GitHub Copilot app adds OS-enforced local sandboxing that fails closed, but it ships off by default
GitHub Changelog·medium signal
GitHub's 2026-09-23 changelog adds local sandboxing to the Copilot app in public preview. It restricts filesystem access through extra read/write, read-only and denied folder lists, controls outbound and local network access, and gates Git HTTPS and GitHub CLI credentials. If the OS cannot enforce the policy, the sandboxed shell errors out rather than running unsandboxed. It is off by default, enabled per project or with '/sandbox on', and does not cover cloud or remote-host sessions.