Zed v1.14 Locks Down AI Agents With OS-Enforced Sandboxing by Default
Zed v1.14 ships OS-enforced sandboxing for its AI agent's terminal and fetch tools, blocking rogue writes and network calls by default
- Zed v1.14 ships OS-enforced sandboxing for the AI agent's
terminalandfetchtools, enabled by default for all users. - Default sandbox blocks writes outside project directories, writes to
.git, and all outbound network requests. - Agents can request elevated permissions with a reason; users choose to allow once, for the thread, always, or deny.
- Platform implementations: macOS uses Seatbelt, Linux uses Bubblewrap (
bwrap), Windows requires WSL. - Sandbox does not cover normal terminal tabs, language servers, extensions, or external agents — only the Zed Agent's built-in tools.
- Also in v1.14: Project Panel undo/redo for file operations, Skip Hooks toggle in Git Panel, configurable Agent Panel fonts. Full changelog
Zed v1.14 is out, and its headline feature is something the agentic coding world has needed for a while: real, OS-enforced sandboxing for the AI agent's terminal and fetch tools. This isn't a prompt telling the model to behave itself. It's the operating system physically blocking access to resources the agent was never supposed to touch.
The problem with trusting your agent
There's a fundamental tension in agentic coding tools. Give the agent too little freedom and you spend your time clicking "approve" on every command. Give it full access and you're one rogue prompt injection away from a bad day. The tension comes from the fact that agents cannot be trusted to determine whether an action is something the user would want. Instruction-following helps, but it's not a guarantee, and it does essentially nothing against prompt injection attacks.
The threat is real and already documented. Perhaps you work on an open source project and you're reviewing a contributor's PR. You open an agent and ask "review this PR". Little do you know, the PR contains a modified AGENTS.md that instructs your agent to upload $MY_SECRET_API_KEY to a server controlled by the attacker. This exact class of attack has already been observed in the wild.
What the sandbox actually does
Sandboxing restricts what the agent is able to do when using the terminal and fetch tools. These restrictions are enforced by the operating system and do not rely on an agent following instructions. The default rules are tight but sensible: