Zed v1.14 Locks Down AI Agents With OS-Enforced Sandboxing by Default
Zed v1.14 ships OS-enforced sandboxing for its AI agent's terminal and fetch tools, blocking rogue writes and network calls by default
- Zed v1.14 ships OS-enforced sandboxing for the AI agent's
terminalandfetchtools, enabled by default for all users. - Default sandbox blocks writes outside project directories, writes to
.git, and all outbound network requests. - Agents can request elevated permissions with a reason; users choose to allow once, for the thread, always, or deny.
- Platform implementations: macOS uses Seatbelt, Linux uses Bubblewrap (
bwrap), Windows requires WSL. - Sandbox does not cover normal terminal tabs, language servers, extensions, or external agents — only the Zed Agent's built-in tools.
- Also in v1.14: Project Panel undo/redo for file operations, Skip Hooks toggle in Git Panel, configurable Agent Panel fonts. Full changelog
Zed v1.14 ships with OS-enforced sandboxing for the AI agent's terminal and fetch tools. The operating system physically blocks access to resources the agent was never supposed to touch, with no reliance on the model following instructions.
Why trusting your agent isn't enough
Agentic coding tools carry a structural tension: give the agent too little freedom and you spend your time approving every command; give it full access and a single rogue prompt injection can cause real damage. Instruction-following helps, but it offers no protection against prompt injection attacks, where malicious content in the environment hijacks what the agent does next.
The threat is already documented. Imagine reviewing a contributor's PR on an open source project. You open an agent and ask it to review the diff. The PR contains a modified AGENTS.md that instructs your agent to upload $MY_SECRET_API_KEY to an attacker-controlled server. This class of attack has been observed in the wild.
What the sandbox actually does
The sandbox restricts what the agent can do when using the terminal and fetch tools. Enforcement happens at the OS level. The default rules are tight:
- No writes outside project directories