Overview of Local Sandboxing

GitHub has announced the introduction of local sandboxing for the GitHub Copilot app, aimed at reducing the potential impact of unintended commands by limiting access to files, network resources, and credentials on a user's machine. According to the <a href="https://github.blog/changelog/2026-09-23-local-sandboxing-in-the-github-copilot-app/">GitHub Changelog</a>, users can configure this feature per project specifically for local repository and working tree sessions.

The introduction of local sandboxing provides developers with enhanced isolation controls while working locally. The tool is designed to intercept and manage potential risks before they can affect the broader development environment or sensitive local machine data.

Configurable Policy Domains

Within the GitHub Copilot app, the local sandboxing system governs three primary policy domains: filesystem controls, network restrictions, and credential management.

For the filesystem, the configuration includes additional read/write lists, additional read-only lists, and denied folder lists. On the network side, settings manage outbound internet access and local network connectivity. Meanwhile, credential handling covers Git credentials required for authenticated HTTPS operations, as well as GitHub CLI credentials for authentication purposes.

These defined project settings describe the precise policy that the application requests whenever a sandboxed session begins. However, the effective policy enforced may become even more restrictive if broader enterprise-managed settings apply to the environment.

Operating System Enforcement and Error Handling

The security architecture of the sandbox relies heavily on the underlying host operating system to properly enforce the requested restrictions. If a user's operating system cannot enforce the requested policy, the sandboxed shell will fail with an explicit error rather than running without a sandbox.

This fail-safe behavior ensures that developers are immediately alerted when safety constraints cannot be fully realized, preventing accidental execution in an unverified or insufficiently isolated state.

Enabling and Managing Sandbox Sessions

By default, local sandboxing is turned off in the app. To activate it, developers can open the application settings, select their project, and turn on the "Sandbox new sessions" toggle located under the "Sandbox" section. Developers should note that this setting applies exclusively to new sessions created within the project and does not retroactively alter sessions that are already running.

Furthermore, any subsequent modifications made to filesystem, network, or credential settings will apply to newly initiated sessions or whenever an existing session undergoes a restart.

For users who need to enable sandboxing on an active local session instantly without altering the overall project default, entering a specific command string directly into the session environment can dynamically apply the change. Developers seeking detailed guidance on setup procedures can review the documentation regarding <a href="https://gh.io/github-app-local-sandboxing">configuring local sandboxing in the GitHub Copilot app</a>.

Scope and Preview Status

It is important for users to understand the operational boundaries of the new feature. Local sandboxing does not apply to cloud sandbox sessions or to sessions running on a remote host.

Additionally, sandbox settings for the GitHub Copilot app and the Copilot CLI must be configured separately from one another.

GitHub has emphasized that local sandboxing is currently released in public preview and remains subject to change as feedback is gathered from the developer community.

Sources

• GitHub ChangelogLocal sandboxing in the GitHub Copilot app