GitHub announced local sandboxing in the GitHub Copilot app on September 23, 2026. The public-preview feature lets teams configure a sandbox policy for each project’s local repository and working-tree sessions. It is a meaningful change for teams that want coding agents to help investigate failures without giving every session broad access to a developer machine.
What GitHub Copilot app local sandboxing adds
According to GitHub’s announcement, project settings can define additional read/write folders, read-only folders, denied folders, outbound and local-network access, plus Git and GitHub CLI credentials. The project policy is requested when a sandboxed session starts; enterprise-managed settings can make the effective policy stricter.
There is an important fail-closed detail: if the operating system cannot enforce the requested policy, the sandboxed shell errors instead of running unsandboxed. Sandboxing is off by default, applies to new sessions by default, and is configured separately from Copilot CLI or cloud/remote sessions. An active local session can be enabled with /sandbox on.
Why this matters for QA engineers
AI-assisted debugging often needs test artifacts, logs and a checkout, but it should not automatically need production-like credentials, unrelated home-directory files or unrestricted network access. GitHub Copilot app local sandboxing gives QA leads a testable boundary around that work. Treat the policy as part of your test environment—not as proof that an agent’s output is safe.
A practical QA validation checklist
- Create a disposable test project with a fixture directory the agent may read and a separate directory it must not read.
- Allow write access only to a generated-artifacts folder; ask the agent to create a report there and verify that source files remain unchanged.
- Run a safe command that needs outbound access, then repeat it with outbound access disabled. Record both the error and the resulting artifacts.
- Test local-network access separately from internet access if your test stack uses a local mock server, grid or container endpoint.
- Try a Git operation with credentials disabled and confirm the session fails cleanly rather than prompting, falling back or exposing a token.
- Restart the session after each policy edit; GitHub says settings changes apply to new sessions or an existing session restart.
Roll out with evidence
Start with a non-sensitive repository and capture the effective project policy, agent request, command output and file diff for each test. Keep a negative-test matrix for denied paths, credentials and both network modes. Because this is a public preview and enterprise controls may further restrict it, verify behavior on each supported operating system and managed-device profile before standardizing it in a QA workflow.
Source
GitHub Changelog: Local sandboxing in the GitHub Copilot app (September 23, 2026)