VS Code Copilot Sandbox Settings to Change

Updated 7 November 2026 · Standard formula, shown below

To make GitHub Copilot in VS Code safer and more predictable, you should adjust the sandbox-related settings that control how Copilot handles untrusted code and chat context. The most important ones are chat.experimental.sandboxing, github.copilot.chat.experimental.sandbox.enable, and the workspace trust settings. These controls limit what Copilot can access when you open unfamiliar repositories, reducing the risk of malicious code influencing suggestions or executing commands.

Background: Why Sandboxing Matters

Copilot is an AI assistant that reads your code, comments, and chat messages to generate suggestions. When you open a repository from the internet, that code could contain prompts designed to manipulate the AI—known as prompt injection. A sandbox restricts Copilot’s runtime environment so it cannot read arbitrary files, access your network, or execute commands without your permission. Without sandboxing, Copilot might follow instructions embedded in code comments, potentially leaking your local file contents or performing unintended actions.

How Sandboxing Works in VS Code

VS Code uses a multi-layered security model. The first layer is workspace trust: when you open a folder, VS Code asks if you trust it. Untrusted workspaces disable most extensions, including Copilot, until you explicitly trust the folder. The second layer is the sandbox itself, which runs Copilot’s chat processes in a restricted environment. This sandbox intercepts file system access, network requests, and shell execution, showing you a prompt when Copilot wants to do something outside its allowed scope.

In recent versions, the sandbox is enabled by default for untrusted workspaces, but you can fine-tune its behavior. The relevant settings are in the Extensions section of your settings.json or through the Settings UI.

Key Settings to Change

Here are the specific settings you should review and adjust:

chat.experimental.sandboxing – Set to true to enable the sandbox for all chat features. This is the master switch.
github.copilot.chat.experimental.sandbox.enable – Some versions use this instead of the above. Enable it if present.
github.copilot.chat.experimental.sandbox.allowFileAccess – Controls whether Copilot can read files outside the current workspace. Keep it false for untrusted folders.
github.copilot.chat.experimental.sandbox.allowNetworkAccess – Set to false unless you need Copilot to fetch documentation or packages during chat.
security.workspace.trust.untrustedFiles – Choose newWindow to open untrusted files in a separate window, preventing accidental trust.
github.copilot.chat.experimental.sandbox.allowShellCommands – Leave this false for most work. Enabling it lets Copilot run terminal commands, which is powerful but risky.

How to Choose the Right Settings

Your choice depends on your workflow and the source of the code you open. For personal projects you wrote yourself, you can disable the sandbox for convenience. For third-party repositories, especially those you plan to audit or compile, keep the sandbox fully enabled. Here is a practical guide:

If you only work on your own code, set chat.experimental.sandboxing to false to avoid permission prompts.
If you frequently open GitHub repos to read or test, keep sandboxing true and set file access to true only for the current workspace.
If you use Copilot to write scripts that interact with your system, you may need shell access—but only enable it after reviewing the code carefully.
For maximum security, set all sandbox options to false (i.e., deny access) and manually approve each request.

Common Problems and Fixes

Users often encounter a few issues when adjusting sandbox settings. The most common is Copilot not working at all in an untrusted workspace. This happens because the sandbox blocks all access, and the extension fails silently. To fix it, either trust the workspace (if safe) or adjust the file access setting to allow read-only access to the workspace folder.

Another issue is that Copilot suggestions are less relevant when the sandbox blocks file access. This is expected because Copilot cannot see the full project context. If you need better suggestions, you can allow file access to the current workspace only, but keep network and shell access disabled.

Finally, some users see a prompt asking for permission every time they use chat. This is by design—the sandbox is working. You can reduce prompts by setting github.copilot.chat.experimental.sandbox.promptForAccess to false, but that will auto-deny all requests, making Copilot less useful.

Comparison: Sandbox vs. Workspace Trust

Workspace trust is a broader security feature that disables all extensions in untrusted folders. The sandbox is a finer-grained control that operates within a trusted workspace. Think of workspace trust as a locked door, and the sandbox as a security guard inside the room. You need both for full protection. If you trust a folder, you are telling VS Code that the code is safe enough to run extensions. The sandbox then limits what Copilot can do even within that trusted environment, protecting against malicious content that might be hidden in comments or strings.

Costs and Trade-offs

Enabling the sandbox comes with a slight performance overhead because every file access and network request is intercepted. For large projects, this can make Copilot feel slower. Also, the sandbox may block legitimate features like fetching a package version or reading a config file from a parent directory. You can mitigate this by selectively allowing access to specific paths using the github.copilot.chat.experimental.sandbox.extraPaths setting, but that requires manual configuration.

Alternatives and Best Practices

If you find the sandbox too restrictive, consider using Copilot in a separate VS Code window for untrusted projects, or use the GitHub Copilot CLI with its own sandboxing. Another alternative is to review all code before opening it in an editor—use a code review tool or a virtual machine. The best practice is to keep the sandbox enabled by default and only disable it for projects you fully control and trust. Regularly update VS Code and the Copilot extension, as sandbox improvements are often included in updates.

Frequently Asked Questions

Q: Will changing sandbox settings affect my existing projects?
No, changes apply to all workspaces, but you can override them per-workspace in your settings.json.

Q: Can I enable sandbox only for certain folders?
Yes, use the github.copilot.chat.experimental.sandbox.extraPaths setting to add specific folders that Copilot can access, while keeping the rest blocked.

Q: What happens if I disable sandboxing entirely?
Copilot will have full access to your file system and network, making it vulnerable to prompt injection from malicious code. Not recommended for untrusted projects.

Q: How do I know if the sandbox is active?
Look for a shield icon in the status bar when you open a workspace. If it shows a warning, the sandbox is on. You can also check the output panel for sandbox-related messages.

Q: Does the sandbox block Copilot from reading my .env files?
Yes, by default it blocks access to files outside the workspace, including .env files in parent directories. You can explicitly allow them if needed, but be cautious about exposing secrets.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.