GitHub Copilot ships a local sandbox for agent commands and lets its CLI pick models from Ollama

Local sandboxing is GitHub's answer to the question of what an agent may touch when it runs a shell command on your machine. The feature is built on Microsoft eXecution Container (MXC), which translates one sandbox policy into the native controls of Windows, macOS, and Linux. The policy applies to tool execution regardless of which model is driving the session, and an enterprise can enforce settings that a developer cannot weaken.

What the sandbox restricts, and what it does not

The policy decides which paths a process may read or modify, whether it reaches the internet or the local network, whether it can see Git and GitHub CLI credentials, and whether local MCP servers and language servers run inside the sandbox. Remote servers are never sandboxed. On macOS the backend is Seatbelt and the system keychain can be withheld; macOS 15 or later is required. Linux needs bubblewrap, slirp4netns, util-linux, and iptables. Windows 11 is supported with recent updates, and the feature set varies by build.

GitHub's documentation is explicit about the limits. The sandbox is not a virtual machine or a container. The CLI's built-in file tools run in-process, so OS-level isolation cannot constrain them. On Windows, network enforcement relies on applications honoring proxy settings, which GitHub calls weaker protection than on macOS and Linux.

• Off by default: until it is enabled, shell commands run with the full access of your user account.
• Enable it per session in the CLI with /sandbox enable; in the Copilot app, project settings set the default for new sessions.
• Organizations can require the sandbox and enforce its configuration through server-managed, MDM-managed, or file-based managed settings.
• If a policy mandates the sandbox on a system that does not support it, operations fail rather than run unprotected.

Local models from Ollama, with two caveats

Starting with Copilot CLI 1.0.94, the /model command lists models served by a running Ollama instance next to the configured cloud models. You can add one for the current session or add it without switching, and you do not have to restart the CLI. The flow installs nothing and downloads nothing: Ollama and the model must already be there, and the model must support tool calling and streaming.

Picking a local model does not put the CLI into offline mode. That requires COPILOT_OFFLINE=true, and even then GitHub warns that a remote provider configured in the session can still receive prompts and code context over the network.

Haiku 5.5 on the model list

Claude Haiku 5.5 is available to Copilot Pro, Pro+, Max, Business, and Enterprise users across VS Code, Visual Studio, the CLI, the cloud agent, github.com, mobile, JetBrains, Xcode, and Eclipse, with a gradual rollout. It is billed at the provider's list price under usage-based billing, and Business and Enterprise administrators control it through model policies; under default model enablement it is on unless an administrator has turned the default off.