VS Code 1.141 shipped on October 7 with one feature that should have been in 1.130: cross-platform sandboxing for Copilot agent sessions. For the past year, developers have been handing AI agents unrestricted terminal access and hoping for the best. That changes now — if you opt in.
The release also ships session grids for parallel agents, a worktree cleanup tool that will recover gigabytes from your disk, and external session handoff from Codex CLI and the Copilot app. Here’s what matters and how to configure it.
Agent Sandboxing: Finally, a Blast Radius Limit #
When a Copilot agent runs a tool — a shell command, a file write, a network call — it inherits the permissions of your VS Code process. That means a malicious string in a source file, a poisoned npm package, or a compromised MCP server can instruct the agent to exfiltrate your SSH keys or overwrite your dotfiles. This isn’t theoretical. Prompt injection via untrusted repo content has been an active attack vector since agents got terminal access.
VS Code 1.141 introduces chat.agent.sandbox.enabled. Set it to "on" in your settings and agent-run commands are restricted from accessing files, network resources, and credentials outside defined boundaries.
{
"chat.agent.sandbox.enabled": "on"
}
On macOS and Linux this runs as a first-class sandbox. On Windows it’s experimental and opt-in, with network access still open — Microsoft’s own documentation calls it “network-open” in the current build. File system isolation is the primary protection for now, not full network containment.
You can toggle sandboxing per session without touching settings. Open the Permissions menu in any VS Code Copilot agent session and flip “Sandboxing for terminal” on or off. This is useful when you trust a specific workspace but want the default locked down elsewhere.
For enterprise teams, enforce sandboxing and remove the bypass option entirely:
{
"chat.agent.sandbox.enabled": "on",
"chat.agent.sandbox.allowBypass": false
}
The honest verdict: sandboxing should be the default, not an opt-in experiment. Microsoft is being conservative, which makes sense for a cross-platform security feature shipping across three operating systems simultaneously. But every developer running agents against untrusted code should enable this today, not wait for a stable flag.
Worktree Cleanup: Your Disk Has Been Quietly Filling Up #
Every agent session that uses a Git worktree leaves one behind when it ends. VS Code 1.140 made it easy to run multiple parallel agents. VS Code 1.141 ships the cleanup tool that should have come first.
Run Chat: Open Worktree Cleanup from the command palette. You get a list of inactive agent session worktrees sorted by size, with the last-modified timestamp for each. Filter by inactivity duration — anything untouched for more than a week is almost certainly dead — and delete in bulk.
Teams that have been running Copilot agents for a few months routinely find 5–15 GB of dead worktrees. The cleanup editor also integrates with pull request state: VS Code can automatically remove a session worktree once its corresponding PR is merged, stopping the accumulation problem from being a recurring manual task.
Enable automatic cleanup on PR merge:
{
"chat.agent.worktree.autoCleanupOnMerge": true
}
Session Grid: Managing Parallel Agents Like a Human #
The new session grid in the VS Code Agents window supports drag-and-drop splits, resizable panes, and a maximize-and-return-to-grid action for when you need to focus on one session without losing the others.
This matters for the common pattern of running a feature agent, a test-fix agent, and a refactor agent simultaneously. Previously you were tabbing between sessions with no spatial context. Now you can arrange them side by side and watch multiple task progressions at once.
Background shell tracking rounds this out: a pill above the chat input shows any shell commands an agent has running in the background, with elapsed time. You’ll know when an agent kicked off a build or a long-running test without reading back through the session history.
External Session Handoff: Continue Codex CLI Conversations in VS Code #
If you start a Codex CLI session or a conversation in the GitHub Copilot app, VS Code 1.141 detects it automatically and lets you continue in the IDE without a reload. Full history is preserved.
This closes a friction point that made the Copilot ecosystem feel fragmented. You could start a task in the terminal with codex, get partway through, then need editor integration — but switching to VS Code meant losing context. The handoff is passive: VS Code detects the external session and surfaces a prompt to open it.
Other Changes Worth Noting #
Multiple GitHub Enterprise instances: The deprecated github-enterprise.uri setting becomes github-enterprise.uris (plural), accepting an array. If you have more than one enterprise account, update your settings before the old key is removed.
Dev container samples: One-click environments for Go, .NET, Node.js, PHP, Python, and Rust. Enable via chat.agentHost.devContainer.samples.enabled (experimental).
MCP server discovery: MCP servers from plugins and extensions now appear in the Agent Customizations editor alongside manually configured servers — one unified view of everything an agent can reach.
Upgrade Steps #
Update to VS Code 1.141 and configure immediately:
- Enable sandboxing: Set
chat.agent.sandbox.enabledtoonin Settings - Reclaim disk: RunChat: Open Worktree Cleanup from the command palette
- Enable auto-cleanup: Set
chat.agent.worktree.autoCleanupOnMergetotrue - Migrate enterprise settings: Replace
github-enterprise.uriwithgithub-enterprise.urisif applicable - Try the session grid: Open the Agents window and drag sessions into a 2D layout
Agents with unrestricted system access are a liability. VS Code 1.141 gives you the tools to contain that surface area. The sandbox isn’t perfect yet — Windows network access is still open — but enabling it now costs nothing and prevents a class of attacks that are actively being exploited in the wild.
Full release notes: code.visualstudio.com/updates/v1_141