Copilot app (Local sandboxing)

Use it to run Copilot app sessions with restricted access to files, networks, and credentials to reduce the impact of unintended commands.

Availability

Generally available on paid Copilot plans

Pricing model

Paid Copilot plans

Deployment

Computer use is in public preview on macOS and Windows.

Privacy

Users can view or delete saved preferences in Copilot settings

Licence

No GHSP or GHAS license required for these checks

• Local sandboxing is off by default and can be turned on in app project settings or enabled for an active session with the /sandbox command. ^[1]
• Local sandboxing is configurable per project in the Copilot app and can be enabled for new sessions or when restarting sessions. ^[1]

  In the GitHub Copilot app, you configure it per project for local repository and working tree sessions.

• Sandbox settings include network controls for outbound internet and local network access. ^[1]

  Network: Outbound internet and local network settings.

• Sandbox settings include filesystem (additional read/write, additional read-only, and denied folders) controls. ^[1]

  Filesystem: Additional read/write, additional read-only, and denied folder lists.

• Sandbox settings include credential controls for Git and GitHub CLI authentication. ^[1]

  Credentials: Git credentials for authenticated HTTPS git operations, and GitHub CLI credentials for GitHub CLI authentication.

• If the operating system cannot enforce the requested policy, the sandboxed shell fails with an error rather than running without a sandbox. ^[1]

  If your operating system cannot enforce the requested policy, the sandboxed shell fails with an error rather than running without a sandbox.

• Local sandboxing does not apply to cloud sandbox sessions or sessions running on a remote host. ^[1]

  Local sandboxing does not apply to cloud sandbox sessions or sessions running on a remote host.

• The policy applies to eligible features managed on the enterprise Features & clients page, Copilot Code Review policy, and MCP servers in Copilot policy. ^[2]

  This policy applies to eligible features managed on your enterprise's "Features & clients" page (i.e., https://github.com/enterprises/YOUR-ENTERPRISE-SLUG/ai-controls/copilot/features), as well as the Copilot Code Review policy on the "Agents" page and the MCP servers in Copilot policy.

• Administrators can configure the policy for 28 days before it affects feature access for users. ^[2]

  For the next 28 days, you can configure this policy, but it won't affect feature access for your users yet.

• Starting October 22, eligible generally available features left Unconfigured follow the selected global default. ^[2]

  Eligible generally available features and capabilities left Unconfigured will follow your selected global default of enabled, disabled, or let organizations decide.

• Explicitly enabled or disabled feature decisions are preserved. ^[2]

  If you've explicitly enabled or disabled a feature, we won't override that choice.

• Preview features remain opt-in. ^[2]

  Preview features remain opt-in.

• Local sandboxing limits agents' access to files, networks, and credentials. ^{[1] [3]}

  Limit agents' access to files, networks, and credentials with local sandboxing, now in public preview.

• Local sandboxing is now in public preview. ^{[1] [3]}

  Limit agents' access to files, networks, and credentials with local sandboxing, now in public preview.

• The sandboxing is local. ^{[1] [3]}

  This week's releases add new models to Copilot, local sandboxing in the Copilot app, and updates to Copilot in Slack, Microsoft Teams, JetBrains, and VS Code.

• The validator detects malformed JSON, unsupported configurations, invalid team mappings, and other errors that can prevent policies from being enforced. ^[4]

  The validator detects malformed JSON, unsupported configurations, invalid team mappings, and other errors that can prevent policies from being enforced.

• Validation covers copilot/managed-settings.json and copilot/team-mappings.json, including team settings files referenced by the mappings file. ^[4]

  copilot/team-mappings.json and any team settings files referenced by the team mappings file

• Each issue identifies the affected file and JSON path. ^[4]

  Each issue identifies the affected file and JSON path, helping you make corrections to ensure that policies are enforced as intended.

• Administrators can review errors in the “Copilot settings validation” section of the enterprise AI controls page. ^[4]

  Review and correct errors in the "Copilot settings validation" section of the enterprise AI controls page.

• HydraFusion is available in Visual Studio Code and the GitHub Copilot app, expanding beyond Copilot CLI. ^[5]

  The HydraFusion research preview is now available in Visual Studio Code and the GitHub Copilot app, expanding beyond Copilot CLI.

• HydraFusion orchestrates multiple models rather than being a single model. ^[5]

  HydraFusion appears in the model picker, but rather than being a single model, it orchestrates multiple models.

• HydraFusion uses one of three workflows: Single, Cascade, or Critique. ^[5]

  HydraFusion uses one of three workflows:

• HydraFusion is available to Copilot Pro, Pro+, Business, and Enterprise users. ^[5]

  HydraFusion is available to Copilot Pro, Pro+, Business, and Enterprise users.

• Copilot Business and Enterprise administrators must enable preview features. ^[5]

  For Copilot Business and Enterprise, an administrator must enable preview features.

• HydraFusion remains a research preview and is subject to change. ^[5]

  HydraFusion remains a research preview and is subject to change.

• Computer use is available in public preview in the GitHub Copilot app on macOS and Windows. ^[6]

  Computer use is now available in public preview in GitHub Copilot CLI and the GitHub Copilot app on macOS and Windows.

• Copilot can read accessible app content and visual context, click controls, enter and edit text, press keys, scroll, drag, and navigate workflows across applications. ^[6]

  Copilot can interact with desktop applications on your behalf (e.g., reading accessible app content and visual context, clicking controls, entering and editing text, pressing keys, scrolling, dragging, and navigating workflows across applications).

• Computer use can help automate workflows in GUI-only software that does not provide an API, command-line interface, or MCP integration. ^[6]

  This expands the tasks Copilot can help automate, including workflows in legacy and GUI-only software that do not provide an API, command-line interface, or MCP integration.

• Copilot asks for approval before controlling an app. ^[6]

  Copilot asks for approval before controlling an app, and you can review or reset apps that you have chosen to always allow.

• On macOS, computer use guides users through required Accessibility and Screen Recording permissions. ^[6]

  On macOS, computer use also guides you through the required Accessibility and Screen Recording permissions.

• Dynamic workflows are in public preview in the GitHub Copilot app.
• They are available on all Copilot plans. ^[7]

  Dynamic workflows are available on all Copilot plans.

• Workflows can run commands, use tools, or call other services. ^[7]

  Run commands, use tools, or call other services.

• The GitHub Copilot app has dynamic workflows available with no setup required. ^[7]

  In the GitHub Copilot app, dynamic workflows are always available with no setup required.

• The announcement says HydraFusion provides clearer, more frequent progress updates. ^[8]

  Clearer, more frequent progress updates help you follow its work.

• HydraFusion lets Copilot select and coordinate models for a task. ^[8]

  Let Copilot select and coordinate models for your task with HydraFusion , a research preview now available in VS Code and the GitHub Copilot app alongside Copilot CLI.

• HydraFusion is a research preview in VS Code and the GitHub Copilot app alongside Copilot CLI. ^[8]

  Let Copilot select and coordinate models for your task with HydraFusion , a research preview now available in VS Code and the GitHub Copilot app alongside Copilot CLI.

• Local sandboxing is generally available in GitHub Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host. ^[9]

  Local sandboxing for GitHub Copilot is now generally available in GitHub Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host.

• Sandbox policies can limit the files and directories that agent-run commands can read or modify. ^{[1] [9]}

  Limit the files and directories that agent-run commands can read or modify.

• Developers can control access to the internet, local networks, Git credentials, and GitHub CLI credentials. ^{[1] [9]}

  Control access to the internet, local networks, Git credentials, and GitHub CLI credentials.

• Microsoft eXecution Container translates a common sandbox policy into native operating-system controls across Windows, macOS, and Linux. ^[9]

  Local sandboxing is powered by Microsoft eXecution Container (MXC) , which translates a common sandbox policy into native operating-system controls across Windows, macOS, and Linux.

• Local sandboxing is included with GitHub Copilot at no additional cost. ^[9]

  Local sandboxing is included with GitHub Copilot at no additional cost.

• GitHub is adding checks from the secret classifier alongside the existing LLM-based security review. ^[10]

  Coming soon, GitHub is adding checks from the secret classifier alongside the existing LLM-based review.

• The new checks are coming soon in private preview. ^[10]

  AI-based secret scanning with the GitHub Copilot /security-review command for the Copilot CLI and Copilot app available soon in private preview.

• The new checks will consume AI Credits in addition to the review’s existing usage. ^[10]

  The new checks will consume AI Credits in addition to the review's existing usage.

• No GHSP or GHAS license is required to use these checks. ^[10]

  You don't need a GHSP or GHAS license to use these checks.

• The new checks will be off by default, and running /security-review will not enable them. ^[10]

  The new opt-in checks for push protection and the security review command will consume GitHub AI Credits.

• Local sandboxing is generally available in Copilot CLI. ^[11]

  Limit agents' access to files, networks, and credentials with local sandboxing, now generally available in Copilot CLI, the Copilot app, and VS Code sessions using Agent Host.

• Local sandboxing is available in the Copilot app and VS Code sessions using Agent Host. ^[11]

  Limit agents' access to files, networks, and credentials with local sandboxing, now generally available in Copilot CLI, the Copilot app, and VS Code sessions using Agent Host.

• Local sandboxing can limit agents’ access to files, networks, and credentials. ^{[1] [11]}

  Limit agents' access to files, networks, and credentials with local sandboxing, now generally available in Copilot CLI, the Copilot app, and VS Code sessions using Agent Host.

• Local sandboxing is included with Copilot at no extra cost. ^[11]

  This is included with Copilot at no extra cost.

• Identity capture is off by default and remains separate from the existing pseudonymous user identifier. ^[12]

  Identity capture is off by default and remains separate from the existing pseudonymous user identifier.

• The telemetry.capture.identity setting adds user.name, process.user.name, and host.name attributes to OpenTelemetry data. ^[12]

  The telemetry.capture.identity setting adds three attributes to OpenTelemetry (OTel) data:

• Administrators can independently control capture of prompts, responses, toolArguments, toolOutput, and policyDetail. ^[12]

  Administrators can also independently control five additional capture classes:

• Every capture class is off by default. ^[12]

  Every capture class is off by default.

• Explicit managed values take precedence over local settings, SDK configuration, and environment variables. ^[12]

  Explicit managed values take precedence over local settings, SDK configuration, and environment variables.

• Fine-grained capture controls are available in Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host. ^[12]

  Fine-grained capture controls are available in Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host.

• With the setting active, a cached response cannot satisfy the freshness requirement. ^[13]

  While the setting is active, a cached response cannot satisfy the freshness requirement.

• If a client cannot confirm current policy, it fails closed rather than running with stale or unconfirmed policy. ^[13]

  If the client cannot confirm current policy, it fails closed rather than running with a stale or unconfirmed policy.

• The sandbox key can enforce a required minimum client version, forcing users on older versions to update to resume using Copilot. ^[13]

  When this key is included in managed settings, users who pin to older versions of Copilot clients will now be forced to update in order to resume using Copilot.

• The forceRemoteSettingsRefresh setting can require supported clients to retrieve current settings at startup. ^[13]

  Enterprise administrators can now require supported GitHub Copilot clients to retrieve current server-managed settings at startup instead of relying on a cached policy.

• The setting is supported in Copilot CLI, VS Code, and the GitHub Copilot app. ^[13]

  The setting is supported in Copilot CLI, VS Code, and the GitHub Copilot app.

• Claude Opus 5.5 is the suggested alternative to Claude Opus 4.8 and Claude Opus 5. ^[14]

  The deprecation of Claude Opus 4.8 does not apply to these customers.

• Suggested alternatives are automatically enabled for Copilot Enterprise and Copilot Business customers under default model enablement, unless an administrator has disabled them. ^[14]

  Under default model enablement, the suggested alternatives are automatically enabled for Copilot Enterprise and Copilot Business customers unless an administrator has turned off the global default or explicitly disabled the model.

• Claude Opus 4.8, Claude Opus 5, and GPT-5.6 Terra are scheduled for deprecation across GitHub Copilot experiences on November 16, 2026. ^[14]
• Claude Opus 4.8 remains available to individual GitHub Copilot subscribers on annual plans. ^[14]

  *Claude Opus 4.8 will remain available to individual GitHub Copilot subscribers on annual plans so they retain an Opus offering.

• GPT-6.1 Sol or GPT-6 Luna are suggested alternatives to GPT-5.6 Terra. ^[14]

  GPT-6.1 Sol or GPT-6 Luna

• GET and PATCH endpoints for model policies are generally available. ^[15]

  GET and PATCH endpoints are now generally available for model policies at four levels:

• Enterprise policies can delegate model control to organizations in organization mode, or to teams and apps in enterprise teams mode. ^[15]

  Enterprise policies can delegate model control to organizations in organization mode, or to teams and apps in enterprise teams mode.

• The API supports model policies at the organization level. ^[15]

  You can now use the REST API to retrieve and update Copilot model policies for enterprises, enterprise teams, enterprise apps, and organizations.

• The API supports model policies for enterprise teams and enterprise apps. ^[15]

  You can now use the REST API to retrieve and update Copilot model policies for enterprises, enterprise teams, enterprise apps, and organizations.

• The API supports model policies at the enterprise level. ^[15]

  You can now use the REST API to retrieve and update Copilot model policies for enterprises, enterprise teams, enterprise apps, and organizations.

• Administrators can choose Enabled, Disabled, or Let organizations decide as the global default. ^[16]

  Eligible generally available features and capabilities left Unconfigured will be set according to the selected global default of Enabled , Disabled , or Let organizations decide .

• Enforcement is gradually rolling out through October 26. ^[16]

  Starting today, we're gradually rolling out enforcement of the policy through October 26, so it may take effect at different times for different enterprises and organizations.

• Eligible generally available features left Unconfigured are set according to the selected global default. ^[16]

  Eligible generally available features and capabilities left Unconfigured will be set according to the selected global default of Enabled , Disabled , or Let organizations decide .

• Explicit choices for individual features are preserved during rollout. ^[16]

  Administrators can still make explicit choices for individual features at any time.

• Preview features remain opt-in. ^[16]

  Preview features remain opt-in.

• Server-to-server authentication is available in public preview. ^[17]

  GitHub Copilot now supports server-to-server authentication for GitHub Apps installed on organizations, available in public preview.

• Services and agents built with the GitHub Copilot SDK can make requests on behalf of an organization without a signed-in user's credentials. ^[17]

  Services and agents built with the GitHub Copilot SDK can now make requests on behalf of an organization without relying on a signed-in user's credentials.

• A GitHub App can be given the read-only Copilot Requests organization permission and installed on an organization. ^[17]

  Developers can give a GitHub App the read-only Copilot Requests organization permission, install the app on an organization, and pass a short-lived installation access token to the Copilot SDK.

• Usage is attributed and billed to the organization that owns the installation. ^[17]

  Usage is attributed and billed to the organization that owns the installation.

• Organization owners can review app access, identify app-attributed usage in AI usage CSV reports, and suspend or uninstall an app to stop its access. ^[17]

  Organization owners can review which apps have access, identify app-attributed usage in AI usage CSV reports using the app_client_id field, and stop an app's access by suspending or uninstalling it.

• Assisted permissions are generally available in GitHub Copilot CLI, GitHub Copilot app, and Visual Studio Code. ^[18]

  Assisted permissions are now generally available in GitHub Copilot CLI, GitHub Copilot app, and Visual Studio Code.

• A large language model evaluates requests to run commands, access a file system path, or open a URL. ^[18]

  When Copilot requests permission to run a command, access a file system path, or open a URL, a large language model evaluates the request.

• Requests classified as clearly safe automatically proceed. ^[18]

  Requests classified as clearly safe automatically proceed.

• Requests not classified as clearly safe require approval. ^[18]

  Requests classified as clearly safe automatically proceed.

• Enterprise administrators can block Allow All while keeping Assisted available, or disable Assisted separately. ^[18]

  If you're an enterprise administrator, you can use enterprise-managed settings to block Allow All while keeping Assisted available or disable Assisted separately.

• Administrators can choose the default permission mode for new sessions. ^[18]

  You can also choose the default permission mode for new sessions.

• Copilot Chat, Copilot code review, and Copilot in the cloud require available budget. ^[19]

  Copilot Chat, Copilot code review, and Copilot in the cloud require available budget to use.

• Available now for GitHub Enterprise Cloud customers working with a GitHub or Microsoft account team. ^[19]

  Enterprises working with a GitHub or Microsoft account team can now get Copilot included with GitHub Enterprise for every licensed user.

• Self-serve availability is opening in stages, and current self-serve subscriptions are unaffected. ^[19]

  Self-serve availability is coming in stages, and current self-serve subscriptions are unaffected.

• AI usage is metered from the first request against the enterprise budget. ^[19]

  AI usage is metered from the first request against your enterprise budget, using the policies, alerts, and attribution you already have.

• Code completion and next edit suggestions keep working even when no budget is available. ^[19]

  Code completion and next edit suggestions keep working even with no budget available.

• Copilot access through GitHub Enterprise has the same features and models as Copilot Enterprise but does not include monthly AI credits per seat. ^[19]

  Copilot access through GitHub Enterprise and Copilot Standalone has the same features and models as Copilot Enterprise but does not include monthly AI credits per seat.

• Computer use can read app content, click controls, enter or edit text, and navigate across apps, including apps without an API, command-line interface, or MCP integration. ^[20]

  Computer use—in public preview on macOS and Windows—lets Copilot read app content, click controls, enter or edit text, and navigate across apps, including those without an API, command-line interface, or MCP integration.

• Copilot Projects can use context such as repositories, design mocks, Slack threads, and notes from design meetings. ^[20]

  Start a project, describe what you want to get done, and add the context Copilot needs (e.g., repositories, design mocks, Slack threads, or notes from a design meeting).

• Copilot runs agents for project work and brings back results, such as pull requests, for review. ^[20]

  Copilot runs as many agents as the work needs and brings back results (e.g., pull requests) for your review.

• Project automations can perform repeatable tasks, such as creating a promo video when a feature lands. ^[20]

  Use project automations for repeatable tasks, such as creating a new promo video whenever a feature lands.

• Users can generate and edit images using natural language in chat. ^[20]

  You can also generate and edit images using natural language in chat.

• Computer use is in public preview on macOS and Windows. ^[20]

  Computer use—in public preview on macOS and Windows—lets Copilot read app content, click controls, enter or edit text, and navigate across apps, including those without an API, command-line interface, or MCP integration.

• Copilot can generate and edit images using natural language. ^[21]

  You can now generate and edit images using natural language in GitHub Copilot.

• The selected reasoning model calls a dedicated image-generation tool powered by GPT Image 2.5 Flare. ^[21]

  When you ask for an image, your selected reasoning model calls a dedicated image-generation tool powered by GPT Image 2.5 Flare, previews the result inline, and saves it to your project.

• Generated images are previewed inline and saved to the project. ^[21]

  When you ask for an image, your selected reasoning model calls a dedicated image-generation tool powered by GPT Image 2.5 Flare, previews the result inline, and saves it to your project.

• Image generation is in public preview for Copilot Pro, Copilot Pro+, Copilot Business, and Copilot Enterprise. ^[21]

  Image generation is in public preview for Copilot Pro, Copilot Pro+, Copilot Business, and Copilot Enterprise.

• Image generation is billed separately from the chat model based on image tokens that count toward the plan’s AI credits. ^[21]

  It's billed separately from your chat model, based on image tokens that count toward your plan's AI credits.

• Organization and enterprise owners can disable image generation using Copilot model policies. ^[21]

  Organization and enterprise owners can turn off image generation by disabling the image generation model using Copilot model policies .

• GitHub Copilot Memory is generally available on paid Copilot plans. ^[22]

  GitHub Copilot Memory is now generally available on paid Copilot plans.

• Copilot can remember personal preferences and repository conventions across sessions and clients. ^[22]

  Copilot can remember personal preferences and repository conventions across sessions and clients.

• Users can view or delete saved preferences in Copilot settings. ^[22]

  You can interact with memories in the Copilot app, Copilot CLI, and VS Code, or manage personal memories in your Copilot settings, where you can view or delete saved preferences .

• AWS Continuum can investigate code vulnerabilities and propose fixes Daily brief 2026-10-25
• An open model for tool-using agents, plus a checkpoint to fine-tune Daily brief 2026-10-13
• Two local models can classify, route, or score text and images Daily brief 2026-10-10
• Perplexity introduces a decision model fine-tuned from Qwen3.8-27B Daily brief 2026-10-01
• GitHub expands Copilot controls and adds local sandboxing Daily brief 2026-09-30
• GitHub adds controls for Copilot code review and local sandboxing Daily brief 2026-09-26
• Meta previews Muse Video and releases Muse Image and Muse Spark Daily brief 2026-09-25
• New model releases span quantized language models and image generation Daily brief 2026-09-23