iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Start with chat.agent.sandbox.enabled on the machine that actually runs the Copilot Agent Host, then narrow network, filesystem, credential, and fallback access to what the task requires. The setting is off by default. Enabling it does not make every Copilot action isolated: approval controls remain separate, built-in read/edit/write tools use VS Code permissions, and a sandbox is not a virtual machine or a separate user account.
Before changing anything, identify the execution host. A remote Agent Host applies its policy on the remote machine, even when the VS Code window is local. After changing host-level settings, start a new Agent Host session and inspect the effective policy shown for that session.
The settings to change first
For a normal Agent Host workflow, change settings in this order:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Enable
chat.agent.sandbox.enabled. - Decide whether the task needs outbound internet access with
chat.agent.sandbox.network.allowNetwork. - Keep
chat.agent.sandbox.network.allowLocalNetworkdisabled unless a private or local service is required. - Use destination allow lists and the narrowest filesystem paths that still let the task succeed.
- Disable developer-tool access, Git credentials, GitHub credentials, or unsandboxed fallback when they are not needed.
- Leave unfamiliar repositories in Restricted Mode until you have inspected them.
These controls belong to the current Copilot Agent Host. They do not configure the legacy Local chat harness or a custom terminal override.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
What each Agent Host sandbox setting does
| Setting or control | Documented default | Change it when | Practical effect |
|---|---|---|---|
chat.agent.sandbox.enabled |
false |
Terminal commands should run with OS-enforced restrictions. | Turns on the unified Agent Host terminal sandbox. Configure it on the execution host and start a new session. |
chat.agent.sandbox.network.allowNetwork |
true |
The task can run offline, or you need to reduce outbound exposure. | Controls outbound network access, subject to destination restrictions. |
chat.agent.sandbox.network.allowLocalNetwork |
false |
The task must reach a printer, database, service, or other private-network host. | Separately controls access to hosts on the local network. |
chat.agent.sandbox.network.allowedDomains |
Empty | Only named internet destinations are needed. | Provides an allow list for outbound destinations when network access is enabled. |
chat.agent.sandbox.network.deniedDomains |
Empty | A destination must be blocked even while general network access remains enabled. | Blocks listed destinations. Check how the effective policy resolves overlapping rules. |
chat.agent.sandbox.fileSystem.userConfiguredPaths |
Empty user lists | The task needs files outside its normal workspace scope, or you want explicit read-only or denied paths. | Holds custom read/write, read-only, and denied path rules. |
chat.agent.sandbox.fileSystem.allowDevToolAccess |
true |
The task does not need common developer tools, configuration, or caches. | Controls exposure to those developer resources; disabling it can affect normal build workflows. |
chat.agent.sandbox.credentials.authenticategit |
true |
No Git operation needs your account. | Makes Git credentials available to sandboxed processes when enabled. |
chat.agent.sandbox.credentials.authenticategh |
true |
No GitHub operation needs your account. | Makes GitHub credentials available to sandboxed processes when enabled. |
chat.agent.sandbox.allowUnsandboxedCommands |
true |
Every command must remain inside the sandbox. | Controls whether a confirmed command or session may fall back outside sandbox restrictions. |
Defaults are documented defaults, not a guarantee that an organization policy or a particular session has the same effective values. Managed settings can override user settings, so verify the policy presented by the active Agent Host.
How to enable the sandbox safely
1. Identify the execution host
Determine whether Copilot is running the Agent Host on your local desktop, a Linux or Windows subsystem, a remote development machine, or another connected host. Install prerequisites and inspect settings on that host. Changing a local client setting does not necessarily change a remote Agent Host.
2. Open the settings editor
- Open VS Code Settings with
Ctrl+,on Windows/Linux orCmd+,on macOS. - Search for
chat.agent.sandbox.enabled. - Turn the setting on for the scope that applies to the Agent Host. If your organization manages the setting, use the effective value supplied by the organization.
- Start a new Agent Host session. Host-level changes are not something to assume will retrofit an already-running session.
3. Inspect the effective policy
Before asking the agent to modify a repository, review the session’s effective sandbox policy. Confirm the execution host, network state, allowed and denied destinations, filesystem paths, credential exposure, and unsandboxed-command behavior. If the effective policy differs from your user setting, look for a remote or managed configuration rather than repeatedly changing the local setting.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Choose the smallest network boundary
Offline work
For refactoring, local documentation, test execution, or other tasks that do not need downloads or APIs, set chat.agent.sandbox.network.allowNetwork to false. This removes outbound access instead of relying only on a list of blocked destinations.
Selected internet destinations
If a task needs package metadata, an issue tracker, or a specific API, keep outbound access enabled and populate chat.agent.sandbox.network.allowedDomains with only the required destinations. An allow list is more predictable than granting broad internet access. Confirm that the tool being used resolves through the names you permitted; redirects, package mirrors, and authentication endpoints may require additional destinations.
Blocking selected destinations
chat.agent.sandbox.network.deniedDomains is useful when general outbound access is required but a particular destination must be excluded. Because allow and deny lists can interact, check the effective policy in the session instead of assuming that a list entry has the precedence you intended.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Private and local networks
Keep chat.agent.sandbox.network.allowLocalNetwork off by default. Turn it on only when the task has a defined need for a local or private-network service. Local-network access is a separate decision from ordinary outbound internet access. On Windows, proxy and hostname-restriction configurations have documented interactions with this control; consult the current VS Code Agent Host guide before relying on a particular proxy arrangement.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsAny destination that can receive agent actions may also receive workspace data through those actions. Network access is therefore an information-flow decision, not merely a convenience toggle.
Limit filesystem access and developer resources
Use path rules deliberately
chat.agent.sandbox.fileSystem.userConfiguredPaths supports custom read/write, read-only, and denied path lists. Start with the workspace and the specific task directories. Add a path only when a command fails because it genuinely needs it, and choose read-only access for source or reference data that the agent does not need to edit.
- Keep credential stores, personal documents, unrelated repositories, and production data outside the allowed paths.
- Use a denied path for especially sensitive material even when a broader parent directory is available to the task.
- Prefer a project subdirectory over a whole home directory or drive.
- After changing paths, start a fresh session and verify what the Agent Host reports as readable and writable.
Decide on developer-tool access
chat.agent.sandbox.fileSystem.allowDevToolAccess defaults to true and exposes common developer tools, configuration, and caches. Builds, language servers, package managers, and test runners may depend on these resources. Disable it for a task that only needs isolated file operations, but expect workflows that rely on global tool installations or caches to stop working. If you leave it enabled, compensate by keeping user-configured paths narrow and by removing credentials the task does not need.
Do not expose credentials by default
chat.agent.sandbox.credentials.authenticategit and chat.agent.sandbox.credentials.authenticategh both default to true. They make the corresponding credentials available to sandboxed processes for relevant operations. Set each to false unless the task specifically requires Git or GitHub authentication.
A sandboxed process that receives a credential can act with that account’s permissions. Sandboxing does not turn a deliberately injected credential into a harmless token, and credentials explicitly supplied to a process are not protected by the sandbox. For read-only analysis, disable both credential controls and use local copies or unauthenticated data where possible.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Choose a fail-closed or fallback policy
chat.agent.sandbox.allowUnsandboxedCommands defaults to true. When enabled, a blocked command may offer a confirmed one-command or session fallback outside the sandbox. That can rescue a legitimate build, but it also creates a path around the restrictions you just configured.
Set it to false when policy requires every command to remain sandboxed. The command will fail instead of offering an outside-sandbox run. This is the clearer choice for untrusted repositories, sensitive workspaces, and automated sessions where a human may not be watching each prompt.
Sandboxing and approvals are different controls
Visual Studio Code’s approvals documentation states: “Sandboxing is independent of the permission level.” A permissive approval mode does not disable an enabled terminal sandbox, and an enabled sandbox does not replace approvals for other tools, URLs, or actions.
Recommended Free Tools
Use approval settings to decide when a person must confirm an operation. Use sandbox settings to limit the resources available to supported terminal processes. Terminal auto-approval is a convenience feature with detection limitations, not a security boundary. Prefer session-scoped approvals and avoid global automatic approval as a substitute for resource restrictions.
Built-in agent read, edit, and write tools use VS Code’s permission system rather than the process sandbox. Do not describe the configuration as isolating every agent action.
Keep unfamiliar workspaces in Restricted Mode
Workspace Trust addresses whether a folder is trusted, while the Agent Host sandbox addresses the resources available to supported terminal processes. They complement each other and should not be collapsed into one setting.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Open an unfamiliar repository in Restricted Mode while you inspect its files, scripts, tasks, extensions, and configuration. Restricted Mode limits agents, terminals, tasks, debugging, workspace settings, and extensions; terminal launch is blocked by default. Trust the folder only after you understand what it contains and what execution-capable features it enables.
Restricted Mode is not an absolute defense: VS Code cautions that a malicious extension may ignore it. Keep extensions under review and do not treat trust status as proof that a repository is safe.
Platform prerequisites and execution-host details
Prerequisites vary by the host where the Agent Host executes. The current documentation checked on October 13, 2026 lists the following requirements; verify the live guide immediately before deploying because operating-system support and security updates can change.
| Host | Requirement |
|---|---|
| macOS | No additional package requirement is listed. |
| Linux | bubblewrap and socat. |
| WSL2 | bubblewrap and socat; WSL1 is unsupported. |
| Windows | Support is experimental and requires the applicable Windows security update. The listed updates are Windows 11 24H2/25H2 KB5124008 and Windows 11 26H1 KB5124012. |
Install Linux or WSL2 prerequisites
On Debian or Ubuntu, install the packages on the execution host:
sudo apt-get install bubblewrap socatOn Fedora, use:
sudo dnf install bubblewrap socatThese commands install prerequisites; they do not enable the sandbox or grant filesystem and network access. Configure the Agent Host settings separately.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Agent Host versus Local and custom terminal behavior
The current sandbox guide applies to the Agent Host’s default Copilot SDK tool implementation. It does not automatically apply to the Local chat harness or a custom terminal override. A configuration that appears to work for one harness may have different enforcement or setting names in another.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
The settings reference marks chat.agent.sandbox.fileSystem.mac, chat.agent.sandbox.fileSystem.linux, and chat.agent.sandbox.fileSystem.windows as deprecated platform-specific legacy settings. Agent Host ignores those legacy controls. Local-only retry and auto-approval settings are likewise not a replacement for the unified Agent Host policy. Remove stale assumptions from documentation and verify which harness the current session reports.
What the sandbox cannot guarantee
- It is not a virtual machine.
- It is not a complete user-account boundary.
- It is not a standalone security boundary or an endpoint-security replacement.
- Explicitly injected credentials remain usable by the process that receives them.
- Extra allowed paths, developer configuration and caches, unrestricted network access, local-network access, and unsandboxed fallback all weaken isolation.
- Not every built-in agent tool is covered by terminal process sandboxing.
Use the sandbox as one layer in a defense-in-depth configuration: untrusted workspace handling, least-privilege credentials, narrow paths, restricted network access, approvals, and normal endpoint protections still matter.
Practical profiles for common tasks
Offline code review
- Enable
chat.agent.sandbox.enabled. - Set
allowNetworktofalse. - Keep
allowLocalNetworkoff. - Allow only the repository path, preferably without unrelated parent directories.
- Disable both Git and GitHub authentication.
- Set
allowUnsandboxedCommandstofalse. - Use Restricted Mode until the repository is inspected.
Build and test with package downloads
- Enable the sandbox on the build host.
- Keep outbound access on, but allow only the package registries, source hosts, and services the build actually uses.
- Leave local-network access off unless a test dependency is private.
- Allow the workspace and required build caches; use read-only paths for reference data.
- Enable developer-tool access only if the build needs shared tools or caches.
- Expose Git credentials only when the workflow must fetch private repositories.
- Keep unsandboxed fallback off when reproducibility and isolation are more important than completing a blocked command.
Publishing changes to a remote repository
- Keep the filesystem scope limited to the repository and its build output.
- Enable only the Git or GitHub credential control required by the operation.
- Use destination restrictions for the source-control service and any required API endpoint.
- Use manual approvals for pushes, releases, or destructive history changes; sandboxing does not approve those actions for you.
Troubleshooting when a command fails
The setting appears enabled but commands are unrestricted
Check the execution host and start a new Agent Host session. Confirm that the session is using Agent Host rather than Local or a custom terminal, then inspect the effective policy. A remote host or organization-managed setting may be supplying a different value.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A command cannot reach a service
Check allowNetwork, then the allowed and denied destination lists. If the service is on a private address, check allowLocalNetwork. On Windows, review proxy and hostname-restriction interactions in the current Agent Host documentation.
A build cannot find a tool or cache
Review allowDevToolAccess and the configured filesystem paths. Add the smallest required path, preferably read-only, and begin a new session before testing again.
Git operations fail after enabling the sandbox
Check whether authenticategit or authenticategh is disabled, depending on the operation. If credentials are intentionally unavailable, use an unauthenticated or local workflow rather than weakening the policy.
The agent offers to run a command outside the sandbox
That behavior is controlled by allowUnsandboxedCommands. Set it to false to fail closed. If you keep the fallback enabled, approve it only after understanding the command and the resources it will access.
Quick Recap
A concise review checklist
- Which machine runs the Agent Host?
- Is
chat.agent.sandbox.enabledon for that host? - Did you start a new session after changing host-level settings?
- Is outbound network access necessary?
- Is local-network access necessary?
- Are destination lists narrower than the task requires?
- Are filesystem paths limited to the workspace and required inputs?
- Does the task need developer tools or caches?
- Does it need Git or GitHub credentials?
- Must blocked commands fail rather than run outside the sandbox?
- Is the repository trusted, and if so, why?
- Are you configuring Agent Host rather than deprecated Local or platform-specific settings?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
