Zed 1.14 sandboxes its agent's terminal and fetch tools at the OS level, on by default.

Seatbelt on macOS, Bubblewrap namespaces on Linux, WSL on Windows. Enforced boundaries: no writes outside the project directory, no modification of .git, no network without explicit permission. Zed's stated reasoning is that prompt injection overrides instructions, so restriction has to be enforced by the kernel. First mainstream editor to make agent sandboxing a default rather than a setting, and the "on by default" part is what makes it matter. Opt-in security is security that 4% of users have.