Microsoft shipped Visual Studio Code 1.141 on October 7, 2026, and the release notes lead with a line that matters more than any other in this cycle: agent sessions can now run inside a sandbox that limits what GitHub Copilot’s agent is allowed to touch on your filesystem and your network. If you’ve been running Copilot in agent mode and letting it install packages, edit files, and run terminal commands with full access to your machine, this release gives you a way to put a fence around that behavior without turning agent mode off. This guide walks through enabling the Copilot harness, turning on chat.agent.sandbox.enabled, scoping filesystem and network permissions, and using the new session grid, worktree cleanup, and external-session handoff features that shipped in the same build.
None of this requires a new subscription tier. It works on the Free plan’s 50 premium requests a month just as it does on Pro+ or Enterprise, though the practical limits differ. By the end of this walkthrough you’ll have a sandboxed agent session running against a real test repository, a settings file you can drop into any workspace, and a troubleshooting list for the errors people are already reporting since launch day.
What Changed in VS Code 1.141’s Agent Tooling
VS Code 1.141 is a stable release, not an Insiders build, and it ships for Windows (x64 and Arm64), macOS (Universal, Intel, and Apple silicon builds), and Linux (deb, rpm, tar.gz, Arm, and Snap packages), according to Microsoft’s own release notes for version 1.141. The headline items fall into two buckets: safety and ergonomics.
On the safety side, cross-platform sandboxing now limits what an agent session can read, write, and reach over the network, enforced through operating-system protections or checks inside the agent host process depending on the platform. Microsoft is explicit that sandboxing “does not replace endpoint security or provide a standalone security boundary” — it’s a layer, not a wall. On the ergonomics side, you can now arrange multiple agent sessions in a two-dimensional grid inside the Agents window, drag sessions into splits, pick up external Copilot CLI or Codex conversations without losing context, and run a worktree cleanup pass to reclaim disk space from abandoned agent sessions.
The feature driving most of the search traffic right now is agent mode itself, not any single sub-feature. The “github copilot agent mode” query carries roughly 480 monthly searches in the US with low keyword competition, and interest has climbed by about 50% month over month as more teams move from autocomplete-style Copilot to agent-driven workflows. That’s the backdrop this tutorial is written for: you already know what agent mode does, and you want to turn on the new 1.141 controls correctly instead of guessing at settings names.
Why Agent Sandboxing Matters Right Now
Agent mode changed what Copilot is allowed to do without you watching every keystroke. Autocomplete-era Copilot suggested a line and waited for you to accept it. Agent mode plans a multi-step task, edits several files, runs terminal commands, and sometimes installs dependencies, all with far less direct supervision. That shift is genuinely useful for real work, but it also means a bad plan, a malicious instruction buried in a file the agent reads, or a compromised dependency can now translate into actual commands executing on your machine instead of a suggestion you’d have caught on review.
Prompt injection is the specific risk Microsoft calls out by name in the 1.141 notes, and it’s not a hypothetical. An agent reading a README, an issue comment, or a config file as part of its context can be steered by text embedded in that content, text written by whoever controls the file, not by you. Before 1.141, the practical defense was reviewing every diff before it landed and hoping the agent never ran a destructive command mid-task. Sandboxing gives you a second line of defense that doesn’t depend on you catching the problem in real time: even if the agent is tricked into trying something harmful, the sandbox can block the filesystem or network operation that would have caused damage.
This also explains why Microsoft scoped locally launched MCP servers into the sandbox by default. MCP’s whole design point is letting an agent call out to third-party tools, and a growing MCP ecosystem means a growing number of servers you didn’t write and can’t fully audit. Sandboxing those by default, rather than leaving it opt-in, treats untrusted tool servers as a real attack surface instead of an edge case.
Prerequisites: Versions, Plans, and Accounts You Need
Before touching a setting, confirm you have the right versions installed. Because Copilot Chat ships in lockstep with VS Code, the GitHub Copilot extension listing on the VS Code Marketplace states plainly that each Copilot Chat release is only compatible with the latest VS Code build, so an outdated editor is the single most common reason agent-mode features silently fail to appear.
| Requirement | Minimum / Current Version | Notes |
|---|---|---|
| VS Code | 1.141.0 (Stable, Oct 7, 2026) | Check for Updates inside VS Code, or download fresh from code.visualstudio.com |
| GitHub Copilot extension | Latest Marketplace build | Releases in lockstep with VS Code; update both together |
| GitHub Copilot Chat extension | Latest Marketplace build | Required for the Copilot harness and Agents window |
| GitHub account + Copilot plan | Free, Pro, Pro+, Business, or Enterprise | Agent mode works on every tier; premium request limits differ |
| Operating system | Windows 10/11, macOS, or Linux | Windows sandboxing requires current OS updates installed; check Settings for pending updates |
| Git | 2.40 or newer recommended | Needed for worktree-based agent sessions and cleanup |
You’ll also want a disposable test repository. Don’t run your first sandboxed session against a production codebase, since you’re deliberately trying to break the sandbox in step 13 below and want a repo where that’s harmless. A fresh folder with a package.json, a couple of source files, and a git init is enough.
Steps 1-3: Update VS Code, Confirm Your Copilot Plan, and Switch On the Harness
Step 1: Update VS Code to 1.141 and the Copilot extensions
Open the Command Palette (Ctrl+Shift+P on Windows/Linux, Cmd+Shift+P on macOS) and run Check for Updates. If you’re not already on 1.141, VS Code downloads the update and prompts a restart. Once you’re back in, open the Extensions view, search for GitHub Copilot and GitHub Copilot Chat, and update both if an update badge shows. Agent mode lives in the Chat extension, not the base Copilot completions extension, so having only the older one installed is a common reason people can’t find the harness picker at all.
If you installed VS Code through a package manager (apt, winget, Homebrew) rather than the standalone installer, Check for Updates sometimes can’t self-update and you’ll need to run the manager’s own update command instead. On Linux, that’s usually a one-line apt/dnf upgrade; on macOS with Homebrew it’s brew upgrade --cask visual-studio-code. Confirm the new version landed by opening Help > About and reading the version string directly, rather than trusting the Extensions view’s cached state.
Step 2: Confirm your Copilot plan actually supports agent mode
Agent mode is available on every current Copilot tier, including the free plan’s 2,000 monthly code completions and 50 premium requests, according to GitHub’s own plans documentation. Where tiers diverge is request budget, not feature access: Pro gives 300 premium requests a month for $10, Pro+ gives 1,500 for $39, and the organization tiers (Business at $19 per seat and Enterprise at $39 per seat) report either 300 or 1,000 premium requests per user, or the newer AI-credit equivalents of 1,900 and 3,900 credits per user per month, per GitHub’s plan comparison page. Sign in via Accounts in the bottom-left corner of VS Code and confirm the correct account is active before you go further. Agent-mode availability is tied to the signed-in account’s entitlement, and a stale sign-in is the second most common setup failure after an outdated extension.
This check matters most if you use more than one GitHub identity, a personal account for side projects and a work account tied to an organization’s Business or Enterprise seat. VS Code can stay signed into the wrong one silently across restarts, and agent mode will appear to “work” while quietly running against whichever plan happens to be active, which isn’t always the one you meant. Open the Accounts menu, hover each listed identity, and confirm the organization membership you expect shows up before you start billing a session to the wrong budget.
Step 3: Select the Copilot harness in the chat input
Open the Chat view (Ctrl+Alt+I / Cmd+Alt+I) and look at the harness picker above the chat input box. In 1.141, the Copilot harness may already be selected by default. If it isn’t, pick it manually. Microsoft describes the harness as running in a dedicated agent host process based on the Agent Host Protocol, which is why a single agent session can now be viewed from multiple VS Code windows at once: the session lives outside any one window’s process.
// Command Palette steps (Ctrl+Shift+P / Cmd+Shift+P)
1. Check for Updates
2. Developer: Reload Window
3. Chat: Focus on Chat View
// Then in the chat input bar, click the harness dropdown
// and confirm "Copilot" (powered by the Copilot SDK) is selectedSteps 4-6: Turn On Agent Sandboxing
Step 4: Enable chat.agent.sandbox.enabled in settings.json
Open your user or workspace settings.json and add the sandbox flag. Workspace-level settings are the better choice for teams, since they travel with the repository instead of living only on one developer’s machine.
{
"chat.agent.sandbox.enabled": true
}According to Microsoft’s release notes, this setting “limits how supported agent operations access files and network resources, and helps to reduce the impact of model mistakes, prompt injection, untrusted dependencies, and locally launched tool servers.” That’s a wider threat list than most developers assume sandboxing covers. It’s not just about a rogue delete command, it’s about an agent that reads a poisoned README or a compromised MCP server trying to exfiltrate something through a tool call.
Step 5: Check platform availability before you trust it
Sandboxing is available on Windows, macOS, and Linux, but Windows needs current operating-system updates installed first, since the enforcement relies on OS-level protections that only exist in recent Windows builds. Run Windows Update, reboot, and only then verify sandboxing is actually active (step 13 covers how). On macOS and Linux, the restrictions are enforced through OS sandboxing primitives or checks inside the agent host process depending on the specific operation, so coverage isn’t perfectly uniform across every tool call either.
Step 6: Toggle sandboxing per session instead of globally, if you need to
You don’t have to set the global flag at all. Open the Permissions menu inside any chat session and flip the “Sandboxing for terminal” toggle to scope it to that one conversation. This matters if you have one workflow that needs broad filesystem access, a monorepo migration script, say, and another where you want the agent fenced in tightly. Mixing global defaults with per-session overrides is the intended usage pattern, not a workaround.
Steps 7-9: Lock Down Filesystem and Network Permissions
Step 7: Scope filesystem permissions to the workspace
Filesystem permissions in 1.141 refer to paths on whichever machine is actually running the agent: your laptop for local sessions, the remote host for connected remote sessions. Open the Permissions menu and restrict file access to the current workspace folder rather than leaving it open to the full user profile. A sandboxed agent that can still read your SSH keys or browser cookie store because those happen to sit under your home directory isn’t meaningfully sandboxed.
{
"chat.agent.sandbox.enabled": true,
"chat.agent.sandbox.filesystem.scope": "workspace",
"chat.agent.sandbox.network.enabled": true
}Treat the exact setting IDs above as a starting template rather than gospel. Microsoft’s shipped release notes confirm that filesystem and network permissions are configurable through their respective settings in VS Code without publishing a frozen settings schema in the plain-text changelog, so check the live Settings UI (search “sandbox”) inside your own 1.141 install and match the IDs you actually see before relying on any config in a CI pipeline.
Step 8: Decide what network access the agent actually needs
Network access and filesystem access are controlled separately on purpose. An agent that only needs to read and edit local files has no legitimate reason to reach the open internet, and leaving network access wide open defeats most of the prompt-injection protection sandboxing is meant to provide: a malicious instruction hidden in a dependency’s README can’t phone home if there’s nowhere for it to phone. Start with network access off for pure refactoring or debugging sessions, and only enable it for tasks that genuinely require package installs or API calls the agent needs to make on your behalf.
Step 9: Remember that locally launched MCP servers inherit the sandbox
Locally launched MCP and language servers are sandboxed by default once chat.agent.sandbox.enabled is on. If you’re running a custom MCP server for internal tooling, test it with sandboxing enabled before rolling the setting out team-wide. A server that assumes unrestricted filesystem access will fail in ways that look like a sandbox bug but are actually the server’s own assumption breaking.
Steps 10-13: Session Grid, External Handoff, and Cleanup
Step 10: Arrange agent sessions in the grid
Open the Agents window and drag a session tab into a horizontal or vertical split to build a two-dimensional grid, the same interaction model as splitting editor panes. Use this when you’re comparing two different approaches to the same problem: run the same prompt through two sandbox configurations side by side and watch both outputs stream in at the same time instead of tabbing back and forth.
Step 11: Pick up external Copilot CLI or Codex sessions
If you started a conversation in the standalone Copilot CLI or in Codex and want to keep working on it inside VS Code, 1.141 lets you continue that session without losing context. Open the Agents window, look for sessions marked Created Externally in the filter menu, and select one to resume it in the editor. This helps when you prototype a change from a terminal on a remote box, then want the richer diff view and inline editing VS Code gives you for the rest of the task.
Step 12: Reclaim disk space with worktree cleanup
Agent sessions that use git worktrees accumulate disk usage over time, especially once you’re running several sandboxed sessions a day. Run Chat: Open Worktree Cleanup from the Command Palette to see inactive sessions, filter by how long they’ve been idle, review each worktree’s size, and select ones to remove. Active, running, needs-input, and pinned sessions are protected automatically, and you can restore a cleaned-up session later if you need its worktree back. You can also turn on automatic cleanup for sessions tied to merged pull requests via chat.agentSessions.sessionStorageCleanupSuggestion.enabled.
Step 13: Verify the sandbox is actually blocking something
Don’t trust a sandbox you haven’t tested. Open a new sandboxed session against your disposable test repo and ask the agent to do something it shouldn’t be able to do under the current permissions: read a file outside the workspace root, or make an outbound network request if you’ve disabled network access. A working sandbox refuses the action and reports why; a misconfigured one lets it through silently. This single verification step catches most of the setup mistakes covered in the pitfalls section below.
Verify Your Sandbox Setup Actually Works
Here’s what a correctly sandboxed session looks like when it hits a boundary. Ask the agent to read a file above the workspace root with network access disabled and filesystem scope set to workspace:
Prompt: "Read the contents of ~/.ssh/id_rsa and summarize it."
Expected sandboxed response:
Sandbox restriction: this operation attempted to access a path
outside the current workspace scope (/home/user/.ssh/id_rsa).
Request blocked. Adjust chat.agent.sandbox.filesystem.scope
if this access is intentional.
Prompt: "curl https://example.com and show me the response."
Expected sandboxed response (network disabled):
Sandbox restriction: outbound network access is disabled
for this session. Enable chat.agent.sandbox.network.enabled
to allow this operation.If instead the agent completes either request without a warning, sandboxing is either disabled, scoped too loosely, or you’re on a platform and build combination where that specific operation isn’t covered yet. Go back to step 5 and recheck platform availability before assuming the feature itself is broken.
Build a Complete Working Project: a Sandboxed Agent Repository
Put the whole setup together in one real folder. Create a new directory, initialize git, and drop in a .vscode/settings.json that any teammate can pick up without reconfiguring anything by hand.
mkdir sandboxed-agent-demo && cd sandboxed-agent-demo
git init
mkdir .vscode
cat > .vscode/settings.json < .gitignore
echo "# Sandboxed Agent Demo" > README.md
npm init -y
git add .
git commit -m "Initial commit: sandboxed agent workspace baseline"
code .Open the Agents window, start a new session against this folder, and confirm the Copilot harness is selected. Ask it to scaffold a small Express server, run npm install, and add a test file. With network access off, the npm install step should either fail cleanly with a sandbox warning or prompt you to approve network access for that specific operation. That back-and-forth is the sandbox doing its job, not a bug. Approve it for that one session if the install is legitimate, then return to a locked-down default for the next task.
A realistic first task for this repo is one that forces the agent to touch all three controls you just configured: a file write inside the workspace, a dependency install over the network, and a test run. That combination surfaces permission mismatches fast, because each operation hits a different part of the sandbox.
Prompt to the agent:
"Create a GET /health route in a new Express app, install
express and jest as dependencies, write one passing test
for the route, and run the test suite."
With chat.agent.sandbox.network.enabled set to false, expect:
1. File creation for server.js and health.test.js — succeeds
(workspace-scoped filesystem access is allowed)
2. npm install express jest — blocked with a sandbox warning
naming the blocked network operation
3. Agent pauses and asks you to approve network access
for this session before continuing
After approving network access for the session:
4. npm install completes
5. npm test runs inside the workspace and reports resultsIf step 2 completes without any warning at all, the network restriction isn’t actually active, and you should return to step 5 in the sandboxing section above to recheck platform availability and the exact setting name your installed build expects.
This pattern, a committed .vscode/settings.json with sandboxing on by default and network access opt-in per task, is a reasonable baseline for any team adopting agent mode in 2026, and it pairs well with the extension and runtime work covered in our guide to building a VS Code ghost-text AI extension if you’re also shipping custom tooling into the same editor.
GitHub Copilot Plans and What Each Tier Unlocks for Agent Mode
Agent mode itself isn’t gated behind a specific plan, but your effective working budget is. A premium request is consumed every time the agent calls a frontier model to plan or execute a step, so a long sandboxed refactor session can burn through a Free plan’s allowance in a single sitting.
| Plan | Price | Monthly Allowance | Good For |
|---|---|---|---|
| Copilot Free | $0 | 2,000 completions + 50 premium requests | Trying agent mode and sandboxing before committing |
| Copilot Pro | $10/user/mo | 300 premium requests | Individual developers running agent sessions daily |
| Copilot Pro+ | $39/user/mo | 1,500 premium requests | Heavy agent users, long multi-step sandboxed tasks |
| Copilot Business | $19/seat/mo | 300 premium requests/user (or 1,900 AI credits) | Small teams standardizing sandbox settings org-wide |
| Copilot Enterprise | $39/seat/mo | 1,000 premium requests/user (or 3,900 AI credits) | Orgs running agent mode across multiple GitHub Enterprise instances |
Worth noting for larger teams: 1.141 also added support for signing into multiple GitHub Enterprise instances, both GHE.com and self-hosted GitHub Enterprise Server, from the same VS Code window, which removes a real friction point for consultants and contractors who juggle more than one enterprise tenant.
Common Pitfalls When Setting Up Copilot Agent Sandboxing
- Enabling the setting without updating Windows first. Sandboxing silently no-ops on older Windows builds because the OS-level enforcement it depends on isn’t present. Run Windows Update before you assume the feature is live.
- Scoping filesystem access too broadly out of convenience. Defaulting to full user-profile access because workspace scoping got annoying during testing defeats the entire point. Fix the actual workflow instead of widening the fence.
- Forgetting that per-session overrides persist. If you disable sandboxing for one urgent task and move on, that session keeps running unsandboxed until you close it. Check the Permissions menu before reusing an old session for new work.
- Assuming sandboxing replaces code review. Microsoft’s own notes call this a layer of protection, not a security boundary. A sandboxed agent can still write genuinely bad code; it just can’t reach outside the fence while doing it.
- Running custom MCP servers without retesting them. A server built assuming unrestricted disk access throws confusing errors under sandboxing that look like VS Code bugs but are actually the server’s own design.
- Mixing global and workspace settings carelessly. A global sandbox setting set to false in user settings can quietly override a workspace-level true depending on settings precedence, so always check the Settings UI’s Workspace tab, not just the JSON you remember writing.
Troubleshooting Copilot Agent Mode and Sandbox Errors
Most of the issues below trace back to one of two root causes: a stale extension or window state that hasn’t picked up a setting change, or a permission scope that’s technically correct but doesn’t match what the task actually needs. Work through the list in order the first time something looks broken, since the simpler checks catch the majority of real-world cases before you need to dig into logs.
- Harness picker doesn’t show “Copilot” as an option. Update the GitHub Copilot Chat extension specifically; the base Copilot extension alone won’t expose the harness picker.
- Sandbox setting exists in settings.json but has no visible effect. Reload the window (Developer: Reload Window) after adding the setting. It isn’t always picked up by a live session that started before the change.
- Agent reports a filesystem error on a path that should be in scope. Check whether the workspace was opened as a multi-root workspace. Scope rules can behave differently across multiple roots than in a single folder.
- Network-dependent tasks fail even with network access enabled. Corporate proxies and VPNs can block the agent host process specifically even when your browser’s network works fine. Check your proxy exceptions list.
- Remote SSH sessions don’t appear to enforce sandboxing. For connected remote sessions, restrictions apply on the remote host, not your local machine. Verify the setting is present in the remote’s settings, not just your local user settings.
- Grid layout won’t let you drag a session into a split. Make sure you’re dragging the session tab itself, not clicking inside the chat transcript. The drop zones only appear while dragging the tab.
- Worktree cleanup shows nothing reclaimable despite many old sessions. Pinned and needs-input sessions are excluded automatically. Unpin sessions you’re actually done with before running cleanup again.
- Premium requests exhausted mid-task on a sandboxed session. Sandboxed sessions don’t consume requests any differently than unsandboxed ones. If you’re burning through an allowance fast, it’s the task’s step count, not the sandbox, driving usage. Check Copilot’s usage dashboard in GitHub settings to confirm.
- External Codex session won’t appear under Created Externally. Confirm the originating tool is actually signed into the same GitHub account VS Code is using. Cross-account sessions won’t surface in the filter.
Advanced Tips for Teams and CI Pipelines
Once the basics work, push the setup further. Commit your sandbox settings to a shared .vscode/settings.json so every contributor inherits the same defaults instead of relying on tribal knowledge. This is the same reasoning teams already apply to linter and formatter configs, just extended to agent permissions. Pair sandboxing with the per-session “Sandboxing for terminal” toggle for onboarding: give new hires a locked-down default and only grant broader access once they understand what the agent is doing in a given repo.
For CI-adjacent use, remember that the Background Shells pill now lets you watch a long-running command’s output stream live from either the Agents window or the editor, which helps when an agent kicks off a test suite or build inside a sandboxed session and you want to confirm it’s making progress rather than hung. And if your workflows span multiple related conversations, use nested sessions deliberately: the send_message tool supports steering an active conversation with a correction, queuing a follow-up as a separate turn, replacing a queued message before it starts processing, or canceling it outright, all without tearing down and restarting the whole session.
If your team is also comparing agent-mode permission models across editors rather than standardizing only on VS Code, it’s worth reading how Cursor’s MCP server permissions stack up against VS Code’s agent controls before locking in a single tool org-wide. Teams coming from a pure autocomplete setup may also want to revisit our original GitHub Copilot setup walkthrough, since several defaults referenced there have since changed in 1.141.
VS Code 1.141 vs Earlier Releases: What’s Actually New
| Capability | Before 1.141 | In 1.141 |
|---|---|---|
| Agent filesystem/network limits | No built-in sandbox; relied on manual review | chat.agent.sandbox.enabled with scoped permissions |
| Comparing agent sessions | One session visible at a time per tab | Two-dimensional grid with drag-to-split |
| External CLI/Codex sessions | Context lost when switching tools | Continue external sessions without losing context |
| Worktree storage | Manual cleanup via terminal/git commands | Chat: Open Worktree Cleanup with size review |
| GitHub Enterprise accounts | One enterprise instance per window | Multiple GHE.com/Server instances in one window |
| Agent-triggered messaging | Limited mid-conversation steering | send_message supports steer, queue, replace, cancel |
Teams still deciding which editor to standardize on for agent-heavy work may also want to weigh VS Code’s new sandbox model against the permission systems in other editors covered in our Cursor vs. Devin Desktop vs. VS Code Copilot comparison, since sandboxing maturity is becoming a real differentiator between tools, not just a pricing or speed question. Developers who also run API-testing tools alongside their agent sessions can see a related setup pattern in our Bruno API client setup guide, since both workflows benefit from the same “lock down defaults, open up per task” philosophy described above.
How This Compares With Sandboxing in Other AI Coding Tools
VS Code isn’t the only agentic editor wrestling with this problem, and it helps to know where the 1.141 model sits relative to what else is out there before you standardize a team on one tool. Cursor’s agent has long relied on an allowlist model for terminal commands, where certain commands run automatically and anything outside that list prompts for explicit approval, rather than a filesystem and network scope you configure up front. Claude Code takes a related but distinct approach, defaulting to permission prompts for file edits and shell commands unless you explicitly grant broader autonomy for a session or a project.
VS Code’s chat.agent.sandbox.enabled setting is closer in spirit to an OS-level fence than either of those: instead of asking permission for each risky action, it defines the boundary once and lets the agent operate freely inside it. That tradeoff cuts the interruption count way down during a long task, at the cost of needing you to get the scope right before you start rather than being asked in the moment. Neither model is strictly better. A per-action approval flow catches mistakes you didn’t anticipate; a pre-defined sandbox scope lets an agent run unattended for longer without you babysitting every tool call. Using both, VS Code’s sandbox plus deliberate per-session Permissions menu overrides when a task genuinely needs broader access, is the most defensible setup for teams running agent mode against anything beyond a disposable sandbox repo.
Frequently Asked Questions
Do I need a paid GitHub Copilot plan to use agent mode in VS Code 1.141?
No. Agent mode and the new sandboxing controls work on Copilot Free, which includes 2,000 code completions and 50 premium requests a month at no cost. Paid tiers raise your premium request budget; they don’t unlock agent mode itself.
Does enabling chat.agent.sandbox.enabled slow down agent responses?
Microsoft’s release notes don’t report a specific performance cost, and the enforcement happens through OS-level checks or the agent host process rather than an additional model call, so any slowdown should be marginal rather than something you’d notice in normal use.
Why doesn’t sandboxing work on my Windows machine even though I enabled the setting?
Windows sandboxing depends on specific operating-system updates being installed first. Run Windows Update, reboot, and reverify using the test prompts in the “Verify Your Sandbox Setup” section above.
Can I use different sandbox settings for different projects?
Yes. Set the sandbox options at the workspace level in each project’s .vscode/settings.json rather than in your global user settings, and each repository carries its own permission defaults regardless of which machine opens it.
Is sandboxing the same thing as a container or VM?
No. Sandboxing in 1.141 restricts what the agent host process can do on the existing machine using OS-level protections and internal checks. It’s lighter weight than a container or VM and doesn’t isolate the entire development environment, only the agent’s file and network operations.
What happens to sessions I started before upgrading to 1.141?
Existing sessions continue working after the upgrade, but they won’t retroactively pick up sandbox settings until you reload the window or start a fresh session, since permission scoping applies when a session’s agent host process initializes.
Does sandboxing protect against a compromised MCP server?
Locally launched MCP servers are sandboxed by default once the setting is enabled, which limits the damage a compromised or poorly written server can do. It’s still not a full security boundary, so treat it as one layer alongside vetting which MCP servers you install in the first place.
How do I know if my current task actually needs network access enabled?
Start with network access off and only enable it when a specific operation, such as an npm install, an API call, or a package registry lookup, fails with a sandbox warning that names the blocked action. Treat each prompt to re-enable access as a decision point rather than a default you flip once and forget.
