GitHub now lets Copilot run inside isolated local or cloud sandboxes. Local sandboxing restricts filesystem, network, and system access for command execution, while cloud sandboxes provide ephemeral Linux environments hosted by GitHub.

For enterprise AI coding adoption, the product shift is clear: agents need execution layers with identity, policy, and isolation. This article belongs in security and governance monitoring, not just productivity coverage.

Field|Current evidence
Primary source|GitHub: Cloud and local sandboxes for GitHub Copilot now in public preview
Source date|2026-06-02
Update scope|cloud and local execution isolation for Copilot agent tasks
Verification note|Official source only; no search-result scraping, no ranking guarantee, no uncited claims

The information gain is the split between local and cloud isolation. Local sandboxes restrict file, network, and system access around command execution, while cloud sandboxes provide an ephemeral Linux environment. That distinction helps security teams decide where untrusted or high-risk agent work should run.

A practical rollout should classify tasks by risk: dependency updates and exploratory commands can use stronger isolation, while normal edits may stay local with narrower permissions. The point is not to trust the agent more; it is to reduce blast radius when the agent makes a bad call.

Teams should treat sandboxes as a control layer for agent execution, not as a replacement for code review, secret scanning, or CI. The best early use case is letting an agent investigate or test without broad access to the workstation.

Limits and open questions: public preview status means behavior, pricing, platform support, and policy defaults can change. The article should not imply complete protection until GitHub documents the exact boundaries and failure modes. Source handling note: SignalFront records the publisher, publication date, and source URL on the page, then keeps the update date tied to evidence-backed edits rather than automatic refreshes. When source material is thin, the system keeps interpretation narrow and waits for stronger documentation. Editorial review compares the new claim against the article summary, fact table, internal links, and listed source before allowing another optimization pass. Search outcomes are measured after publication rather than assumed at writing time.

GitHub's public preview for cloud and local sandboxes gives Copilot isolated execution environments for agentic development.

Cloud and local sandboxes for GitHub Copilot now in public preview

GitHub Copilot Sandboxes Put Agent Execution Behind Policy Boundaries

Cursor Enterprise can now manage multiple teams from one organization-level container. Admins get a rollup of spend and token usage, identity controls, and separate security, governance, budget, and feature settings for each team.

The new group model is especially relevant for agent governance because cohorts can receive separate model access, spend limits, and agent permissions without creating a new team.

Field|Current evidence
Primary source|Cursor: Organizations for Cursor Enterprise
Source date|2026-06-03
Update scope|organization containers, multiple teams, analytics, budgets, and agent permissions
Verification note|Official source only; no search-result scraping, no ranking guarantee, no uncited claims

The useful change is administrative scope. Cursor is separating organization-level visibility from team-level controls, which matters when one company has different model policies, budgets, and agent permissions across engineering groups. That turns AI coding governance into an operating model rather than a single workspace setting.

Enterprise admins should map teams, identity groups, cost centers, and agent permissions before turning on broader access. The strongest early use is separating experimental groups from production-facing teams while still getting organization-level spend and usage visibility.

This update is most relevant for companies already standardizing on Cursor. Smaller teams may not need organization containers yet, but enterprises should treat the feature as a policy and reporting layer.

Limits and open questions: the changelog does not establish every security default, retention policy, or export format. Those should be verified through admin docs or a controlled enterprise trial before stronger claims are made. Source handling note: SignalFront records the publisher, publication date, and source URL on the page, then keeps the update date tied to evidence-backed edits rather than automatic refreshes. When source material is thin, the system keeps interpretation narrow and waits for stronger documentation. Editorial review compares the new claim against the article summary, fact table, internal links, and listed source before allowing another optimization pass. Search outcomes are measured after publication rather than assumed at writing time.

Cursor's June 3 changelog adds organization containers, multi-team support, usage analytics, and group-level agent permissions for enterprise deployments.

Security & Governance

GitHub Copilot Sandboxes Put Agent Execution Behind Policy Boundaries

Cursor Enterprise Adds Organization-Level Governance