How to Enable and Configure Copilot Sandboxing in VS Code

To enable sandboxing for GitHub Copilot Agent Host sessions in VS Code, set chat.agent.sandbox.enabled to on on the machine that runs the agent, meet that machine’s operating-system prerequisites, and start a new Agent Host session. Then inspect the session’s effective policy and adjust filesystem, network, and bypass settings to suit the task. Sandboxing is off by default, and turning it on does not automatically block outbound internet access.

What VS Code sandboxing does—and what it does not

VS Code’s Agent Host sandbox adds restrictions to supported terminal operations initiated during a Copilot Agent Host session. Its purpose is to constrain what terminal commands can access, including filesystem locations and network destinations. That can reduce the impact of an unsafe or unexpected command while an agent works on a task.

#	Preview	Product	Price
1		TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones	$14.99	Buy on Amazon
2		Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen...	$17.99	Buy on Amazon
3		New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord	$8.99	Buy on Amazon
4		BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees	$199.99	Buy on Amazon
5		Pokemon FireRed and LeafGreen Strategy Guidebook: Affordable & Unofficial Strategy Guide...	$19.98	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

It is separate from the agent’s permission level. VS Code’s documentation puts it plainly: “Sandboxing is independent of the selected permission level.” An Allow all or Autopilot permission choice does not, by itself, turn off the sandbox. However, if you approve an operation to run outside the sandbox, that operation no longer has the sandbox’s filesystem and network restrictions. A session-wide bypass can affect later terminal commands until sandboxing is turned back on. See VS Code’s Agent Host sandboxing guide and its approvals and permissions guide.

This is a defense-in-depth feature, not a virtual machine, a separate user account, or a standalone security boundary. It does not replace endpoint security or careful review of agent actions. Credentials explicitly provided to a task, developer-tool configuration and caches, permissive allowed paths, broad network access, and unsandboxed fallbacks can all reduce isolation. Built-in and other non-process tools are governed by separate permission checks. VS Code explains these security limitations in its secure AI-assisted development guidance.

#1 Best Overall

Sale

TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones

• [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
• [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
• [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
• [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
• [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

$14.99

Buy on Amazon

Check the machine that runs the Agent Host

Sandboxing depends on the execution host: the operating system, installed dependencies, effective settings, and filesystem of the machine running the agent. In a remote setup, enabling the feature or installing a dependency only on your local VS Code client may not enable sandboxing on the remote host. Confirm where the Agent Host runs before changing settings.

For Debian or Ubuntu Linux, the VS Code guide gives this installation command:

sudo apt-get install bubblewrap socat

For Fedora, it gives:

sudo dnf install bubblewrap socat

Run the appropriate command on the Linux execution host, not just on the client if the agent runs remotely. On Windows, check the execution host’s Windows version and install the matching update before enabling the feature. The Windows support status and update identifiers are documented in the VS Code 1.141 release notes and the Agent Host sandboxing guide.

If a required dependency is missing, VS Code reports the issue rather than silently running the command without a sandbox. Follow the notification to install the missing dependency, then try again.

Enable sandboxing for new Agent Host sessions

1. Open settings for the execution host. Use the settings that apply to the machine running the Agent Host. If the host is remote, make the change in the remote host’s effective settings rather than assuming a client-side setting will apply.
2. Set the unified Agent Host setting. Add or change this entry in the applicable settings JSON:

   {
     "chat.agent.sandbox.enabled": "on"
   }

   The setting accepts on or off and defaults to off.

3. Start a new Agent Host session. New sessions inherit the effective settings of their execution host. Do not assume changing a host setting retroactively updates an already-running session.
4. Inspect the effective sandbox policy. Check the session’s Permissions menu and the effective sandbox policy before trusting the session with a task. Confirm that the policy matches the filesystem and network access you intended.

For a one-session change, use Permissions > Sandboxing for terminal. That toggle changes the current Agent Host session; it does not change User or Workspace settings or other sessions. An explicit choice persists when a session is restored, unless organization-managed policy overrides it. The current-session behavior is described in Manage approvals and permissions.

Tune filesystem and network access

Enabling the sandbox is only the starting point. The documented defaults are not the same as maximum restriction: outbound network access is allowed by default, while local-network access is disabled. Review the effective policy against the work the agent needs to do, and tighten access where practical.

Use the filesystem path controls to give a task the minimum access it needs. For example, a task that only edits a project may not need access to unrelated directories. Decide which paths need read/write access, which only need read access, and which should be denied. The setting’s default path lists are empty; do not infer that this means the sandbox has no other effective filesystem policy. Inspect the effective policy for the session.

Rank #2

Sale

Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)

• 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
• 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
• 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
• 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
• 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

$17.99

Buy on Amazon

For network access, decide whether the task needs outbound internet access at all. If it does, consider whether it can work with a narrower set of allowed domains. Keep local-network access off unless the task genuinely needs to reach a device or service on that network. An empty allowed or denied domain list is not evidence that outbound network is blocked: allowNetwork defaults to true.

Other settings can widen access or change which processes are covered. Check these documented controls:

These defaults may be convenient for development workflows, but convenience is a trade-off. Credential access can let sandboxed commands authenticate to services; developer-tool access may expose configuration or caches; and allowing unsandboxed commands creates a route around the sandbox for an approved operation. If your requirements call for tighter isolation, review each control and the effective paths and network policy instead of relying only on the main enable switch. The VS Code feature guide documents the available settings and defaults at Sandbox Copilot Agent Host sessions.

Build a deliberate settings profile

A practical configuration starts by separating the controls that affect every new session from the controls that affect one task. Keep the enable switch in the host settings, then decide whether network, credentials, developer tools, MCP servers, language servers, and unsandboxed commands are appropriate for the work. The following is a planning example using the documented setting names; choose values that match your policy rather than copying it blindly:

{
  "chat.agent.sandbox.enabled": "on",
  "chat.agent.sandbox.network.allowNetwork": true,
  "chat.agent.sandbox.network.allowLocalNetwork": false,
  "chat.agent.sandbox.network.allowedDomains": [],
  "chat.agent.sandbox.network.deniedDomains": [],
  "chat.agent.sandbox.fileSystem.allowDevToolAccess": true,
  "chat.agent.sandbox.mcpServers": true,
  "chat.agent.sandbox.lspServers": true,
  "chat.agent.sandbox.credentials.authenticategit": true,
  "chat.agent.sandbox.credentials.authenticategh": true,
  "chat.agent.sandbox.allowUnsandboxedCommands": true
}

This example mirrors the documented defaults; it is not a high-restriction profile. A stricter profile would normally begin by turning off outbound access when it is unnecessary, leaving local-network access disabled, narrowing allowed domains, reducing configured paths, and disallowing unsandboxed commands where the workflow permits. If a build needs package downloads, you can instead retain outbound access and constrain destinations with the domain lists. If a task does not use Git over HTTPS or gh, consider whether credential access should remain enabled.

Filesystem configuration deserves the same task-by-task treatment. Identify the project directory that must be edited, any separate read-only source tree, and directories that should be denied. Avoid granting broad parent-directory access merely because one child path is needed. After saving settings, inspect the session’s effective policy so you can catch an inherited path or organization-managed value that differs from your intended profile.

Compare common configuration choices

Use these axes—execution host, paths, network, session scope, organization policy, and server coverage—when comparing two setups. A configuration that is appropriate for a disposable test project may be excessive for a production checkout, while a profile that works offline may be too restrictive for dependency installation.

Rank #3

New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord

• [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
• [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
• [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
• [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
• [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

$8.99

Buy on Amazon

Choose host defaults or a one-session override

Use a host setting when you want new sessions on that execution host to inherit the same default. Use the Permissions menu when you need a temporary change for the current session. These controls have different scopes:

• Host or User/Workspace settings: determine effective settings inherited by new sessions, subject to the execution host and any organization-managed policy.
• Permissions > Sandboxing for terminal: changes the current Agent Host session only; it does not edit User or Workspace settings or other sessions.
• Unsandboxed command approval: permits the approved operation to run without the sandbox restrictions. A session-wide bypass can affect later terminal commands until sandboxing is re-enabled.

Approval level and sandbox state answer different questions: approval governs whether an operation may proceed, while sandboxing constrains supported terminal operations. Before confirming an unsandboxed operation, consider whether the command’s purpose requires access beyond the session’s current filesystem or network boundaries. See the approvals documentation for how permission choices interact with agent actions.

Verify the setup with a repeatable checklist

1. Locate the execution host. Write down whether the Agent Host is local, remote, Linux, WSL2, macOS, or Windows. For remote development, treat the remote machine as the place where prerequisites and effective settings must be verified.
2. Verify prerequisites. On Linux or WSL2, confirm that bubblewrap and socat are installed. On Windows, confirm the version and the matching September 8, 2026 update. Do not use WSL 1 for this feature.
3. Confirm the unified setting. Check that chat.agent.sandbox.enabled is on, not an obsolete platform-specific key.
4. Create a fresh session. This ensures the session inherits the current host configuration instead of an earlier effective policy.
5. Open Permissions. Check the “Sandboxing for terminal” state and inspect the effective policy, including paths, network, and relevant process settings.
6. Exercise the intended boundaries. For a project-editing task, verify that the project path is usable and unrelated paths are not unnecessarily exposed. For an offline task, confirm that network access is not broader than intended. For a domain-limited task, check that required destinations are represented in the policy.
7. Review exceptions. If the agent asks for an unsandboxed command, determine whether the request is caused by a missing path, blocked destination, unavailable credential, or a genuinely necessary operation. Fix the narrow policy issue when possible instead of approving a broad bypass.

This checklist distinguishes a configuration problem from an expected policy block. A blocked command can indicate a denied path, insufficient read/write access, a restricted hostname, a disabled local network, or a process such as an MCP server or language server that is not configured for the required workflow.

Verify the setup and troubleshoot common failures

1. Confirm the session type. These instructions apply to Copilot Agent Host sessions. Do not assume settings for Agent Host apply to legacy Local or custom terminal implementations; their behavior may differ.
2. Confirm the execution host and platform. For a remote host, check its OS, installed dependencies, and effective settings—not only the local client.
3. Check the prerequisite appropriate to that host. Linux and WSL2 need bubblewrap and socat; WSL 1 is unsupported. Windows requires the update for its version and remains Experimental. macOS has no additional prerequisite listed in the current guide.
4. Check the setting value. Verify chat.agent.sandbox.enabled is on in the settings that apply to the execution host.
5. Start a fresh session and inspect its policy. New sessions inherit host settings. A session-level toggle may instead reflect an explicit choice for that session, and organization-managed policy can override it.
6. If a command is blocked, identify the boundary involved. Check whether the required path is denied or lacks the needed access, whether the destination is permitted by the network policy, or whether a required developer tool or server is covered by a relevant setting.
7. If a command requests an unsandboxed run, weigh the exception. Approval is not a way to preserve sandbox protections for that operation. Allow it only when the task requires the additional access and you accept the resulting reduction in isolation.

When an OS dependency is missing, VS Code should report that issue rather than silently falling back to an unsandboxed command. Use the notification to address the prerequisite, then re-check the session policy. For additional feature context, see Using tools with agents.

Common pitfalls to avoid

• Changing the client instead of the host. A remote Agent Host uses its own platform, dependencies, settings, and filesystem.
• Expecting the switch to block the internet. allowNetwork is true by default, so explicitly review outbound and domain settings.
• Confusing local and outbound network access. Local-network access defaults to false, but that does not mean all outbound access is disabled.
• Assuming empty path lists mean unrestricted access or no access. They are user-configured path lists; inspect the effective policy and other developer-tool allowances.
• Treating approval as sandboxing. Approving a command and constraining its access are separate decisions. An unsandboxed approval removes the restrictions for that operation.
• Forgetting restored sessions. An explicit session choice can persist when a session is restored, unless an organization-managed policy overrides it.
• Copying obsolete keys. The Windows-specific enable key and platform-specific filesystem keys are removed or ignored for Agent Host, and the old network key is deprecated.
• Assuming all tools share one boundary. Built-in and other non-process tools use separate permission checks; terminal sandboxing is not a universal policy for every agent action.
• Granting convenience access without reviewing its consequences. Developer-tool caches, Git credentials, GitHub CLI credentials, MCP servers, language servers, and unsandboxed fallbacks can all broaden what a task can reach.

Replace stale setting names in older instructions

Use chat.agent.sandbox.enabled as the unified Agent Host enable setting. Older guidance may refer to settings that are no longer appropriate:

• chat.agent.sandbox.enabledWindows was removed and replaced by the unified setting.
• chat.agent.sandbox.allowNetwork is deprecated; use chat.agent.sandbox.network.allowNetwork.
• chat.agent.sandbox.fileSystem.mac, chat.agent.sandbox.fileSystem.linux, and chat.agent.sandbox.fileSystem.windows are deprecated and ignored by Agent Host.

Do not assume that legacy Local or custom terminal implementations honor the current Agent Host settings. Their behavior is a separate matter; verify the documentation for the specific implementation you use.

When to use a stricter profile

Use the narrowest profile that still lets the task finish. An offline refactoring task can keep outbound and local-network access disabled. A dependency-install task may need outbound access but can still use a limited domain list and only the project’s writable path. A release task that pushes through HTTPS Git or gh may require credential settings, while a code-review task may not. A task that launches local MCP or language servers should keep their sandbox controls enabled unless a documented requirement says otherwise.

Rank #4

BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees

• Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
• Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
• All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
• Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
• Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

$199.99

Buy on Amazon

Revisit the profile when the task changes. A setting that was reasonable for downloading dependencies may be unnecessarily broad for editing source files, and a temporary unsandboxed approval should not become the routine way to run ordinary commands. Keep the host default conservative and use the current-session toggle only for a deliberate, documented exception.

Frequently Asked Questions

What setting enables Copilot Agent Host sandboxing?

Set chat.agent.sandbox.enabled to on on the execution host, then start a new Agent Host session. The setting accepts on or off and defaults to off.

Do I need to install anything first?

macOS has no additional prerequisite listed in the current guide. Linux and WSL2 require bubblewrap and socat; WSL 1 is unsupported. Windows support is Experimental and requires the applicable September 8, 2026 update: KB5124008 for Windows 11 24H2 or 25H2, or KB5124012 for Windows 11 26H1.

Why did enabling the setting on my laptop not enable a remote session?

The Agent Host uses the remote execution host’s operating system, dependencies, settings, and filesystem. Install prerequisites and apply the effective setting on that host, then create a new session.

How do I change sandboxing for only one session?

Open the session’s Permissions menu and use Sandboxing for terminal. This changes the current Agent Host session without changing User or Workspace settings or other sessions.

Does Allow all or Autopilot disable the sandbox?

No. VS Code states that “Sandboxing is independent of the selected permission level.” An operation explicitly approved to run outside the sandbox is different: it loses the sandbox’s filesystem and network restrictions.

Is outbound internet blocked by default?

No. chat.agent.sandbox.network.allowNetwork defaults to true. Local-network access defaults to false. Use the network and domain settings to match the task’s actual requirements.

Best Value

Pokemon FireRed and LeafGreen Strategy Guidebook: Affordable & Unofficial Strategy Guide Walkthroughs

$19.98

Buy on Amazon

What does allowing an unsandboxed command do?

chat.agent.sandbox.allowUnsandboxedCommands defaults to true and permits a request to run outside the sandbox after confirmation. The approved operation has no sandbox filesystem or network restrictions, and a session-wide bypass can affect later terminal commands until sandboxing is restored.

Are Git and GitHub CLI credentials available inside the sandbox?

The documented credential settings default to true: authenticategit permits credentials for HTTPS Git commands, and authenticategh permits credentials for gh. Disable or review those settings when authenticated access is not needed.

Are MCP servers and language servers sandboxed?

When sandboxing is enabled, chat.agent.sandbox.mcpServers and chat.agent.sandbox.lspServers default to true, applying sandboxing to locally launched MCP servers and language servers.

What should I do if VS Code reports a missing dependency?

Install the required dependency on the execution host using the notification and the platform-appropriate instructions, then create or retry a session and inspect its effective policy. VS Code reports the issue rather than silently running the command without a sandbox.

Is this a complete security boundary or virtual machine?

No. VS Code describes sandboxing as an additional defense-in-depth layer, not a virtual machine, separate user-account boundary, standalone security boundary, or replacement for endpoint security. Broad paths, network access, credentials, developer-tool caches, and unsandboxed fallbacks can reduce isolation.

Which older settings should I remove?

Use chat.agent.sandbox.enabled instead of enabledWindows. Replace deprecated chat.agent.sandbox.allowNetwork with chat.agent.sandbox.network.allowNetwork. The platform-specific filesystem keys ending in .mac, .linux, and .windows are deprecated and ignored by Agent Host.

The Bottom Line

Enable chat.agent.sandbox.enabled with the value on on the machine that runs Copilot Agent Host, satisfy that host’s prerequisites, and start a fresh session. Then verify the effective policy and deliberately configure paths, outbound and local-network access, domains, credentials, developer tools, MCP and language servers, and unsandboxed-command behavior. Use the Permissions toggle for a one-session change, remember that approval level is separate from sandbox state, and treat sandboxing as defense in depth rather than complete containment.

Quick Recap

SaleBestseller No. 1

TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones

$14.99

SaleBestseller No. 2

Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)

$17.99

Bestseller No. 3

New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord

[Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable

$8.99

Bestseller No. 4

BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees

$199.99

Bestseller No. 5

Pokemon FireRed and LeafGreen Strategy Guidebook: Affordable & Unofficial Strategy Guide Walkthroughs

$19.98

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.