{"slug": "vs-code-1-141-enable-agent-sandboxing-before-your-next-session", "title": "VS Code 1.141: Enable Agent Sandboxing Before Your Next Session", "summary": "Microsoft shipped VS Code 1.141 on October 7 with cross-platform sandboxing for Copilot agent sessions, enabled via the chat.agent.sandbox.enabled setting, which restricts agent-run commands from accessing files, network resources, and credentials outside defined boundaries. The release also adds session grids for parallel agents, a worktree cleanup tool that teams report recovering 5–15 GB of dead worktrees, and external session handoff from Codex CLI and the Copilot app. On Windows the sandbox is experimental and network-open, with file system isolation as the primary protection for now.", "body_md": "VS Code 1.141 shipped on October 7 with one feature that should have been in 1.130: cross-platform sandboxing for Copilot agent sessions. For the past year, developers have been handing AI agents unrestricted terminal access and hoping for the best. That changes now — if you opt in.\n\nThe release also ships session grids for parallel agents, a worktree cleanup tool that will recover gigabytes from your disk, and external session handoff from Codex CLI and the Copilot app. Here’s what matters and how to configure it.\n\n## Agent Sandboxing: Finally, a Blast Radius Limit\n\nWhen a Copilot agent runs a tool — a shell command, a file write, a network call — it inherits the permissions of your VS Code process. That means a malicious string in a source file, a poisoned npm package, or a compromised MCP server can instruct the agent to exfiltrate your SSH keys or overwrite your dotfiles. This isn’t theoretical. Prompt injection via untrusted repo content has been an active attack vector since agents got terminal access.\n\nVS Code 1.141 introduces `chat.agent.sandbox.enabled`. Set it to `\"on\"` in your settings and agent-run commands are restricted from accessing files, network resources, and credentials outside defined boundaries.\n\n```\n{\n  \"chat.agent.sandbox.enabled\": \"on\"\n}\n```\n\nOn macOS and Linux this runs as a first-class sandbox. On Windows it’s experimental and opt-in, with network access still open — Microsoft’s own documentation calls it “network-open” in the current build. File system isolation is the primary protection for now, not full network containment.\n\nYou can toggle sandboxing per session without touching settings. Open the **Permissions** menu in any VS Code Copilot agent session and flip “Sandboxing for terminal” on or off. This is useful when you trust a specific workspace but want the default locked down elsewhere.\n\nFor enterprise teams, enforce sandboxing and remove the bypass option entirely:\n\n```\n{\n  \"chat.agent.sandbox.enabled\": \"on\",\n  \"chat.agent.sandbox.allowBypass\": false\n}\n```\n\nThe honest verdict: sandboxing should be the default, not an opt-in experiment. Microsoft is being conservative, which makes sense for a cross-platform security feature shipping across three operating systems simultaneously. But every developer running agents against untrusted code should enable this today, not wait for a stable flag.\n\n## Worktree Cleanup: Your Disk Has Been Quietly Filling Up\n\nEvery agent session that uses a Git worktree leaves one behind when it ends. [VS Code 1.140](https://byteiota.com/vs-code-1-140-run-multiple-agents-judge-picks-best/) made it easy to run multiple parallel agents. VS Code 1.141 ships the cleanup tool that should have come first.\n\nRun **Chat: Open Worktree Cleanup** from the command palette. You get a list of inactive agent session worktrees sorted by size, with the last-modified timestamp for each. Filter by inactivity duration — anything untouched for more than a week is almost certainly dead — and delete in bulk.\n\nTeams that have been running Copilot agents for a few months routinely find 5–15 GB of dead worktrees. The cleanup editor also integrates with pull request state: VS Code can automatically remove a session worktree once its corresponding PR is merged, stopping the accumulation problem from being a recurring manual task.\n\nEnable automatic cleanup on PR merge:\n\n```\n{\n  \"chat.agent.worktree.autoCleanupOnMerge\": true\n}\n```\n\n## Session Grid: Managing Parallel Agents Like a Human\n\nThe new session grid in the VS Code Agents window supports drag-and-drop splits, resizable panes, and a maximize-and-return-to-grid action for when you need to focus on one session without losing the others.\n\nThis matters for the common pattern of running a feature agent, a test-fix agent, and a refactor agent simultaneously. Previously you were tabbing between sessions with no spatial context. Now you can arrange them side by side and watch multiple task progressions at once.\n\nBackground shell tracking rounds this out: a pill above the chat input shows any shell commands an agent has running in the background, with elapsed time. You’ll know when an agent kicked off a build or a long-running test without reading back through the session history.\n\n## External Session Handoff: Continue Codex CLI Conversations in VS Code\n\nIf you start a Codex CLI session or a conversation in the GitHub Copilot app, VS Code 1.141 detects it automatically and lets you continue in the IDE without a reload. Full history is preserved.\n\nThis closes a friction point that made the Copilot ecosystem feel fragmented. You could start a task in the terminal with `codex`, get partway through, then need editor integration — but switching to VS Code meant losing context. The handoff is passive: VS Code detects the external session and surfaces a prompt to open it.\n\n## Other Changes Worth Noting\n\n**Multiple GitHub Enterprise instances:** The deprecated `github-enterprise.uri` setting becomes `github-enterprise.uris` (plural), accepting an array. If you have more than one enterprise account, update your settings before the old key is removed.\n\n**Dev container samples:** One-click environments for Go, .NET, Node.js, PHP, Python, and Rust. Enable via `chat.agentHost.devContainer.samples.enabled` (experimental).\n\n**MCP server discovery:** MCP servers from plugins and extensions now appear in the Agent Customizations editor alongside manually configured servers — one unified view of everything an agent can reach.\n\n## Upgrade Steps\n\nUpdate to VS Code 1.141 and configure immediately:\n\n1. **Enable sandboxing:** Set`chat.agent.sandbox.enabled` to`on` in Settings\n2. **Reclaim disk:** Run**Chat: Open Worktree Cleanup** from the command palette\n3. **Enable auto-cleanup:** Set`chat.agent.worktree.autoCleanupOnMerge` to`true`\n4. **Migrate enterprise settings:** Replace`github-enterprise.uri` with`github-enterprise.uris` if applicable\n5. **Try the session grid:** Open the Agents window and drag sessions into a 2D layout\n\nAgents with unrestricted system access are a liability. VS Code 1.141 gives you the tools to contain that surface area. The sandbox isn’t perfect yet — Windows network access is still open — but enabling it now costs nothing and prevents a class of attacks that are actively being exploited in the wild.\n\nFull release notes: [code.visualstudio.com/updates/v1_141](https://code.visualstudio.com/updates/v1_141)", "url": "https://wpnews.pro/news/vs-code-1-141-enable-agent-sandboxing-before-your-next-session", "canonical_source": "https://byteiota.com/vs-code-1-141-enable-agent-sandboxing-before-your-next-session/", "published_at": "2026-10-12 03:30:00+00:00", "updated_at": "2026-10-12 03:37:48.507007+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety", "ai-products"], "entities": ["Microsoft", "VS Code 1.141", "GitHub Copilot", "Codex CLI", "Copilot app", "chat.agent.sandbox.enabled", "chat.agent.worktree.autoCleanupOnMerge", "VS Code Agents window"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/vs-code-1-141-enable-agent-sandboxing-before-your-next-session", "markdown": "https://wpnews.pro/news/vs-code-1-141-enable-agent-sandboxing-before-your-next-session.md", "text": "https://wpnews.pro/news/vs-code-1-141-enable-agent-sandboxing-before-your-next-session.txt", "jsonld": "https://wpnews.pro/news/vs-code-1-141-enable-agent-sandboxing-before-your-next-session.jsonld"}}