GitHub Copilot App Local Sandboxing: Production Safety Guide
GitHub announced September 23, 2026 that the GitHub Copilot app now supports per-project local sandboxing for local repository and working-tree sessions. The feature is in public preview and is off by default. A project policy can grant or deny filesystem paths, allow or block outbound internet and local-network access, and control authenticated Git and GitHub CLI credentials. GitHub says the requested policy can be made more restrictive by enterprise-managed settings, and if the operating system cannot enforce the requested policy the sandboxed shell fails instead of silently running unsandboxed. Use local sandboxing to reduce the blast radius of unintended agent commands, but keep authorization, branch protection, secret handling, tests, code review and deployment controls separate. Start from the narrowest practical policy, verify common development tasks inside it, and treat any request to run a tool outside the sandbox as a consequential exception that deserves review rather than a routine click-through.
A Copilot app local session needs to install dependencies or edit code without giving agent-run commands unrestricted access to the rest of the workstation
A project sits near sensitive folders or credentials and the team wants explicit filesystem deny rules
An agent needs package-registry or local-development-server access but should not inherit every network path available to the signed-in user
A team wants to know whether working-tree isolation alone prevents commands from reading files elsewhere on the machine
A sandboxed tool requests permission to run outside the sandbox and the user needs a safer decision process
Possible causes
Without local sandboxing, agent-run commands can execute with the same filesystem, network and credential access as the signed-in user
Working trees separate branches and files for concurrent sessions but do not by themselves restrict command access to other locations on the machine
The default sandbox policy permits common development activity, so high-sensitivity projects may need tighter path, network or credential restrictions
Policy changes apply to new sessions or restarted sessions rather than silently changing a currently running shell
Some requested policies depend on host operating-system capabilities; GitHub documents fail-closed behavior when the host cannot enforce them
HOW TO FIX IT
Work from the safest step to the harder repair.
Step 1. Open the GitHub Copilot app project settings and enable Sandbox new sessions for the project you are testing. GitHub says local sandboxing is off by default and the project setting applies to new local sessions rather than sessions already running.
Step 2. Inventory the minimum resources the agent actually needs before widening anything: workspace files, any additional read-only folders, any additional read/write folders, package registries, local development servers, Git authentication and GitHub CLI authentication.
Step 3. Keep filesystem access narrow. GitHub says the sandbox already has read/write access to its workspace and current working directory; add only required paths and use Denied entries for sensitive folders that should remain inaccessible.
Step 4. Review network needs separately. Outbound internet and local-network access are independent project settings. Disable the paths a project does not need, then verify dependency installation, API calls, preview servers and local tooling that legitimately depend on those connections.
Step 5. Review credential access separately from network access. Turn off Git credentials or GitHub CLI credentials when a task does not need authenticated pushes, pull-request creation or other authenticated GitHub operations.
Step 6. Restart an existing session after policy edits when you need the new filesystem, network or credential policy to take effect. GitHub documents /restart-session for keeping history while restarting the session.
Step 7. Verify fail-closed behavior on the target workstation. GitHub says a sandboxed shell fails with an unsupported-platform or unsupported-policy error when the operating system cannot enforce the requested policy rather than falling back to unrestricted execution.
Step 8. Treat a Run outside the sandbox? prompt as a security decision. Prefer canceling and narrowing the task or policy first. If an exception is genuinely required, understand whether you are authorizing one operation or disabling sandboxing for the remainder of the current session.
Step 9. For enterprise environments, review managed settings before assuming the local project configuration is the effective policy. GitHub says enterprise controls can make the effective policy more restrictive and can prevent users from running tools outside the sandbox.
Step 10. After the agent changes code, run the normal engineering gates: typecheck, tests, security checks where relevant, human review and a reversible deployment. Sandboxing limits command reach; it does not prove that generated code is correct or authorized for production.
Step 11. Keep secrets out of prompts and repositories even when credential access is disabled. A sandbox is a containment control, not a reason to place production keys, customer records or private credentials into agent context.
Step 12. Recheck GitHub's current documentation before standardizing the policy because local sandboxing is in public preview and the supported host capabilities or controls can change.
Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.
Test sandbox policies in a non-sensitive repository before rolling them out to repositories that can deploy or access production data.
Use least-privilege filesystem, network and credential settings and preserve branch protection, code review and CI gates.
Keep a documented rollback path for policy changes and verify host support before depending on a restriction as a production control.
STOP AND GET HELP WHEN
Do not turn a repair into a larger outage.
Do not describe local sandboxing as a complete security boundary or as permission for an agent to perform consequential production actions.
Do not assume a working tree prevents agent-run commands from accessing unrelated files elsewhere on the workstation.
Do not approve Run outside the sandbox prompts automatically; review why the requested capability is missing and whether the task can be completed without bypassing the boundary.
Do not broaden filesystem, network or credential access merely to silence a tool error without first identifying the minimum requirement.
Do not assume a policy edit changes a currently running session until the session is restarted or the documented session control is used.
HOW GENESIS HANDLES IT
Diagnose the exact failure before choosing a repair.
Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.
Platform scope
GitHub Copilot app · local agent sessions · working trees · filesystem/network/credential sandboxing
Category
Agentic coding · Local sandboxing · Production security
Last updated
2026-09-23
REPAIR PROFILE
Know the complexity before you edit.
Difficulty
Intermediate
Change risk
Medium
These labels describe implementation complexity and blast radius, not a guaranteed repair time.
AUTHORITATIVE SOURCES
Verify time-sensitive platform details at the source.
Is local sandboxing on by default in the GitHub Copilot app?
No. GitHub says it is off by default. Enable Sandbox new sessions in the project's app settings, or use the documented session command for an active local session.
Does a Copilot working tree already isolate the rest of my computer?
No. GitHub says a working tree separates branches and files for concurrent sessions, but it does not restrict what a command can access elsewhere on the machine. Local sandboxing adds that access-control layer.
What can the local sandbox restrict?
GitHub documents filesystem paths, outbound internet, local-network access, Git credentials and GitHub CLI credentials as project-configurable controls.
What happens if my operating system cannot enforce the requested sandbox policy?
GitHub says the sandboxed shell fails with an error rather than running without the requested sandbox.
Does local sandboxing apply to cloud or remote-host sessions?
No. GitHub says the Copilot app's local sandbox policy applies to local repository and working-tree sessions, not cloud sandbox sessions or sessions running on a remote host.
Once you know the platform and the verified problem, search the Genesis Code Doctor Code Store for a matching package. If the exact integration or repair is not there, use Request a Code and describe the platform, official documentation, desired behavior, and sanitized error—never send your secret key.
Start with a free diagnostic. If Genesis verifies a problem and a compatible treatment exists, continue to the matching Code Store product or repair path. If you cannot find the exact code you need, request it at GenesisCodeDoctor.com rather than forcing a generic snippet into the wrong platform.
