GitHub Copilot CLI v1.0.72 & v1.0.73: Critical Infinite-Loop Fix and Sandbox Security Tightening
Two back-to-back Copilot CLI releases fix a dangerous agentStop infinite-loop bug, tighten macOS sandbox defaults, and patch Anthropic subagent reliability.
GitHub Copilot CLI shipped two back-to-back releases on July 20 and 21, 2026. Together, v1.0.72 and v1.0.73 close a critical stability hole in the hooks system, tighten sandbox security defaults on macOS, and patch a reliability issue affecting Anthropic-powered subagents. If you use custom hooks or work in multi-directory setups, these are worth paying attention to.
The Big One: agentStop Hooks No Longer Loop Forever
The hooks system in Copilot CLI lets you attach custom shell commands to lifecycle events: session start and end, before and after tool use, when a prompt is submitted, and when the agent stops a turn. That last one, agentStop, is the one that bit people.
If you wrote an agentStop hook that always returned a “block” signal, telling the agent to continue rather than stop, the CLI had no way out. It would keep calling the hook indefinitely. No cap, no escape hatch. For anyone using hooks for logging, security scanning, or approval gating, a single logic error in that hook could lock the process in a permanent spin.
v1.0.72 fixes this with a two-part solution. The CLI now enforces a hard limit of 8 consecutive blocks from an agentStop hook. After that, it forces a stop regardless. At the same time, hooks now receive a stop_hook_active flag when the CLI is in that forced-continuation state. A well-written hook can check for that flag and exit cleanly instead of blocking again, which means you have a graceful way to handle the edge case rather than just hitting a wall at block number 8.
If you maintain agentStop hooks, the practical advice is simple: add a check for stop_hook_active and make sure your hook returns a non-blocking signal when it’s set. That way your hook behaves correctly in both the normal flow and the forced-stop scenario.
macOS Keychain Access Now Defaults to Off
Previously, the OS sandbox on macOS allowed Keychain access by default. From v1.0.72 onwards, that access is off unless you explicitly enable it via /sandbox. The change tightens isolation so that sandboxed commands cannot reach Keychain credentials unless there is a deliberate decision to allow it.
For most workflows this will be invisible. If a specific command you run inside the sandbox does need Keychain access, you can re-enable it through /sandbox settings. The trade-off is a slightly more intentional setup for those edge cases versus tighter default isolation for everyone else, which is a reasonable direction for a tool handling code and credentials.
Opt-In git and gh Authentication Inside the Sandbox
On the authentication side, v1.0.72 adds opt-in git and gh credential access inside the OS sandbox. Previously, running authenticated git or GitHub CLI operations inside the sandboxed environment was awkward because the sandbox did not pass through those credentials by default. Now it can, but you have to opt in explicitly. That keeps the default posture locked down while giving teams a supported path for workflows that genuinely need it.
This follows the same pattern as the Keychain change: default closed, deliberately open when needed.
Anthropic Subagent Fix in v1.0.73
The follow-up release on July 21 focused on Anthropic-powered subagents. When you have additional directories configured alongside your main workspace, Anthropic subagents were failing to work correctly across those directories. v1.0.73 fixes that, so multi-directory setups now behave consistently regardless of which model is powering the subagent.
The same release also fixes how relative links in custom agent instruction files are resolved. Previously those links were resolved from the wrong base path. They now resolve from the location of the agent file itself, which is the behaviour you would expect.
A Few Other Fixes Worth Knowing About
Hook commands run in the right directory. After using /cd to switch directories, lifecycle and subagent hook commands now run in the current session directory rather than the original one. This was a subtle but impactful bug for anyone using hooks in multi-directory workflows.
Cross-repo approval isolation. Command approvals no longer carry over when you switch repositories with /cd. Previously, a tool call approved in one repo context could persist into a different repo after a directory switch. That is now fixed, and approvals are scoped correctly to the repository context they were granted in.
MCP server handling. Deleting an MCP server with /mcp delete now stops its running background process rather than leaving it orphaned. Toggling /sandbox restarts only local MCP servers and leaves remote servers connected, avoiding unnecessary disruption to remote connections when you toggle sandbox state.
Windows browser fix. The “Open in web” action from the GitHub tab now reliably launches the browser on Windows.
Prompt preservation. Content you have pasted into the prompt is preserved when you switch models using Ctrl+X /model, so you do not lose your work mid-session.
What This Means for You
The agentStop infinite-loop fix is the most urgent change here. If you have hooks in production, check them. Specifically, any agentStop hook that could block unconditionally under certain conditions should be updated to check the stop_hook_active flag and handle the forced-stop case explicitly. The CLI will now protect you from a full hang, but a hook that hits the 8-block cap and then gets force-stopped may not behave the way you intended.
For macOS users, the Keychain default change is worth a quick audit. If any of your sandboxed workflows rely on Keychain access, you will need to re-enable it manually. It will not break silently, but it is the kind of thing that can catch you off guard after an update.
For teams using Anthropic models with subagents across multi-directory workspaces, v1.0.73 should resolve the failures you may have been seeing. No configuration changes needed, the fix is in the runtime.
These releases are available across all Copilot subscription tiers, including Free, Pro, Pro+, Business, and Enterprise. Update via your usual gh extension upgrade flow to pick them up.