Skip to content
NewsProduct launch

GitHub Copilot's local sandboxing reaches general availability alongside Claude Haiku 5.5

· by Pondero Newsdesk

The short version

GitHub's October 7-9 changelog rollup moved local sandboxing to GA across Copilot CLI, the Copilot app, and VS Code, added Claude Haiku 5.5 to the model picker, and let the CLI discover locally-running Ollama models.

GitHub Copilot's local sandboxing reaches general availability alongside Claude Haiku 5.5

GitHub Copilot's autonomous agents can now run inside an operating-system-level sandbox that blocks file, network, and credential access by default, a general-availability feature GitHub shipped October 7 alongside a new fast, cheap Claude model and a way to point the CLI at models running on a developer's own machine.

What happened

GitHub's October 9 "weekly releases" changelog rolled up a cluster of changes dated October 5 through 7, per GitHub's changelog. Local sandboxing, which scopes what files, networks, and credentials a Copilot agent can touch, reached general availability in Copilot CLI, the Copilot app, and VS Code sessions that use Agent Host, per GitHub's announcement. The same week, Claude Haiku 5.5, described by GitHub as "Anthropic's newest lightweight model," became generally available to Copilot Pro, Pro+, Max, Business, and Enterprise users, per GitHub's changelog entry. Separately, Copilot CLI's /model command, starting in CLI version 1.0.94-0, can now discover models from a running local Ollama instance and let a developer add one mid-session without restarting the CLI, per GitHub's changelog. A companion VS Code 1.141 release, also referenced in the rollup, added a grid view for comparing parallel agent sessions side by side and a cleanup tool that shows how much disk space inactive agent worktrees are using, per the VS Code release notes.

Local sandboxing is built on Microsoft eXecution Container, or MXC, which translates one sandbox policy into native operating-system controls across Windows, macOS, and Linux, per GitHub's documentation on cloud and local sandboxes. It lets a developer or an organization limit which files and directories agent-run commands can read or modify, restrict access to the internet, local networks, and Git or GitHub CLI credentials, and extend the same restrictions to local MCP servers and language servers where supported. GitHub includes the feature with Copilot at no additional cost. Model execution and tool isolation are handled separately, so a sandbox policy applies no matter which model, including the new Haiku 5.5 option, is doing the work.

Haiku 5.5 is pitched at a different problem than sandboxing: speed and cost on high-volume work. GitHub's changelog frames it as designed "for fast, high-volume work like subagents, quick edits, and terminal tasks," and states that in early testing the model "matched Claude Sonnet 5 on many coding tasks while using significantly fewer tokens and steps" (claim per GitHub's changelog, not independently verified). It is billed at provider list pricing under Copilot's usage-based billing and is rolling out gradually across VS Code, Visual Studio, Copilot CLI, the Copilot cloud agent, the Copilot app, github.com, GitHub Mobile, JetBrains IDEs, Xcode, and Eclipse. Business and Enterprise admins control access through the existing model policy in Copilot settings, where new models are enabled by default unless an admin has turned off that default. Developers checking which plan tier includes Haiku 5.5 and local sandboxing can review current Copilot plans at /go/copilot.

The Ollama discovery flow in Copilot CLI does not install anything on its own. A developer must already have Ollama and the target model installed locally; the CLI then lists discovered models in the picker alongside configured and cloud options, and a chosen model is added only after the developer reviews its provider and endpoint and confirms "Add and use for this session" or "Add without switching." Models have to support tool calling and streaming, and connection failures surface in the picker with an explanation rather than failing silently. Choosing a local model does not turn on offline mode or disable GitHub telemetry; offline mode stays a separate, explicit setting via the COPILOT_OFFLINE environment variable, and GitHub notes that a remote provider can still receive prompts and code context over the network even when offline mode is on, per GitHub's CLI provider documentation.

Enterprises can now mandate sandboxing instead of hoping developers opt in

The GA milestone matters less for what sandboxing does than for who can turn it on. GitHub's documentation describes enterprise-managed settings that require sandboxing and enforce policies developers cannot weaken, which moves the feature from an individual safety habit to an organizational control an admin sets once across every Copilot CLI, app, and VS Code Agent Host session in a company. That is the piece that was missing while sandboxing sat in preview: a team running Copilot's more autonomous flows, such as the cloud agent or CLI tasks that execute without per-step confirmation, previously depended on each developer choosing to sandbox their own sessions. With GA and the enterprise-enforcement option, a security team can close that gap without auditing individual developer settings.

The Ollama discovery feature answers a narrower but related question: cost and data locality for the easy, high-volume part of agentic coding work. Haiku 5.5 gives Copilot users a cheaper, faster cloud option for subagents and quick edits; local Ollama models give them a path to run some of that same work entirely off GitHub's cloud, provided the developer has already set up the runtime and the model supports tool calling and streaming. Neither path changes what sandboxing restricts, since GitHub keeps model choice and tool isolation as separate systems, so an organization that mandates sandboxing keeps that mandate regardless of which model a developer or admin picks.

What to watch next

Microsoft's Command Line blog, linked from the CLI changelog, previewed a related but separate feature: "intelligent routing" that would let Copilot decide automatically whether a task runs on a local, on-device model or routes to Copilot's cloud models, paired with a new quantized model Microsoft calls MAI Code 1.1 Flash, aimed at NVIDIA RTX Spark-equipped devices such as the Surface Laptop Ultra. Microsoft's post targets a "by the end of the month" availability window from its October 7 publication date. Whether that routing feature ships on schedule, and whether other IDE vendors follow GitHub's lead on surfacing local models inside a CLI model picker, are the next milestones to track.

Sources