Zed 1.14 Sandboxes Its Agent's Terminal and Fetch Tools at the OS Level, On by Default

Zed Blog·medium signalXBlueskyLinkedInCopy link

Zed shipped OS-level sandboxing for the agent panel's terminal and fetch tools on August 5, enabled by default for all users in version 1.14 — Seatbelt on macOS, Bubblewrap namespaces on Linux (requires bwrap without the setuid bit), WSL on Windows with non-WSL shells unsupported. The enforced boundaries: no writes outside the project directory, no modification of .git, no network requests without explicit permission. Zed's stated rationale is that agents cannot be reliably restricted through instructions because prompt injection overrides guidelines, so the restriction has to be enforced by the kernel — the first mainstream editor to make agent sandboxing a default rather than an opt-in setting.