Someone turning on Copilot local sandbox today from GitHub’s changelog would take “tools and commands initiated by Copilot run with restricted access” as covering the file tools too.

I fetched the live About cloud and local sandboxes page (HTTP Date Wed, 07 Oct 2026 21:02:33 GMT, no last-modified). Local enable is /sandbox enable, with no experimental flag. Cloud is still public preview and still wants copilot --cloud --experimental. Local is off by default. Isolation is OS-level process containment (Seatbelt on macOS, bubblewrap on Linux, BaseContainer on Windows), not a separate virtual machine or container. Built-in file tools run in-process in the CLI, so the operating-system sandbox never sees those writes; they check the policy in software, on a best-effort basis. I didn’t start Copilot CLI.

The MXC README still says not to treat current profiles as security boundaries, and that SDK policies can be overly permissive.