Microsoft brings local AI models and sandboxed tools to Windows and GitHub Copilot

Microsoft has published on its official Command Line blog (signed by Patrick Nikoletich, of GitHub, and Stuart Schaefer, of the Windows team) a technical announcement on how GitHub Copilot will start deciding automatically when a coding task is best run with a model on the device itself and when it is best to turn to cloud models. The core idea is that developers no longer have to manage that infrastructure manually: Copilot orchestrates the choice behind the scenes, relying on what the company calls 'Project HydraFusion', an orchestrator that already picked among several cloud models by balancing performance, cost and latency, and that now extends to local inference as just another compute environment.

The flagship use case is Windows PCs with NVIDIA RTX Spark, such as the Surface Laptop Ultra, equipped with up to 128 GB of unified memory and up to 1 petaflop of AI compute. The article devotes a section to explaining why memory is the real bottleneck for local inference: on a chip with unified memory, CPU and GPU share the same physical pool, but that space is also claimed by the operating system, applications, the inference runtime and, increasingly, the key-value cache that stores the attention state of tokens already processed. As an agent reads files and receives tool results, context grows and with it memory pressure, so keeping a model loaded between requests helps avoid reloads, but does not by itself guarantee a constant response time.

To address that challenge, Microsoft AI has developed a local version of MAI Code 1.1 Flash, a mixture-of-experts coding model with 137 billion total parameters and 6.8 billion active parameters. The on-device version applies quantization and 'speculative decoding' (a smaller model proposes blocks of candidate tokens that the target model verifies) to cut size and improve latency without sacrificing too much quality on coding and tool-use tasks, which is critical because a single wrong token in code can cause a syntax error, a wrong identifier or a broken diff. According to the figures published by Microsoft, the quantized version used on the device weighs 53 GB, compared with the size of the cloud variant in Bfloat16, a reduction of roughly 80%. On the Surface Laptop Ultra, peak memory use reaches 75.5 GB with a 256k-token context, and prompt processing reaches 923.5 and 769.8 tokens per second with 64k and 128k contexts, respectively.

On coding benchmarks, the table shared in the article puts MAI Code 1.1 Flash (cloud variant) at 72.6% on SWE-Bench Verified and 62.9% on Terminal-Bench 2.1, against 32.0% and 23.6% for GPT-OSS-120B (using Unsloth's GGUF version as a comparison). The quantized version running locally, despite the size reduction, holds performance very close to the cloud: 70.80% on SWE-Bench Verified and 66.29% on Terminal-Bench 2.1. Microsoft specifies that these tests were run on October 5, 2026 with mixed quantization of roughly 3.3 bits per weight, sliding-window 'DFlash2' speculative decoding and a llama.cpp runtime with CUDA on Windows ARM64, and warns that the results reflect a synthetic code-generation workload and may vary depending on the device and configuration.

In practice, GitHub Copilot will offer two routes for using local models in its CLI, in the desktop app and in VS Code: an 'Auto' mode, in which intelligent orchestration decides on its own when to use local or cloud inference over a multi-turn session, preserving useful cached work; and explicit model selection, designed for workflows that require a specific provider, model or endpoint, whether by choosing MAI Code 1.1 Flash through the Windows ML provider or by connecting Copilot to local endpoints compatible with the OpenAI API. The article stresses that moving inference to the device does not simply turn the session 'offline': model selection, inference and tool execution have different boundaries.

The second leg of the announcement is the security of tool execution through sandboxing. Because an agent's shell commands normally inherit the permissions of the account that launches them —something that does not change by running the model locally— GitHub Copilot incorporates Microsoft Execution Containers (MXC), an open-source library from the Windows team that translates an access policy (files, networks, credentials, system capabilities) into native operating-system controls, regardless of which model requested the action. According to the article, on Windows it uses the 'BaseContainer' level of the ProcessContainer backend, on macOS it uses Seatbelt and on Linux, bubblewrap; these local backends do not require a separate virtual machine or container image, though Microsoft says it plans to offer those options in the future through MXC. When sandboxing is active, shell commands and, by default, local Model Context Protocol (MCP) servers and language servers run inside that process boundary; built-in file tools run inside Copilot itself and their requests are checked against the policy in force, though without the process isolation enforced by the operating system, and remote MCP servers fall outside the local process sandbox, with their connection policy checked inside Copilot's own process. Configuration is handled with the `/sandbox` command in the GitHub Copilot CLI.

The article illustrates all this with a practical example: a daily automated job on the open-source `copilot-sdk` repository that generates an HTML triage dashboard every morning at 9:00 (open, closed and merged issues and PRs, labels, authors, stale items, etc.) using only public GitHub metadata, without touching local repos or code, and that appends the results to a history of up to seven days. By turning on the 'Sandbox new sessions' toggle in the GitHub Copilot app, the current working directory stays read/write while the rest of the system remains largely inaccessible, and by selecting the local MAI Code 1.1 Flash model the agent can generate and run scripts to build the dashboard locally, with the sandbox guardrails active, before inspecting the generated result.

Taken together, the announcement —described by Microsoft as 'just the beginning' of this journey— points to a trend that matters for the coding-agent ecosystem: combining hybrid cloud/edge orchestration with model control, and operating-system-level process isolation to contain what an autonomous agent can touch on the developer's machine. The rollout is announced for 'before the end of the month' (relative to the publication date, October 7, 2026), initially tied to the NVIDIA RTX Spark hardware in devices such as the Surface Laptop Ultra.