GitHub Copilot has announced automatic selection of device or cloud execution for models. Developers must assess that choice separately from the permissions granted to commands.
1. Automatic routing is planned by late October
Microsoft’s October 7, 2026 announcement said automatic routing was planned for rollout by the end of that month. Local models and sandboxed tools are rolling out gradually. This does not mean they are fully deployed or local inference is the default. A sandbox is an execution area that restricts the files and networks commands can access.
The [“Two ways to use local models” section](https://commandline.microsoft.com/local-models-sandboxed-tools-github-windows/) lists Copilot CLI, the desktop app, and Visual Studio Code (VS Code) as supported interfaces.
Automatic mode chooses where to run based on task context and the state of previously computed information across conversation turns. Developers can still select a local model manually.
2. Assess local model size alongside task performance
The local version of MAI Code 1.1 Flash reduces memory use through quantization, which lowers numerical precision. It also uses speculative decoding: the main model verifies output segments proposed by a smaller model. Microsoft, its developer, says this combination improves responsiveness.
Context length is the amount of input and conversation handled at once. Tokens are text-processing units, and k denotes thousands, so 256k means 256,000 tokens.
The Surface Laptop Ultra used in [Microsoft’s device measurements](https://commandline.microsoft.com/local-models-sandboxed-tools-github-windows/) had up to 128GB of unified memory. This is physical memory shared by the CPU and GPU. The first shipping model used up to 75.5GB at a context length of 256k. Its model file was 53GB, 80% smaller than the high-precision cloud version.
Task success check: switching from the original model to the on-device quantized model changed SWE-Bench Verified scores from 72.6% to 70.80%. Terminal-Bench 2.1, an evaluation of terminal tasks, changed from 62.9% to 66.29%. These opposite shifts mean the performance impact of reducing size cannot be characterized in a single direction.
Throughput was measured on October 5, 2026, using llama.cpp·CUDA runtimes on Windows 64-bit Arm with sliding-window speculative decoding. It reached 923.5 tokens per second at 64k. However, the main text calls this input throughput, while the test notes call it output generation throughput, leaving the measurement type unclear. This figure alone cannot establish the extent of any improvement in perceived responsiveness.
Available runtime capacity cannot be judged from file size alone. The operating system and development tools also use memory, and speculative decoding needs extra working memory. The cache storing computation states for previous tokens also grows with context length.
3. Multi-model research results differ from local execution performance
Project HydraFusion, unveiled by GitHub on September 4, 2026, is a research preview of multi-model orchestration. It chooses between solving a task with one model, escalating to a stronger model if a draft falls short, or revising after another model reviews it. The October announcement outlined extending this approach to local and cloud execution.
In [HydraFusion’s offline evaluation](https://github.blog/ai-and-ml/github-copilot/project-hydrafusion-frontier-quality-via-multi-model-orchestration/), estimated terminal task costs fell 67% versus Claude Opus 5. The share of tasks verified as correct rose 4.9 percentage points.
The cost estimate includes drafting, review, revision, escalation to stronger models, retries, and fallback runs. It is neither the price of a single model call nor the total operating cost of a local device.
Evaluation check: the tests used TerminalBench 2.1, DeepSWE, and CheckpointBench. The last is an internal evaluation based on real Copilot sessions. The researchers iteratively tuned configurations using all three evaluation sets. The results reflect the best configuration with inference settings at the same “medium” level. Inputs, tools, execution limits, pricing, and scoring conditions were also standardized. These results are tied to those evaluation versions and model configurations. They cannot be directly compared with real-world costs or speeds of on-device models.
The research preview recommends starting with clearly scoped coding tasks that can be assigned in a single initial request. Performance across extended, multi-turn conversations is a target for future improvement.
This command enables experimental features in the CLI.
/experimental on4. Sandboxes restrict tool permissions, not models
[Microsoft Execution Containers](https://blogs.windows.com/windowsdeveloper/2026/10/07/microsoft-execution-containers-policy-driven-containment-for-ai-agents/) became generally available on October 7. They isolate tool execution. Developers or organizations define allowed files and network destinations, and the operating system enforces those boundaries. The work area is defined externally so agents cannot expand their own permissions.
Copilot uses lightweight process isolation on Windows. Enabling the sandbox isolates shell commands and, by default, local tool servers and language servers.
According to [Copilot’s isolation scope](https://commandline.microsoft.com/local-models-sandboxed-tools-github-windows/), built-in file tools undergo policy checks inside the assistant. They are not child processes isolated by the operating system. Remote tool servers are also outside the local sandbox.
Local inference does not mean the entire session runs offline. The dashboard example also uses issue and pull request information from external services, so it does not guarantee offline operation.
5. Manual local model selection is also supported
Manual selection is supported through Windows Machine Learning providers or OpenAI-compatible local endpoints.
Adoption decisions should assess model execution location, task completion capability, and permission boundaries for each tool separately.