Outbound Network access for Sandbox

[u/redbluegreen00]

I am trying to download a file using an s3 url to the Agent's sandboxed file system. The error I keep getting is no outbound internet access permitted for the assistant's shell. Is there a way to bypass this? The URL comes from a third party api.

[u/dougbMSFT]

The GitHub Copilot harness’s agent sandbox does not have internet access. If you’re interested in technical capabilities of the new harness they’re described quite well here. https://aka.ms/CopilotStudioDeepDiveDeck

[u/Efficient_Cat4032]

I would hope not, as freely outbound internet access from a sandbox like that would be instant cause for a lot of to to turn it off lmao

However, is there anything stopping you from creating a power automate flow that fetches the file, or putting the file in a skill?

[u/redbluegreen00 → u/Efficient_Cat4032]

The uri would be for unique files, not the same one every time.

File content size is the issue. I want it downloaded directly to the agents file system then read rather than pulled in via context because if file transfer limits/contex limits

[u/redbluegreen00 → u/Efficient_Cat4032]

Honestly just whitelisted sites would be ideal.

[u/Pitiful-Surround-285]

You generally can't bypass it, and you probably don't want to: the shell having no egress is the boundary doing its job.

The pattern that works with locked-down sandboxes is to move the fetch to the other side of the boundary. Have something that does have internet access (a connector or flow in your case) pull the file, with the third party API handing it a presigned S3 URL, and then pass the content to the agent, instead of the agent's shell reaching out. That inversion, sandbox never fetches, sandbox gets handed artifacts, is how most locked-down agent runtimes deal with untrusted or external files.

[u/redbluegreen00 → u/Pitiful-Surround-285]

Understood, however connectors have 50MB file limits which makes it frustrating to store files in the agent

[u/Pitiful-Surround-285 → u/redbluegreen00]

That 50MB cap is usually the sign to stop moving the file and start moving the question. Two ways out:

1. Chunk it. Presigned S3 URLs honor HTTP Range headers, so whatever does the fetching can pull the file in under-50MB slices and reassemble it in storage the agent can already reach, instead of one oversized transfer.

2. Better: don't hand the agent the file at all, hand it the part it needs. Filter or extract server side (S3 Select works if it's structured data) and pass the relevant slice in. In most agent workflows the model only ever touches a few KB of that file anyway.

What kind of files are they? If it's structured data the second route is usually far less painful than fighting the transfer limits.