Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCopilot sandboxing in VS Code primarily constrains terminal commands and the child processes they launch. In Copilot Agent Host sessions, it can also cover Agent Host-managed MCP servers and language servers when their sandbox settings are active. Filesystem permissions and network permissions are separate controls, while built-in tools that do not launch operating-system processes use their own approval checks. The effective boundary depends on the session harness, execution host, configuration, credentials, and any approved operation outside the sandbox.
The short answer: what is isolated?
The sandbox is a policy boundary around supported agent operations, not a miniature computer. Its main target is the process tree created for terminal work: a command started by Copilot, plus the child processes that command starts. The policy can restrict which paths those processes can read or write and which network destinations they can reach.
As an Amazon Associate I earn from qualifying purchases.
Agent Host can extend that process boundary to MCP servers and language servers that it launches or manages when the related settings are enabled. This matters because a server may read files, execute helper programs, or make network requests on the agent’s behalf. The exact behavior is documented for the default Copilot SDK tool implementation, not automatically for every VS Code chat harness or custom terminal integration. See the VS Code Agent Host sandboxing guide.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Not every Copilot capability is an operating-system process. Built-in, non-process tools are governed by separate permission checks rather than the terminal process sandbox. Therefore, “sandbox enabled” does not mean that every action in a session has the same technical boundary.
#1 Best Overall
Terminal commands and their child processes
The primary process boundary
When an agent runs a shell command, the command executes on the configured execution host under the host user’s account. Its descendants inherit the process restrictions applied by the Agent Host. A compiler, script, package manager, test runner, or helper utility started by that command is part of the same process tree for sandboxing purposes.
This inheritance is why a sandbox can constrain more than the visible command in a transcript. For example, a build command that invokes a scripting runtime still operates under the sandbox policy, as do tools that the script starts. The boundary follows the covered process, not merely the first executable name.
What the process boundary does not promise
The sandbox does not turn a command into a virtual machine guest, switch it to a separate operating-system account, or provide a complete endpoint-security product. The process remains on the execution host and uses the privileges of the account running the session. VS Code states this directly: “Sandboxing is not a virtual machine or user-account boundary, and it does not replace endpoint security.” Read the full explanation in Understand trust and safety for AI agents.
Filesystem isolation: read-write, read-only, and denied paths
The three path permissions
Agent Host filesystem policy describes paths using three effective states:
- Read-write: the covered process may inspect and change files in the path.
- Read-only: the process may read the path but cannot modify it through the sandboxed operation.
- Denied: access is blocked.
By default, the current working directory is granted read-write access. User-configured path lists can add, narrow, or otherwise adjust that access. The current working directory is not a guarantee that every other directory on the machine is available; paths outside the granted policy may be read-only or denied according to configuration.
Rank #2
Conflicting entries follow a precedence order
A path can match more than one configured rule. In that case, the stricter state wins in this order:
- Denied access takes precedence over read-only.
- Read-only takes precedence over read-write.
- Read-write applies only when no stronger matching rule overrides it.
This ordering prevents a broad writable rule from silently reopening a directory that a narrower rule denies. When diagnosing an unexpected “permission denied” result, inspect every matching path entry rather than looking only for the first read-write rule.
Developer-tool access is a separate decision
Access needed by development tooling is not identical to ordinary project-file access. A separate developer-tool setting may expose tool directories, configuration files, caches, registry tokens, and shared build caches. Those locations can contain credentials or metadata that are outside the simple “workspace is writable” mental model. Treat developer-tool access as an additional capability that must be evaluated on its own.
| Filesystem question | What the policy controls | Important qualification |
|---|---|---|
| Can the agent change project files? | Whether the relevant path is read-write, read-only, or denied. | The current working directory is read-write by default in the documented Agent Host configuration, but user rules can override it. |
| Can it inspect a sensitive directory? | A matching read-only or denied path rule. | Denied outranks read-only, which outranks read-write. |
| Can tooling use caches or registry credentials? | A separate developer-tool access setting. | This may include configuration, caches, tokens, and shared build caches. |
Network isolation is independent from filesystem policy
Filesystem rules do not automatically decide whether a process can connect to the internet. Agent Host has a separate network policy. In the documented defaults, chat.agent.sandbox.network.allowNetwork is true, chat.agent.sandbox.network.allowLocalNetwork is false, and the allowed-domain and denied-domain lists are empty. In practical terms, outbound networking is permitted by default, while local-network access is denied by default.
That default means an enabled sandbox is not automatically an offline mode. A terminal command may be able to contact an external service while being unable to reach devices or services on the local network, depending on the effective policy and host environment. Domain allowlists and denylists can further narrow or block destinations when configured.
| Network control | Documented Agent Host default | How to interpret it |
|---|---|---|
| Outbound network | true |
External network access is allowed unless another policy or host control restricts it. |
| Local network | false |
Connections to local-network resources are denied by default. |
| Allowed domains | Empty list | No explicit domain allowlist is supplied by default. |
| Denied domains | Empty list | No explicit domain denylist is supplied by default. |
These are documented defaults, not a promise that every organization or session has them. User settings, organization policy, the execution host, and a remote-session configuration can change the effective result. For the setting model and current caveats, consult Sandbox Copilot Agent Host sessions.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →MCP servers and language servers
Servers managed by Agent Host
Agent Host can sandbox MCP servers and language servers that it launches or manages when the corresponding server-sandbox settings are active. The VS Code documentation lists those settings as enabled by default when Agent Host sandboxing is enabled. A server covered by that configuration is therefore subject to the relevant process, filesystem, and network policies rather than receiving an unrestricted process environment.
Do not conflate different MCP arrangements
A separately configured local stdio MCP server is a different feature with its own platform support and configuration. The fact that Agent Host can sandbox servers it manages does not establish identical behavior for every locally run stdio server configured elsewhere. Determine which component launches the server before assuming that Agent Host’s boundary applies.
This distinction is especially important when a server has access to project files, credentials, source-control metadata, or external services. The launch path and active settings determine whether those operations are inside the Agent Host sandbox or governed by another mechanism.
Built-in tools and approval checks
Some agent capabilities do not start an operating-system process. Those built-in tools are outside the terminal process sandbox and use their own permission checks. A sandboxed terminal command can therefore remain constrained even when the session’s general permission level is broad, while a non-process operation may still require an approval.
Approvals and sandboxing answer different questions:
- Approval: may this action run automatically, or must a person confirm it?
- Sandbox: assuming the action is covered by the process boundary, which files and network resources can it use?
A confirmation dialog does not expand a sandboxed command’s filesystem or network rights. Conversely, a process sandbox does not replace approval checks for built-in operations that are not covered by it. The distinction and current approval controls are described in Manage approvals and permissions.
What the sandbox does not isolate
The following limits are fundamental, not edge cases:
- The operating-system account: sandboxed processes still run as the account executing the session.
- The whole machine: this is not a virtual machine and does not create a separate kernel or complete guest operating system.
- Credentials already exposed: tokens, registry credentials, configuration, or secrets made available through allowed paths or developer-tool access can still be used by covered processes.
- Every agent operation: built-in non-process tools have separate permission checks.
- Every execution route: an approved fallback outside the sandbox can change where an operation runs and therefore which controls apply.
- Endpoint protection: sandboxing supplements, but does not replace, operating-system hardening, identity controls, network controls, malware protection, or organizational security policy.
VS Code’s security guidance explains these boundaries in Understand trust and safety for AI agents and Secure AI-assisted development in VS Code.
Local versus remote Agent Host sessions
The policy applies on the execution host, not necessarily on the computer displaying the VS Code interface. In a connected remote Agent Host session, paths, defaults, credentials, network routes, and platform behavior refer to the remote host. A project that appears in a local editor may therefore be operated on a remote machine with a different filesystem layout and different network policy.
Before evaluating isolation, identify where the Agent Host process actually runs. A rule that protects a local home directory does not describe a remote host’s home directory, and a local network restriction does not automatically describe the remote environment’s network.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Harness and version caveats
Agent Host is not every VS Code chat harness
The detailed settings and defaults in the Agent Host guide apply to the default Copilot SDK tool implementation. They do not establish identical behavior for the Local chat harness or a custom terminal override. If a session uses a different harness, consult that harness’s documentation and inspect its own process-launch and permission behavior.
Platform availability can change
The current Agent Host guide lists macOS, Linux/WSL2, and Windows prerequisites and identifies Windows support as experimental. Platform support, prerequisites, and defaults can change, so verify the official guide when setting up a new environment. The Visual Studio Code 1.141 release notes also describe sandboxing as limiting supported agent operations’ access to files and network resources and state that locally launched MCP and language servers are sandboxed by default when sandboxing is enabled.
Free tools Windows power users keep installed
One-click scans. No signup required.
A practical method for determining the effective boundary
When a command succeeds or fails unexpectedly, use this sequence instead of assuming that “sandbox on” explains everything:
- Identify the harness. Confirm that the session is using Agent Host and not the Local chat harness or a custom terminal override.
- Identify the execution host. Establish whether the process runs locally, in WSL2, or on a connected remote host. Use that host’s paths, account, credentials, and network topology for the analysis.
- Classify the operation. Decide whether it is a terminal process, an Agent Host-managed MCP or language server, or a built-in non-process tool.
- Map filesystem rules. Check the path’s effective state—read-write, read-only, or denied—and apply the precedence order when multiple entries match.
- Check developer-tool access. Determine whether configuration, caches, registry tokens, shared build caches, or tool directories were separately exposed.
- Check network rules. Evaluate outbound access, local-network access, and any allowed or denied domain entries independently of filesystem permissions.
- Review approvals and fallback behavior. A confirmation requirement is not a filesystem grant. If the operation is approved to run outside the sandbox, reassess it under the outside execution path.
- Account for credentials. A process can use credentials that are present in its environment or accessible through permitted files; sandboxing does not magically revoke secrets that were deliberately exposed.
This checklist separates the controls that are often incorrectly treated as one setting.
Common scenarios and what they mean
| Observed behavior | Likely policy explanation |
|---|---|
| A build can edit files in the workspace but cannot change a protected directory. | The workspace is read-write, while a matching denied or read-only rule has higher precedence for the protected path. |
| A command can download a package but cannot contact a device on the local network. | Outbound network is allowed while local-network access remains denied by the documented default. |
| A language server behaves differently from a shell command. | Its server-sandbox setting, launch path, or harness may differ from the terminal process configuration. |
| A confirmation appears even though the terminal is sandboxed. | The action may be a built-in non-process tool governed by approval checks, or the approval policy may apply independently. |
| A path visible in the editor is unavailable to the command. | The process may be running on a remote host, or the path may be outside the effective filesystem grants. |
| A command accesses a cache or registry without changing project files. | Separate developer-tool access may have exposed that cache or credential location. |
Why the distinction matters for security
Sandboxing reduces the resources available to covered processes, but its protection depends on policy quality and scope. A broad writable path, exposed token directory, unrestricted external network, or approved outside-sandbox fallback can materially widen what an agent can do. Conversely, a denied path or blocked local network may stop an operation even when the command itself was allowed to start.
Use the sandbox as one layer in a defense-in-depth design. Keep sensitive credentials out of paths that agent processes do not need, limit developer-tool access where practical, define network policy deliberately, and treat remote execution hosts as independent security environments. Continue to use endpoint security and account-level controls because the sandbox is not an account boundary or a replacement for them.
Recommended Free Tools
The bottom line on Copilot sandboxing
In VS Code’s Copilot Agent Host, the core isolation boundary covers terminal commands and their child processes, with configurable filesystem and network policies. Agent Host-managed MCP and language servers can join that boundary when their settings are active. Outbound network access is allowed by the documented default, local-network access is denied by default, and built-in non-process tools follow separate approval checks. The sandbox is useful process containment, but it is not a VM, separate user account, universal tool boundary, or substitute for endpoint security.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
