iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To enable terminal sandboxing for GitHub Copilot Agent Host sessions in VS Code, set chat.agent.sandbox.enabled to "on" on the machine that runs the agent, satisfy that machine’s operating-system prerequisites, start a new Agent Host session, and check the effective sandbox policy. Sandboxing is off by default, and turning it on does not automatically make network access or filesystem access maximally restrictive. VS Code’s Agent Host sandbox guide documents the setting and its controls.
What Copilot sandboxing does—and what it does not do
VS Code’s Agent Host sandboxing applies restrictions to supported terminal operations initiated during an agent session. It lets you limit filesystem access and network destinations while an agent works. The effective policy depends on the settings and environment of the host that executes the agent, not just on the VS Code window you are looking at.
Sandboxing is separate from the approval level you choose for the session. VS Code’s documentation states: “Sandboxing is independent of the selected permission level.” An Allow all or Autopilot permission level does not, by itself, remove the sandbox restrictions from supported terminal operations. But if you approve an operation to run outside the sandbox, that operation loses the sandbox’s filesystem and network restrictions; a session-wide bypass can also leave later terminal commands unsandboxed until you turn sandboxing back on. See Manage approvals and permissions for how permissions and approvals work.
This is a defense-in-depth feature, not a virtual machine, a separate user-account boundary, a standalone security boundary, or a replacement for endpoint security. The protections you get depend on the policy you configure and on the tools being used. Built-in and other non-process tools are governed by separate permission checks. VS Code explains these limits in its guide to secure AI-assisted development.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Check the machine that will run the agent
Before changing settings, identify where the Agent Host actually executes. A local session uses the local machine; a remote Agent Host uses the remote host’s operating system, dependencies, settings, and filesystem. Installing a dependency or changing a setting only on the VS Code client will not enable sandboxing on a remote execution host.
Check that host’s platform and prerequisites first. The current VS Code guidance lists no additional prerequisite for macOS. Linux and WSL2 require bubblewrap and socat. WSL 1 is unsupported because it lacks kernel features required by bubblewrap. Windows support is Experimental and requires the applicable September 8, 2026 security update for the host’s Windows release.
| Execution host | Prerequisite | What to do |
|---|---|---|
| macOS | No additional prerequisite is listed in the current Agent Host guide. | Proceed to enable the setting on the host used by the agent. |
| Debian or Ubuntu Linux | bubblewrap and socat |
Run sudo apt-get install bubblewrap socat on the execution host. |
| Fedora Linux | bubblewrap and socat |
Run sudo dnf install bubblewrap socat on the execution host. |
| WSL2 | bubblewrap and socat |
Install both in the WSL2 environment that runs the agent. WSL 1 is unsupported. |
| Windows | Experimental support; required Windows security update varies by release. | For Windows 11 24H2 or 25H2, install KB5124008. For Windows 11 26H1, install KB5124012. Confirm the execution host’s Windows version before enabling. |
The platform requirements and Windows update identifiers are from the Agent Host sandbox guide and VS Code 1.141 release notes. If a required dependency is missing, VS Code reports the problem rather than silently running the command without a sandbox. Follow the notification to install the dependency on the execution host.
Enable sandboxing for new Agent Host sessions
- Open settings for the execution host. If the agent runs remotely, make the change in the remote host’s settings, not only in the local client’s settings. VS Code’s sandbox guide explains the host-specific behavior.
- Set the unified Agent Host setting. In the appropriate User or host settings JSON, add or update this property:
{ "chat.agent.sandbox.enabled": "on" } - Save the setting and satisfy platform prerequisites. Install any required Linux/WSL2 packages or Windows update on the execution host, as applicable.
- Start a new Agent Host session. New sessions inherit the effective settings for their execution host. Do not assume that a setting change retroactively changes a session already running.
- Inspect the effective sandbox policy. Check the session’s effective policy before relying on it, especially if organization-managed policy or host-specific settings could affect the result.
The setting accepts "on" or "off"; it defaults to "off". An explicit choice persists when a session is restored unless an organization-managed policy overrides it. The authoritative setting reference is in Sandbox Copilot Agent Host sessions.
Change sandboxing for the current session
For a temporary session-specific change, use the session’s Permissions menu and select Sandboxing for terminal. This changes the state for the current Agent Host session; it does not rewrite User or Workspace settings and does not change other sessions. A restored session retains an explicit choice unless organization-managed policy overrides it.
This is useful when one task needs a different terminal policy from the default. For example, you may keep the host default enabled and temporarily turn sandboxing off for a particular operation that cannot run within the configured boundary. Treat that as a deliberate exception: an operation approved to run outside the sandbox is not protected by its filesystem and network restrictions. The session and approval behavior is described in the permissions guide.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Think of the setting and the menu as two scopes, not interchangeable ways to edit one global switch. Use the host setting when you want new sessions to inherit a default; use the Permissions control when you intend to change only the current session. If you restore that session later, its explicit choice persists unless managed policy takes precedence. When checking behavior across multiple sessions, verify each session rather than assuming a change in one has propagated to the others.
Configure filesystem and network access deliberately
Enabling the sandbox is only the first decision. The documented defaults permit outbound network access, while local-network access is disabled. Path lists and domain lists start empty. Review these controls against what the task actually needs instead of assuming that enabling sandboxing creates a deny-by-default policy.
| Setting | Documented default | What it controls |
|---|---|---|
chat.agent.sandbox.network.allowNetwork |
true |
Allows outbound network access, still subject to configured hostname restrictions. |
chat.agent.sandbox.network.allowLocalNetwork |
false |
Controls access to the local network. |
chat.agent.sandbox.network.allowedDomains |
Empty list | Configures allowed destination domains. |
chat.agent.sandbox.network.deniedDomains |
Empty list | Configures denied destination domains. |
chat.agent.sandbox.fileSystem.userConfiguredPaths |
Empty path lists | Configures paths for read/write access, read-only access, and denial. |
chat.agent.sandbox.fileSystem.allowDevToolAccess |
true |
Allows access to common developer tools, configuration, and caches. |
chat.agent.sandbox.mcpServers and chat.agent.sandbox.lspServers |
true |
Applies sandboxing to locally launched MCP servers and language servers when sandboxing is enabled. |
chat.agent.sandbox.credentials.authenticategit and chat.agent.sandbox.credentials.authenticategh |
true |
Permits use of credentials for HTTPS Git and gh commands inside the sandbox. |
chat.agent.sandbox.allowUnsandboxedCommands |
true |
Allows a request to run a command outside the sandbox after confirmation. |
These setting names and defaults are documented in VS Code’s sandbox settings reference. The guide documents the controls, but the exact path or domain values you need depend on your machine and task. Use the setting’s supported value format in VS Code rather than guessing at a JSON structure.
Plan filesystem access around the task
Use the filesystem path controls to decide which locations the agent may read and write, which it may read but not modify, and which it must not access. A project task commonly needs access to the project files; it does not automatically need write access to every location on the host. Include only the locations required for the work, and inspect the effective policy for inherited or organization-managed settings.
Also account for the developer-tool exception. With chat.agent.sandbox.fileSystem.allowDevToolAccess enabled by default, common developer tools, their configuration, and caches may be accessible. That can be useful for normal development workflows, but it is not the same as restricting the agent to project files alone. Decide whether that broader access is appropriate for your threat model.
For a task that only edits a project, consider the project’s needed access separately from access to tool configuration and caches. For a task that installs dependencies or consults remote services, examine network requirements as well as file access. These are separate choices: a project may need writable source files without needing local-network access, or it may need outbound downloads without needing broad write access elsewhere on the host. The useful policy is the one that fits the task’s actual inputs and outputs, not simply the one with the most permissive defaults.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Choose network access intentionally
With chat.agent.sandbox.network.allowNetwork at its documented default of true, sandboxed terminal operations can make outbound network requests, subject to configured hostname restrictions. If a task needs package downloads or remote APIs, decide which destinations are necessary and use the allowed- and denied-domain controls accordingly. Do not interpret an empty domain list as proof that outbound access is blocked.
Local-network access is separately controlled and defaults to false. Keep that distinction in mind: access to public destinations and access to machines or services on a local network are not the same policy decision. Enable local-network access only if the task requires it and you accept the additional exposure.
When evaluating a connection problem, first determine whether the destination is an outbound public hostname or a service on the local network. Then check the relevant control and any configured domain restrictions. A request succeeding is not by itself evidence that sandboxing is off: outbound access is allowed by default. Conversely, a task that needs a local service may require a deliberate change to the separate local-network setting.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Decide whether credentials and helper servers belong inside the sandbox
The defaults permit credentials for HTTPS Git and gh commands inside the sandbox. If the agent can use a signed-in account, those credentials affect what operations the commands may perform; sandboxing does not make credential access irrelevant. Consider the account’s scope and whether authentication is needed for the task.
Locally launched MCP servers and language servers are sandboxed when the relevant controls remain enabled and sandboxing is on. That is distinct from built-in or other non-process tools, which are subject to separate permission checks. Confirm the behavior of the tool type you are using instead of assuming every agent action is a sandboxed terminal process.
For a troubleshooting comparison, ask whether an action is a supported terminal process, a locally launched MCP or language server, or a built-in/non-process tool. The documented MCP and LSP controls apply to locally launched servers; separate permission checks govern built-in and other non-process tools. A sandbox setting for terminal commands should not be treated as a blanket policy for every tool an agent can use.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Understand approvals, bypasses, and the actual boundary
Approval level and sandbox policy answer different questions. Approval settings determine when the agent must ask before taking actions; sandbox settings constrain supported terminal operations. A permissive approval level does not automatically turn off sandboxing, but approval to run a command outside the sandbox removes those restrictions for that command.
Free tools Windows power users keep installed
One-click scans. No signup required.
The default chat.agent.sandbox.allowUnsandboxedCommands value is true, so a request can be made to run a command outside the sandbox after confirmation. If your policy requires terminal operations to remain sandboxed, review this control and the organization-managed policy that may apply. Be alert to session-wide bypasses: later terminal commands can remain outside the sandbox until sandboxing is turned on again.
Isolation can also be reduced by explicit credential access, broad allowed paths, developer-tool configuration and caches, unrestricted outbound network access, local-network access, or an unsandboxed fallback. Treat the sandbox as one layer in a larger security posture, not as containment for every tool or as a guarantee that an agent cannot affect anything outside a project.
When an approval prompt offers an unsandboxed route, distinguish that exception from simply granting a higher permission level. The first changes whether the operation is constrained by the sandbox; the second is an approval decision and does not itself remove the sandbox. If you do allow a bypass, consider what filesystem and network restrictions the command will no longer have, then check whether the session needs sandboxing turned back on before the next terminal operation.
Troubleshoot when sandboxing does not take effect
- The sandbox setting appears enabled, but the host reports a dependency problem. Check the execution host, not just the VS Code client. Install
bubblewrapandsocaton Linux or WSL2, or install the required Windows update for the host’s release. VS Code reports missing prerequisites rather than silently dropping the sandbox. - You are using WSL. Verify that the Agent Host runs in WSL2. WSL 1 is unsupported for this feature because it lacks required kernel capabilities.
- You changed settings but the current session behaves the same. The host setting is inherited by new sessions. Start a new Agent Host session, or use Permissions > Sandboxing for terminal to change the current session specifically.
- The remote session is not using the local machine’s policy. Configure and inspect the settings and prerequisites on the remote execution host. The client and host do not share a single effective environment.
- A network request succeeds despite sandboxing being on. Outbound access is allowed by default. Review
allowNetworkand the allowed- and denied-domain settings; check local-network access separately. - A command runs outside the sandbox after a prompt. An approved unsandboxed operation is an exception to the sandbox restrictions. Review the approval choice and
allowUnsandboxedCommands, and restore sandboxing for the session if it was bypassed. - A legacy setting has no effect. Use the unified Agent Host setting and the current nested network and filesystem controls described below; older Agent Host settings may be removed, deprecated, or ignored.
Replace stale sandbox settings
Older instructions may refer to platform-specific or pre-unification settings. For Agent Host, use chat.agent.sandbox.enabled rather than the removed Windows-specific chat.agent.sandbox.enabledWindows. Replace the deprecated chat.agent.sandbox.allowNetwork with chat.agent.sandbox.network.allowNetwork.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe platform-specific filesystem settings chat.agent.sandbox.fileSystem.mac, chat.agent.sandbox.fileSystem.linux, and chat.agent.sandbox.fileSystem.windows are deprecated and ignored by Agent Host. Use the current filesystem controls instead. Legacy Local and custom terminal implementations may behave differently, so Agent Host settings should not be treated as a guarantee about those implementations. See the current sandbox documentation for the settings that apply to Agent Host sessions.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Configuration checklist
- Identify the machine and operating system that execute the Agent Host.
- Meet its prerequisites: no additional prerequisite is listed for macOS; install
bubblewrapandsocatfor Linux or WSL2; on Windows, install the applicable update for the host’s version. - Set
chat.agent.sandbox.enabledto"on"in the execution host’s effective settings. - Start a new session or deliberately change the current session through Permissions > Sandboxing for terminal.
- Check the effective policy, including filesystem paths, outbound and local-network access, credentials, developer-tool access, MCP/LSP behavior, and unsandboxed-command fallback.
- Keep the approval model and sandbox policy distinct, and treat any approved unsandboxed command as outside the sandbox boundary.
For additional context on what agents do when they use tools, see VS Code’s guide to using tools with agents.
Frequently Asked Questions
How do I enable sandboxing for Copilot Agent Host sessions in VS Code?
Set chat.agent.sandbox.enabled to "on" in the settings for the machine that executes the Agent Host, meet that host’s platform prerequisites, and start a new session. Then inspect the effective sandbox policy. The setting defaults to "off".
Can I change sandboxing for just one Agent Host session?
Yes. Open the session’s Permissions menu and use Sandboxing for terminal. This changes the current session only; it does not update User or Workspace settings or other sessions. An explicit choice persists when the session is restored unless organization-managed policy overrides it.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDoes Allow all or Autopilot turn off the sandbox?
No. Approval level and sandboxing are separate. Supported terminal operations remain subject to the sandbox, but a command approved to run outside it loses the sandbox’s filesystem and network restrictions. A session-wide bypass can affect later terminal commands until sandboxing is turned on again.
Why can a sandboxed command still access the internet?
Outbound network access is allowed by default through chat.agent.sandbox.network.allowNetwork. Review that setting and the allowed- and denied-domain controls. Local-network access is a separate setting and defaults to false; an empty domain list does not mean outbound access is blocked.
What do I need to install for sandboxing on Linux or Windows?
Linux and WSL2 require bubblewrap and socat; Debian/Ubuntu can use sudo apt-get install bubblewrap socat, and Fedora can use sudo dnf install bubblewrap socat. WSL 1 is unsupported. Windows support is Experimental: Windows 11 24H2 or 25H2 requires KB5124008, while 26H1 requires KB5124012.
Does the local VS Code client’s setting apply to a remote Agent Host?
Not necessarily. A remote Agent Host uses its own operating system, dependencies, settings, and filesystem. Install prerequisites and configure the setting on the remote execution host, then inspect that session’s effective policy.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Are all Copilot tools covered by terminal sandboxing?
No. The sandbox applies to supported terminal operations, and the MCP and LSP settings apply to locally launched servers when enabled. Built-in and other non-process tools are governed by separate permission checks.
The Bottom Line
Enable chat.agent.sandbox.enabled on the Agent Host execution machine, satisfy its platform prerequisites, and verify a new session’s effective policy. Then tune filesystem paths, network destinations, credentials, helper-server access, and unsandboxed-command behavior for the task. Sandboxing adds a useful layer of protection, but it is not complete containment; keep approval choices, exceptions, and the tools outside its scope in view.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
