLI credentials used for GitHub CLI authentication.

One fail-safe is worth reading twice. GitHub says that if the operating system cannot enforce the requested policy, the sandboxed shell fails with an error rather than running without a sandbox. That closes the failure mode where a policy silently degrades into no policy, which is where most sandbox promises break in practice.

How a team turns it on and what stays outside its reach

The sandbox is off by default. To turn it on for all new sessions in a project, GitHub says to open the app settings, pick the project, and turn on Sandbox new sessions under the Sandbox heading. Changes to the three category settings take effect on the next session in that project, or when an existing session restarts. To sandbox one active local session without changing the project default, GitHub says to enter /sandbox on inside the session.

The boundaries of what the feature covers are worth noting. Local sandboxing applies only to local repository and working tree sessions. Cloud sandbox sessions and sessions running on a remote host are not covered. And the Copilot app and the Copilot CLI configure their sandbox settings separately, so a team that uses both has to make the two match if it wants one policy in effect across a developer's day.

The feature is in public preview and subject to change. For a team already running the agent on unrelated repositories in a single working tree, the honest task this week is to write the three folder lists once per project, turn the switch on, and check which sessions the agent finishes with the sandbox in place and which ones start failing on file paths the agent used to touch quietly.

Source

GitHub Changelog, Local sandboxing in the GitHub Copilot app, 23 September 2026. GitHub's configuration documentation.