Most development teams now use AI agents that write and edit code and run commands. It genuinely speeds up delivery — and raises a fair question for the project owner: where do my code and data go, and who reviews what the agent writes? GitHub Copilot's October 2026 updates answer part of that.
The main changes this month
- Local sandboxing is generally available (7 October): it restricts an agent's access to files, network and credentials, in the CLI, the Copilot app and VS Code, at no extra cost.
- Local models: the CLI can now list models running on the developer's machine through Ollama, so sensitive code can be worked on without sending it to a cloud service.
- Model turnover: GitHub retired several older models in October and pointed to newer replacements — the tool itself changes month to month.
- VS Code 1.141: several agent sessions side by side, to compare solutions and track more than one task.
What it means for your project
The speed is real: tasks that took a day now take hours, which is part of why price ranges can be flexible. But code an agent writes needs the same review and testing as any developer's, and sandboxing protects your secrets only if it is actually switched on.
Questions to ask any software company
- Do you use AI tools to write code, and which ones?
- Who reviews code before it's merged, and are there automated tests?
- Where are service keys and passwords kept, and can the agent reach them?
- Is my project's code or my customers' data sent to an outside service?