Know which boundary each feature provides
GitHub announced general availability of local sandboxing in Copilot CLI, the Copilot app and VS Code sessions using Agent Host on October 7, 2026. A worktree alone does not stop a command from reading another directory. Approval prompts decide when access is requested; the sandbox attempts to enforce filesystem and network limits.
Documented CLI defaults may permit writes in the current working directory and temporary directories, including .git inside a repository. Review the effective policy rather than assuming “sandboxed” means read-only.
Test on a synthetic project first
- Record client, version, operating system and active sandbox settings.
- Use a throwaway repository with no secret and no production remote.
- Identify a path and network destination that should be denied.
- Ask for benign read and write attempts inside the allowed scope and outside it.
- Observe which operations fail and whether the client offers a bypass.
- Inspect .git, temporary files and logs after the run; clean up the test environment.
A bypass changes the effective boundary
Some clients can ask to retry a blocked command with broader access. Approve only the exact operation and target you intended; a broad or persistent exception can remove the control the pilot was meant to test. Check whether the client masks credentials in logs, and still keep real credentials out of the synthetic workspace.
GitHub documents different prerequisites across Windows, Linux and macOS. Test the surface you actually use, not a generic screenshot of another client.