Coding agents now ship sandboxes. Public buyers should set the defaults.
Claude Code, Codex and Copilot all offer permission and sandbox controls, but they start from different defaults. Agencies should decide them rather than inherit them.
AI coding agents that read a repository, run commands and propose changes are among the most visible examples of AI agents at work. For a public agency the question is no longer whether such a tool can work unattended, but what it is allowed to touch while it does.
A comparison published in October 2026 shows how far the defaults differ. OpenAI's Codex CLI runs sandboxed by default, with network access off until it is enabled. Claude Code ships a sandbox that is off by default and can be required through managed settings. GitHub Copilot CLI's local sandbox is also off by default, with outbound network access on.
ESS view: an agency adopting any of these tools should treat the sandbox, the network allowlist and the approval mode as procurement requirements, enforced through managed settings, rather than leave them to each user's configuration.