GitHub Copilot CLI shipped versions 1.0.91 through 1.0.105 in October 2026. The headline changes are local command sandboxing for all users, assisted permissions that no longer need experimental mode, local Ollama model discovery in /model, and new flags for telemetry, folder trust, and session sharing.
Last updated: November 5, 2026
Table of contents
- What is new in October 2026
- Release-by-release summary
- How to set up sandboxing and assisted permissions
- Local models and model controls
- Plans, limits and enterprise controls
- Frequently asked questions
- Sources
What is new in GitHub Copilot CLI in October 2026
GitHub published fourteen stable Copilot CLI releases between October 1 and October 27, 2026, according to the official Copilot CLI changelog. Most entries are fixes, but four changes matter for anyone who runs the agent for long, unattended sessions.
Local sandboxing. Version 1.0.93 made command sandboxing available to all users through /sandbox and --sandbox. GitHub’s October 7 announcement says the feature is generally available in Copilot CLI, the Copilot app, and VS Code sessions using Agent Host. It is powered by Microsoft eXecution Container (MXC), which maps one policy to native controls on Windows, macOS, and Linux.
Assisted permissions. When Copilot asks to run a command, access a path, or open a URL, a language model evaluates the request. Clearly safe requests proceed; others need your approval. GitHub announced general availability on October 26, 2026, and version 1.0.104 removed the experimental-mode requirement.
Local model discovery. From 1.0.94-0, /model lists supported models from a running local Ollama instance next to Copilot’s cloud models, as described in the local models changelog.
New flags and commands. Version 1.0.100 added --disable-client-telemetry, --trust-folder for one-off prompt-mode sessions, install links for verified Skills and plugins, and a full-screen /share menu. Version 1.0.92 added copilot config subcommands to list, read, set, and remove settings.
Release-by-release summary
| Version (date) | Notable change | Why it matters |
|---|---|---|
| 1.0.91 (Oct 1) | copilot sandbox ca commands to check, create, trust, rotate, and remove proxy CA trust |
Fixes certificate errors for tools behind the credential proxy |
| 1.0.92 (Oct 5) | copilot config subcommands; Ctrl+E picker for local or cloud runs |
Scriptable settings and faster environment choice |
| 1.0.93 (Oct 7) | Sandboxing for all users; enterprise permissions.limitTo |
Restricts files, network, and credentials for agent commands |
| 1.0.94 (Oct 8) | Claude Haiku 5.5 in model selection; local Ollama discovery | More model choice without leaving the session |
| 1.0.97 (Oct 13) | Agent-scoped declarative hooks for custom agents | Hooks that apply only to one agent |
| 1.0.100 (Oct 19) | --disable-client-telemetry, --trust-folder, /share menu |
Cleaner CI and scripted runs |
| 1.0.101 (Oct 20) | assistedApprovalInstructions; structured output for workflow subagents |
Lets you steer the permission judge |
| 1.0.104 (Oct 27) | Assisted permissions without experimental mode; Autopilot waits for background tasks | No experimental flag needed |
| 1.0.105 (Oct 27) | Copilot Fusion High or Max selectable from long-context sessions | Fewer model-switch failures |
How to set up sandboxing and assisted permissions
The steps below follow GitHub’s Using local sandboxing documentation and the assisted permissions announcement.
- Check prerequisites. On Linux, install Bubblewrap (
bwrap) 0.5.0 or later andslirp4netnson your PATH. On Windows, the docs require Windows 11 25H2 with KB5124010 or later, or 26H1 with KB5124006 or later. - Update the CLI. Install 1.0.104 or later so assisted permissions work without experimental mode.
- Enable the sandbox. Run
/sandbox enable. The choice is saved assandbox.enabledin~/.copilot/settings.jsonand applies to current and future sessions. Already-open sessions need their own/sandbox enableor a restart withcopilot --continue. - Inspect the policy. Run
/sandbox statusto confirm enforcement, and/sandbox policy npm installto preview the access a command would get without running it. - Switch to assisted permissions. Run
/permissionsand select assisted. Optionally setassistedApprovalInstructionsto guide which requests the judge treats as safe. - Grant narrow access when blocked. Use
/add-dir PATHfor session-only read and write access, or/sandbox configfor saved path and host rules.
By default, sandboxed commands can write in the current working directory, temporary folders, and the repository’s Git metadata. Outbound internet access is on and local network access is off. Git and gh receive placeholder credentials, and a local proxy substitutes real ones only for approved HTTPS destinations.
For one-off scripted runs, combine flags: copilot --sandbox -p "PROMPT". Add --trust-folder and --disable-client-telemetry when running in CI.
Local models and model controls
To use a local model, start Ollama, open /model, choose a discovered model, review its provider and endpoint, then pick Add and use for this session or Add without switching. No restart is needed. Ollama and the model must already be installed, and the model must support tool calling and streaming. For Ollama’s own recent changes, see our Ollama new features guide.
A local model does not turn on offline mode or disable GitHub telemetry. Offline mode stays an explicit choice through COPILOT_OFFLINE=true, and a remote provider can still receive prompts and code context.
For cloud models, 1.0.104 makes the managed fusion model start sessions on Auto and apply fusionTier settings. Our GitHub Copilot Fusion guide covers effort levels and billing in detail.
Plans, limits and enterprise controls
Local sandboxing is included with GitHub Copilot at no additional cost. Assisted permissions are generally available in Copilot CLI, the Copilot app, and Visual Studio Code. Note these limits from the official pages:
- Sandbox policies apply to tool execution only, regardless of which model runs the session.
- An approved one-command bypass skips credential masking and the proxy, so it can expose real secrets.
- Credential masking does not hide secrets in credential files, unmasked environment variables, or remote MCP authentication.
- If enterprise settings require sandboxing,
--no-sandboxcannot disable it. - Administrators can block Allow All while keeping assisted permissions, disable assisted permissions, and set the default permission mode. If the default is prohibited, sessions start with manual approval.
Compared with earlier builds, the practical difference is that a safe, semi-autonomous setup no longer needs experimental flags. For how other agents handle approvals, compare Claude Code 2.1.318, Codex CLI 0.166, and Kiro CLI auto-approve. Teams scheduling Copilot work can also read our GitHub Copilot Automations guide.
Frequently asked questions
What is new in GitHub Copilot CLI 1.0.105?
Version 1.0.105 (October 27, 2026) fixes selecting Copilot Fusion High or Max from long-context sessions. The wider October releases, 1.0.91 to 1.0.105, add command sandboxing for all users, assisted permissions without experimental mode, local Ollama model discovery, and new telemetry and trust flags.
How do I turn on assisted permissions in Copilot CLI?
Run /permissions in a Copilot CLI session, then select assisted. A language model evaluates each request to run a command, access a path, or open a URL. Clearly safe requests proceed automatically, and other requests still need your approval.
Is Copilot CLI local sandboxing free?
Yes. GitHub states that local sandboxing is included with GitHub Copilot at no additional cost. It is off by default. Run /sandbox enable to turn it on, or start a single sandboxed session with copilot –sandbox.
Can Copilot CLI use local models from Ollama?
Yes, from version 1.0.94-0. The /model picker discovers supported models from a running local Ollama instance. Ollama and the model must already be installed, and the model must support tool calling and streaming. Choosing a local model does not turn on offline mode.
Can my organization block assisted permissions or require sandboxing?
Yes. Enterprise-managed settings can block Allow All while keeping assisted permissions, disable assisted permissions, choose the default permission mode, and require sandboxing so that –no-sandbox cannot turn it off.
Sources
- GitHub Copilot CLI changelog (versions 1.0.91 to 1.0.105)
- GitHub Changelog: Assisted permissions generally available (October 26, 2026)
- GitHub Changelog: Local sandboxing generally available (October 7, 2026)
- GitHub Docs: Using local sandboxing
- GitHub Changelog: Discover local models in Copilot CLI (October 7, 2026)
Featured image: Laptop coding programs, Wikimedia Commons (Unsplash), CC0 public domain.