GitHub Copilot’s desktop application now includes a public‑preview local sandboxing capability that can be enabled per project. When active, the sandbox restricts the shell session’s access to the file system, outbound network, and stored credentials, and it fails fast if the host OS cannot enforce the requested policy.
What Changed
The new feature is disabled by default. Users can open the Copilot app settings, select a project, and toggle “Sandbox new sessions”. The toggle applies only to sessions started after the change; existing sessions continue without sandboxing unless the user explicitly invokes the /sandbox command inside the session. Configuration options cover three domains:
- Filesystem: Lists of folders that are read‑write, read‑only, or denied.
- Network: Controls for outbound internet and local‑network traffic.
- Credentials: Permissions for Git HTTPS authentication and GitHub CLI authentication.
These settings form the policy the app requests when a sandboxed session launches. Enterprise‑managed policies can further tighten the effective policy. The sandbox does not affect cloud‑hosted or remote‑host sessions, and the Copilot CLI has its own independent sandbox configuration.
Why It Matters for Engineers
AI‑generated code often includes shell commands that run on the developer’s workstation. Without isolation, a stray command could modify critical files, exfiltrate data, or misuse stored credentials. By constraining what a Copilot‑driven session can see or do, local sandboxing reduces the blast radius of accidental or malicious actions, aligning the tool with the security expectations of AI engineers, platform engineers, DevOps/SRE teams, and security specialists.
Operational and Security Considerations
Implementing sandboxing introduces a few operational steps:
- Define per‑project folder allow/deny lists that reflect the minimum set of paths required for the workload.
- Decide whether outbound internet or local‑network access is needed for the commands the model may emit.
- Review which Git and GitHub CLI credentials should be exposed; limiting these reduces credential leakage risk.
Because the sandbox aborts if the operating system cannot enforce the policy, teams should verify that their OS version and security modules (e.g., macOS sandbox, Windows AppContainer, Linux namespaces) are up to date. Failure to enforce results in an error rather than a silent bypass, which is a safety net but also a potential workflow interruption.
Since the feature is in public preview, behavior may evolve. Enterprises that apply additional policy layers should test the interaction between their controls and the Copilot app’s requested policy to avoid unexpected denials.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Adopt the sandbox on a trial basis for non‑critical projects to gauge impact on developer velocity. Document the folder, network, and credential scopes required for each codebase, and encode those as the project’s sandbox policy. Monitor session start logs for sandbox enforcement errors, and adjust OS or policy settings accordingly. Finally, keep an eye on future releases for changes to the preview feature and for any alignment with broader enterprise sandboxing standards.
