GitHub Copilot: local sandboxing for agents, Ollama in the CLI

A busy week for GitHub Copilot. The headline: since 7 October, local sandboxing is generally available in the Copilot CLI, the Copilot app and VS Code sessions that use Agent Host, according to the changelog. On top come local models in the CLI, Claude Haiku 5.5 and new billing controls for code review.

What the local sandbox does

Commands and tools that Copilot starts on your machine run with restricted access to files, the network, credentials and other system capabilities, following rules that you or your organization set. Underneath is Microsoft eXecution Container (MXC), which turns one sandbox policy into the operating system's own controls on Windows, macOS and Linux.

• Limit which files and folders agent-run commands may read or change.
• Control access to the internet, the local network, Git credentials and GitHub CLI credentials.
• Put local tools and services in the sandbox too, including local MCP and language servers where supported.
• Companies can require the sandbox through managed settings and enforce rules that developers cannot loosen.

The sandbox applies to tool execution whatever model Copilot uses, and it comes with Copilot at no extra cost.

Local models in the Copilot CLI

From CLI version 1.0.94-0, /model also lists models from a running Ollama next to your configured models and GitHub's cloud models. Nothing is added on its own: you pick a model, check its provider and endpoint, and confirm. Ollama and the model have to be installed already, and the model has to support tool calling and streaming.

One sentence in the announcement deserves attention: choosing a local model does not turn on offline mode and does not switch off GitHub's telemetry. Offline mode stays a separate choice through COPILOT_OFFLINE=true. GitHub also warns that prompts and code can still reach a remote model provider in offline mode if you select one.

Also new this week

• Claude Haiku 5.5 is generally available in Copilot since 7 October, for Pro, Pro+, Max, Business and Enterprise, billed at the provider's list price under usage-based billing. More on the model in our Haiku 5.5 post.
• Copilot code review (8 October): by default a review counts against the requesting member's own Copilot allowance and fails when that is used up. Organization owners can now bill these reviews to the organization instead, and decide whether people with external licenses may request a review.
• Copilot app: separate GitHub accounts for your Copilot license and your repositories, for example a license from your employer and repositories in another account.
• VS Code 1.141: agent sessions side by side in a grid, and a cleanup that shows how much disk space inactive session worktrees take.

Our take

The same week, Anthropic and OpenAI published reports about agents working around restrictions (Anthropic, OpenAI). GitHub's local sandbox puts the boundary where it belongs: in the operating system, outside the model, with rules a company can lock. And "a local model is not offline mode" is a sentence every team that wants to keep its code at home should read twice.

In AyCode

AyCode runs neither the Copilot app nor the Copilot CLI. If you have connected GitHub Copilot in OpenCode, AyCode shows its models in the model menu for OpenCode chats. Codex normally uses its own sandbox with approval on request. Writable locations include the project, added context folders, Codex memory and temporary folders; check the configured permissions. AyCode can also discover local Codex models from Ollama or LM Studio without signing in (providers). A chat in its own Git worktree separates branch changes, but is not a security sandbox (parallel agents).