GitHub has introduced local sandboxing in the Copilot app, allowing teams to define exactly what folders, credentials, and network access AI agents can reach on developer machines. The public preview feature, announced on September 23, 2026, lets project leads configure sandbox policies for each repository, creating a controlled environment where coding agents can investigate failures without gaining broad access to sensitive files or systems.

What Does GitHub Copilot's Sandboxing Actually Control?

The sandboxing feature operates at the project level, meaning teams can set different policies for different repositories. When a sandboxed session starts, the policy is enforced before any agent work begins. According to GitHub's announcement, project settings can define several layers of access control:

• Read and Write Folders: Teams can specify which directories the agent can both read from and modify, such as a dedicated artifacts folder for generated reports.
• Read-Only Folders: Directories the agent can examine but never alter, useful for test fixtures or reference data.
• Denied Folders: Paths that remain completely off-limits, protecting sensitive configuration files or personal directories.
• Network Access: Teams can disable outbound internet access or local network connections, preventing agents from reaching external services or internal infrastructure.
• Credential Restrictions: Git and GitHub CLI credentials can be disabled, ensuring agents cannot authenticate to repositories or services.

A critical safety feature is the fail-closed design: if the operating system cannot enforce the requested policy, the sandboxed shell errors instead of running unsandboxed. This means the session stops rather than silently bypassing restrictions.

Why Does This Matter for QA Teams?

Quality assurance engineers often need AI assistance to debug failures, which typically requires access to test artifacts, logs, and code checkouts. However, that work should not automatically grant agents access to production-like credentials, unrelated home-directory files, or unrestricted network access. Sandboxing creates a testable boundary around AI-assisted debugging, giving QA leads confidence that agents operate within defined limits.

The feature is off by default and applies to new sessions by default, meaning teams must explicitly enable it. Importantly, sandboxing is configured separately from Copilot CLI or cloud and remote sessions, so teams can apply different policies depending on where the agent runs. Enterprise-managed settings can make the effective policy stricter than project-level settings, adding another layer of control for large organizations.

How to Test Copilot Sandboxing in Your QA Workflow

QA teams planning to adopt sandboxing should follow a structured validation approach before standardizing it in production workflows. Here are the key testing steps:

• Fixture Directory Test: Create a disposable test project with a fixture directory the agent may read and a separate directory it must not read, then verify the agent respects the boundary.
• Write Access Validation: Allow write access only to a generated-artifacts folder, ask the agent to create a report there, and verify that source files remain unchanged.
• Outbound Access Testing: Run a safe command that needs outbound access, then repeat it with outbound access disabled, recording both the error and resulting artifacts.
• Local Network Isolation: Test local-network access separately from internet access if your test stack uses a local mock server, grid, or container endpoint.
• Credential Failure Modes: Try a Git operation with credentials disabled and confirm the session fails cleanly rather than prompting, falling back, or exposing a token.
• Session Restart Verification: Restart the session after each policy edit, since GitHub says settings changes apply to new sessions or an existing session restart.

QA teams should start with a non-sensitive repository and capture the effective project policy, agent request, command output, and file diff for each test. Building a negative-test matrix for denied paths, credentials, and both network modes helps ensure consistent behavior. Because this is a public preview and enterprise controls may further restrict policies, teams should verify behavior on each supported operating system and managed-device profile before standardizing it in a QA workflow.

What About Large Pull Request Reviews?

While sandboxing addresses access control, GitHub has also tackled another challenge for Copilot users: handling massive pull requests. The GitHub Copilot app now renders extremely large pull requests efficiently, a capability demonstrated with an open-source pull request containing 2,200 files, over one million changed lines, and more than 400 inline review comments.

The engineering challenge stems from the difference between code diffs and review comments. Code diffs are predictable in height, allowing for fast virtualization, but comments have unpredictable heights because their markdown wraps differently, expandable sections can open or close, reply composers grow as users type, and images load asynchronously. GitHub's solution splits the document's height into two independent domains: deterministic code height that is exact and known upfront, and dynamic block heights for comments that are estimated, then measured lazily.

This architectural approach ensures that when a comment resizes, it does not force the entire code geometry to be rebuilt. The measurement scheduler runs only when the visible range settles, never once per scroll frame, and waits entirely while a scroll is in flight. This prevents the jank that would otherwise occur during rapid scrolling through massive diffs.

Key Takeaways for Development Teams

GitHub's latest updates address two distinct pain points: security and performance. Sandboxing gives QA and development teams granular control over what AI agents can access, transforming a potential security concern into a manageable, testable boundary. Meanwhile, the improved pull request rendering ensures that even extreme cases with thousands of files and hundreds of comments remain responsive and usable. Together, these features signal GitHub's commitment to making Copilot more enterprise-ready and suitable for large-scale, security-conscious teams.