01 What happened
GitHub Copilot has made local sandboxing generally available for CLI, the Copilot app, and VS Code sessions using Agent Host. The feature provides a secure execution boundary for agentic workflows on developers' own machines.
02 Key details
- Local sandboxing for GitHub Copilot is now generally available for CLI, the Copilot app, and VS Code sessions using Agent Host.
- Microsoft eXecution Container (MXC) translates sandbox policies into native OS controls on Windows, macOS, and Linux.
- Organizations can mandate sandboxing through enterprise-managed settings that developers cannot weaken.
- Sandbox policies apply regardless of which model Copilot uses, and the feature is included at no additional cost.
03 Why it matters
The sandbox restricts Copilot's tools and commands from accessing the filesystem, network, credentials, and system capabilities based on defined policies. Powered by Microsoft eXecution Container (MXC), it translates policies into native OS controls across Windows, macOS, and Linux.
04 Who it matters to
Software developers and enterprise AI customers.
Original source