GitHub shipped two changes on October 7th. Local sandboxing for Copilot reaches general availability, and Copilot CLI can now find models running in a local Ollama instance.
The second comes with a warning GitHub says clearly, and most of the coverage will be skipped. Selecting a local model does not turn on offline mode or disable telemetry. And even in offline mode, a remote provider can still receive your requests and code context over the network.
Sandboxing is now GA
Local sandboxing is live in the Copilot CLI, the GitHub Copilot app, and VS Code sessions with Agent Host. It is included at no extra cost.
Everything Copilot runs on your machine now runs within a boundary you define. What you can limit:
Which files and directories agent-run commands can read or modify. Access to the Internet, local networks, Git credentials, and GitHub CLI credentials. Local tools and services including MCP and language servers, where supported.
Organizations get enterprise managed settings that require sandboxing and enforce policies developers can’t weaken. The last word does real work. A policy a developer can relax if it becomes inconvenient is no control.
GitHub also separates two things that connect people. Model execution and tool isolation are different concerns, and sandbox policies apply to tool execution regardless of which model Copilot uses. Running a model on your own hardware, sandboxing nothing on your own.
What power it
Sandboxing runs on Microsoft eXecution Container, or MXC, which translates a common sandbox policy and native operating system controls to Windows, macOS, and Linux.
MXC is open source at github.com/microsoft/mxc. That’s important for anyone who wants to control the border rather than trust it, and it means that the same policy file can be maintained consistently across three very different isolation mechanisms.
Ollama models in the CLI
From CLI version 1.0.94-0, the /model Command lists support models from a running Ollama instance alongside your configured models and GitHub’s cloud models.
Discovery does not add anything automatically. You select a discovered model, check its provider and endpoint, then choose Add and use for this session or Add without switching. Either works without restarting the CLI.
Two prerequisites. Ollama and the model must already be installed, because this flow does not install a runtime or download weights. And the model has to support tool calling and streaming, which rules out a fair number of smaller local models.
If a supplier connection fails, the picker will show why instead of silently outputting the model. The Copilot app has its own version of this below Settingsthen model providers.
The offline thing
This is the part to understand before adopting local means privately.
Choosing a local model changes where inference occurs. It doesn’t change GitHub’s telemetry, which remains. Offline mode in the CLI is a separate, explicit choice by the COPILOT_OFFLINE=true environment variable.
And GitHub adds a further qualification: a remote provider can still receive requests and code context over the network, even in offline mode. So offline mode is not a guarantee that nothing leaves your machine. It depends on which providers you have configured.
For anyone evaluating Copilot on privacy, those two sentences are the ones that matter, and they’re easy to miss in a minute’s change.
Come next
GitHub says that it also announces intelligent routing with local models, the work between local and cloud depending on the task, with availability to follow. The changelog does not give a date and points to Microsoft’s Command Line blog for details.
Reports of a late-October timeline come from that Microsoft post rather than GitHub’s changelog, so treat the date as reported rather than committed.
If you already run Ollama
If you have Ollama installed, this is a ten minute experiment. Update Copilot CLI on 1.0.94-0 or laterrun /modeland see which of your local models support Tool Calling and Streaming.
The combination with sandboxes is the really interesting part. An agent running a local model, in a file system and a network boundary you set, with credentials held back, is a meaningfully different risk profile from the same agent running unrestricted.