GitHub Copilot CLI

Where it stands, 2026-10-13

On 7 October 2026, 1.0.93 made command sandboxing available to every user, but left it off by default. The same release stopped reading user settings from ~/.copilot/config.json. An upgrade can therefore leave old containment settings behind.

Stable 1.0.97 was released on 13 October 2026 and is available as npm install -g @github/copilot@1.0.97. The runtime updater defaults to on; set COPILOT_AUTO_UPDATE=false for CI pins and check copilot --version. At the 2026-10-13 UTC cutoff, the newest published preview was 1.0.98-0.

Check the 1.0.97 repairs before unattended work. Disabled plugin hooks no longer return on resume, and canceled writes are not replayed when suspended sessions resume. Inspect the hook list and interrupted calls in an existing session. The release also repairs --output-format json secret redaction; inspect saved output because the note does not bound earlier exposure. Autopilot denies a preToolUse hook’s ask decision, so review hooks that expect a human answer.

For preview capabilities and unversioned entry points, see workflow permissions and the open questions.

Migrate settings before enabling the sandbox. Move the affected keys to ~/.copilot/settings.json, starting with sandbox controls and URL rules.

Before expanding the trial, complete the host, credential and network checks, then review shared configuration and unattended work.

Use /sandbox enable, or copilot --sandbox -p 'TASK' per CI job, then inspect /sandbox status and /sandbox policy.

Try authenticated Git before broad delegation

1.0.92 withholds ambient GITHUB_TOKEN from sandboxed shells unless configured. GitHub documents placeholder Git/gh credentials replaced by a proxy at restricted destinations, and sandbox.credentials.envVars.<NAME>.injectHosts for other masked variables. Keep destination lists narrow. With sandboxing enabled, try a read-only authenticated Git operation on an authorized repository. Record completion and exceptions before expanding the workload.

That is the bargain to test: less credential checking command by command, more care over destinations and exceptions. Count both before expanding the workload.

Require sandbox policy on capable hosts. Check Windows 11 prerequisites: 25H2 with KB5124010 or later, or 26H1 with KB5124006 or later, plus BaseContainer support; on Linux, bwrap 0.5.0+ and slirp4netns on PATH. For mandatory containment, apply sandbox.enabled: true, sandbox.failIfUnavailable: true and sandbox.allowBypass: false through device policy.

The docs say server-managed enablement alone can be declined on unsupported hosts, and managed sandbox settings block clients below 1.0.93. If bypass is permitted, distinguish one-attempt approval from a session-wide opt-out.

Restrict token-file access before widening grants. Masking does not hide credential files or unmasked variables. Disable developer-tool access, which is on by default with sandbox.allowDevToolAccess: false to remove grants to token-bearing files such as ~/.npmrc. Grant only the paths you need. Built-in file tools apply policy in software on a best-effort basis. A full bypass also skips masking and the proxy.

Test egress and localhost on each target OS. The GA docs describe proxy-enforced egress on macOS/Linux, while Windows programs can ignore the proxy and bypass host rules. Keep an OS firewall where Windows egress restrictions must hold.

Windows masking requires Allow local network, which also permits private-network access. On macOS, default Git/gh masking activates a proxy that blocks a command connecting directly to its own listener even with local network enabled. Test a blocked destination and localhost suites before requiring sandboxing.

Pair domain permissions with network containment. 1.0.93 adds permissions.limitTo. The docs say saved approvals and allow-all cannot widen it, but it checks domain requests rather than restricting shell, read or write operations themselves.

Check denials through every integration you run. 1.0.88 repairs managed MCP, permission and plugin policy coverage for integration sessions launched through ACP, Agent Host or the SDK server. Test the same denied operation through each entry point.

Shared configuration can widen authority

Copilot reads Claude Code’s .claude/rules from 1.0.89, and MCP configuration changes apply between turns from 1.0.93. One repository’s rules can steer both agents. Review those files. Treat /add-dir as a session read/write sandbox grant subject to managed policy.

Pin a supported model for comparisons. 1.0.89 sends saved, exported or resumed Fast preferences to Balance. Choose a model explicitly before comparing behavior or cost across the upgrade.

Sample the approval judge’s decisions. Assisted Permissions lets a model judge requests for auto-approval. Inspect the 1.0.96 timeline’s attribution to you, the judge, policy or unattended fallback. Review disputed decisions; managed policy can require Manual Approval from 1.0.94. Use the attribution to decide which exceptions still need your attention.

Review workflow code before pre-granting tools. Dynamic workflows remain public preview; existing annual Pro/Pro+ subscribers still on legacy premium request billing are excluded. copilot workflow run shows no approval prompts, subagents inherit session grants, and extension code can run outside those prompts. Approve the code before granting tools narrowly.

What is unresolved

The public repository contains notes and an installer, not the agent implementation.

• Get boundary test results before broadening delegation. Test the documented masking and file-tool rules in 1.0.97. Controlled allowed and denied credential-destination requests and token-file reads would settle those cases. Use the platform network checks and integration denial checks for those paths.
• Test failed refresh before requiring fresh policy. GitHub documents restrictions when a required policy refresh fails. Check effective permission decisions under failure, separately at unmanaged startup, known-managed startup, cached-policy startup and forced fresh fetch.
• Specify the judge’s exceptions before standardizing it. The 1.0.94 policy note does not name the managed disable key; the 1.0.96 attribution note does not define unattended fallback. Docs naming the key and defining fallback decisions would settle deployment and exception handling.
• Test shell reads and constructed destinations before relying on exclusions. For Business and Enterprise users, content exclusion promises context-use exclusion, without establishing a shell-read boundary. An excluded-file shell read and a runtime-constructed destination against limitTo would settle these two untested paths.
• Keep computer use a separate containment trial. It is public preview and off by default; actions follow tool permissions, and managed features.computerUse: false prevents users from enabling it. Test desktop actions against command sandbox restrictions before expanding access.
• Check plugin checkout results before loading code. AIR Security’s 17 September 2026 Plugin4Shell report describes substitution through 40-hex default branches on hosts that permit them, and says GitHub rejects those names. We found no named checkout-verification repair in notes through 1.0.97. Use controlled repositories and compare installed plugin files with the corresponding files at the expected pinned commit; installed plugins omit the source repository’s .git directory. A named, released repair or controlled install result would settle the mechanism for its stated version and host. Silence proves neither a patch nor current exploitability.
• Require release versions before reproducible multi-agent rollout. The multi-agent --fleet mode and workflow commands are documented, but their introduction versions are unverified. This profile does not establish whether those entry points are available in 1.0.97. The programmatic reference excludes --fleet in ACP server mode. Release notes naming those entry points would settle which deployment can reproduce them.