GitHub made local sandboxing for Copilot generally available on 7 October 2026: Copilot CLI sessions, the Copilot app, and VS Code sessions through Agent Host run inside Microsoft's eXecution Container, with filesystem, network, and credential access restricted to policy the developer or their organization defines. It is a real improvement, and it is a runtime containment control.

A sandbox bounds the agent while it runs. It says nothing about whether the change that leaves the sandbox should have shipped. Containment and governance are different layers: the first asks what the agent can reach, the second asks what ships, who approved it, what it touched outside this tool, and whether the record can be checked without the vendor.

GitHub has been absorbing agent infrastructure all year. Agentic Workflows went into public preview on 11 June 2026, putting programmable agent workflows into GitHub Actions with a sandbox, an Agent Workflow Firewall, and a safe-outputs gate. Copilot code review became callable over the REST API on 2 October. GitHub now orchestrates and contains agents inside GitHub, and both moves are good ones. What they do not produce is a cross-tool, offline-verifiable record: a change that starts in a tracker and lands in a pull request leaves its evidence spread across both systems, and re-checking it means going back to GitHub.

The sandbox cannot help there, because it dies with the session. What survives a shipped change is the record: what the agent produced, which gate evaluated it, who approved it, and what the change did in every system it touched - graded observed, derived, or self-reported, and verifiable from the export rather than from GitHub's logs.

The honest summary is that GitHub got better at keeping the agent from breaking out. Whether what comes out should have shipped is still a governance question, and it belongs somewhere that is not the platform that ran the agent.

For the dimension-by-dimension version, see Modulo vs GitHub native agent governance. For what the record itself has to satisfy, see Platform-generated events vs offline-verifiable evidence.