PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteGitHub Copilot sandboxing is generally available in VS Code sessions that use Agent Host, following GitHub’s October 7, 2026 announcement. To enable it, set chat.agent.sandbox.enabled to on, meet the execution host’s platform prerequisites, start a new Agent Host session, then run /sandbox policy to check what the session actually enforces. The feature limits access for covered processes; it does not isolate every agent tool or block outbound internet access by default.
What changed—and which VS Code sessions are covered?
GitHub announced local sandboxing as generally available on October 7, 2026, including for VS Code sessions using Agent Host. GitHub says Microsoft eXecution Container (MXC) translates a common policy into native operating-system controls on Windows, macOS, and Linux, and that the feature is included with GitHub Copilot at no additional cost. The announcement does not establish that every VS Code agent or terminal implementation uses this sandbox. GitHub’s announcement
Execution host matters: Agent Host settings, prerequisites, and paths apply on the machine where the agent runs. If the session uses a connected remote host, configure that host—not just the computer displaying VS Code.
How to enable sandboxing in Agent Host
- Check the execution host’s prerequisites. macOS has no prerequisite listed in the VS Code guide. Linux and WSL2 require
bubblewrapandsocat. WSL1 is unsupported because it lacks kernel features required by bubblewrap. Windows support is labeled experimental and requires the applicable September 8, 2026 security update: KB5124008 for Windows 11 24H2/25H2, or KB5124012 for Windows 11 26H1. Follow the guide’s package instructions for Linux and WSL2. VS Code’s Agent Host sandbox guide - Enable the setting. In VS Code settings on the execution host, set
chat.agent.sandbox.enabledtoon. The setting acceptsofforonand defaults tooff. - Start a new Agent Host session. The documented setup sequence calls for a new session after enabling the setting. Alternatively, a session’s Permissions menu has a sandbox toggle; changing it affects that session, not user or workspace settings for other sessions.
- Inspect the effective policy. Run
/sandbox policyin the session. It reports the execution host, whether sandboxing is enabled, the operating-system implementation, and effective filesystem and network policy. It does not start a model turn or change settings.
What the sandbox restricts
Sandboxing applies policy-based limits to file, network, credential, and other system access for covered agent-initiated tools and commands. In VS Code, its precise coverage depends on the session and tool implementation:
#1 Best Overall
- Brilliant LCD Display – The 13" PixelSense touchscreen[1], with LCD and enriched HDR[2] tech, unveils crisper whites, darker blacks, and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Up to 15.5hours of battery life[3] - The new Surface Pro is designed for long days, late nights and everything in between.
- Productivity. All Day. Every Day. – Built with the latest Qualcomm Snapdragon X2 Plus (10 Core) processors, Surface Pro delivers fast, responsive performance with built-in AI acceleration—so you can handle everything from everyday tasks to demanding workloads with ease.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
- Local sessions: terminal commands and their child processes are sandboxed.
- Agent Host sessions: shell execution and child processes are primarily confined. Agent Host-launched MCP and language servers can also be sandboxed when the related settings are enabled.
- Built-in and other non-process tools: these are outside the process sandbox and rely on separate permission checks.
The Agent Host settings allow customization of writable, read-only, and denied paths; network destinations; and whether locally launched MCP and language servers are sandboxed. The default working directory is writable. A development-tool access setting can grant access to tool directories, configuration, and caches, so do not assume sensitive developer state is automatically denied. Check the effective policy for the session you are using. VS Code’s sandbox setup and policy guide
Sandboxing is not the same as approval
Approval settings determine whether an action runs automatically or waits for confirmation. Sandboxing constrains covered processes’ filesystem and network access. These controls are independent: the sandbox can still restrict terminal processes when permissions are permissive, including Allow all or Autopilot. For how VS Code handles action approvals, see Manage approvals and permissions.
Rank #2
- Brilliant OLED Display – Incredible image quality – The 13" PixelSense touchscreen[1], with optional OLED and HDR[2] tech, gives you sharp detail, smooth scrolling, and colors so richly saturated bringing vivid life into every frame - perfect for work, school, streaming, and creative tasks.
- Up to 15.5 hours of battery life[3] - The new Surface Pro is designed for long days, late nights and everything in between.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Pro delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
Limits to understand before relying on it
- Outbound internet access is not blocked by default. Domain filtering varies by terminal implementation and platform; do not treat enabling the sandbox as an automatic network-deny rule.
- Coverage is not universal. Built-in non-process tools use separate permission checks, and MCP or language-server coverage depends on the session and related settings.
- Policy choices affect isolation. Explicitly injected credentials, allowed paths, local or unrestricted networking, unsandboxed fallback, and bypass can weaken restrictions.
- It is not a separate security boundary. VS Code states: “Agent sandboxing is an added layer for the processes it covers. It is not a virtual machine or user-account boundary, a standalone security boundary, or a replacement for endpoint security.” Understand trust and safety for AI agents
Availability and platform qualifications
The general-availability announcement names Windows, macOS, and Linux, but the VS Code Agent Host guide adds platform-specific prerequisites and labels Windows support experimental. The sources do not separately specify geographic rollout or establish enterprise entitlement beyond the announcement’s stated availability and inclusion with GitHub Copilot.
Quick Recap
Best Value
- Brilliant LCD Display – The 13" PixelSense touchscreen[1], with LCD and enriched HDR[2] tech, unveils crisper whites, darker blacks, and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Up to 15.5hours of battery life[3] - The new Surface Pro is designed for long days, late nights and everything in between.
- Productivity. All Day. Every Day. – Built with the latest Qualcomm Snapdragon X2 Plus (10 Core) processors, Surface Pro delivers fast, responsive performance with built-in AI acceleration—so you can handle everything from everyday tasks to demanding workloads with ease.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
Rank #4
- AI-enhanced Surface Studio Camera: The ultra-wide front facing camera paired with AI-powered Studio effects like automatic framing keeps you, or the whole family in focus
- Snapdragon X Plus (10 core) processor: Experience unparalleled productivity in ultra-portable laptop designs, with battery life that lasts for days
- Immersive Visuals: The 13" PixelSense Flow display offers stunning clarity with 2880 x 1920 resolution and a near edge-to-edge design. With a 1200:1 contrast ratio and up to 120Hz dynamic refresh rate, enjoy vibrant colors and ultra-smooth, responsive touch for an elevated viewing and work experience
- Surface Slim Pen: Stores and recharges in the premium keyboard designed to be used either attached to your Pro for the ultimate laptop set-up or detached as a standalone keyboard for a new level of flexibility
- Instant Copilot: Unlock new possibilities with the dedicated Copilot key, which gives you instant access to experiences that can enhance your productivity
Rank #3
- [This is a Copilot+ PC] — The fastest, most intelligent Windows PC ever, with built-in AI tools that help you write, summarize, and multitask — all while keeping your data and privacy secure.
- [The Power of a Laptop, the Flexibility of a Tablet] — Surface Pro 12” is a 2-in-1 device that adapts to you. Use it as a tablet for on-the-go tasks, prop it up with the built-in kickstand, or attach the Surface Pro Keyboard (sold separately) to turn it into a full laptop.
- [Incredibly Fast and Intelligent] — Powered by the latest Snapdragon X Plus processor and an AI engine that delivers up to 45 trillion operations per second — for smooth, responsive, and smarter performance.
- [All Day Battery Life] — Up to 16 hours of battery life[1] means you can work, stream, and create wherever the day takes you — without reaching for a charger.
- [Brilliant 12” Touchscreen Display] — The PixelSense display delivers vibrant color and crisp detail in a sleek design — perfect for work, entertainment, or both.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
