TechAtelier
DEVELOPMENT · AI · SECURITY

AI agents: why the sandbox is becoming as important as the prompt

GitHub Copilot now offers per-project local sandbox settings for sessions running on your machine. The question is no longer only what an agent understands, but what it is technically allowed to read, modify, contact and authenticate as.

An assistant that suggests code and an agent that executes commands do not carry the same risk. Once an agent can launch a shell, edit files or use the network, its execution environment becomes a security boundary of its own.

What GitHub added to Copilot

On September 23, 2026, GitHub announced local sandbox settings in the GitHub Copilot app for local repository and working-tree sessions. The feature is in public preview and remains off by default.

The project policy covers filesystem permissions, outbound Internet and local network access, and Git/GitHub CLI credentials.

The real issue: bounding agent capabilities

A prompt tells the agent what you want. The sandbox determines what it can actually do. That distinction becomes fundamental in agentic workflows.

An instruction is not a security boundary

Saying “do not access this folder” or “do not use the network” is not equivalent to an execution policy that technically blocks that access.

1. Filesystem

The sandbox can define extra read/write locations, read-only locations and denied folders. A sensible default is to start with the smallest required project scope and expand only when the task requires it.

2. Network

Network access is a sensitive capability. A command may fetch dependencies, reach APIs, access local services or send data outside the machine. Copilot separates outbound Internet and local-network settings.

3. Credentials

The sandbox can control Git credentials for authenticated HTTPS operations and GitHub CLI credentials. An agent should receive those credentials only when the intended task genuinely requires remote actions.

The most important detail: fail rather than lose isolation

GitHub states that if the operating system cannot enforce the requested sandbox policy, the sandboxed shell fails with an error instead of running without the sandbox. This fail-closed behavior is an important security property.

What the local sandbox does not cover

These settings target local sessions in the Copilot app. They do not apply to cloud sandbox sessions or sessions running on a remote host. GitHub also notes that Copilot app and Copilot CLI sandbox settings are configured separately, while enterprise-managed restrictions may make the effective local policy more restrictive.

Practical rules

  • Enable isolation before granting more autonomy to an agent.
  • Restrict write access to the project directories that are actually needed.
  • Explicitly deny folders containing secrets or unrelated projects.
  • Disable network access when the task does not require it.
  • Expose Git/GitHub credentials only when remote actions are expected.
  • Prefer fail-closed behavior when a policy cannot be enforced.
  • Treat local, CLI, remote and cloud execution as separate environments.

The agent is becoming a workload that needs isolation

Models will keep improving, but so will their autonomy. Security therefore cannot stop at prompt quality or code review. Agents that can act need a controlled execution layer: least privilege, bounded network, limited credentials and enforced isolation.

Sources

Published September 24, 2026. The feature is in public preview and may change.