--- title: Sandboxing — Zed's Blog | daily.dev description: Zed 1.14 introduces OS-enforced sandboxing for the agent panel's terminal and fetch tools, enabled by default. The sandbox prevents agents from writing outside... canonical: https://daily.dev/posts/sandboxing-zed-s-blog-nfgnz2mdn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Sandboxing — Zed's Blog | daily.dev og:description: Zed 1.14 introduces OS-enforced sandboxing for the agent panel's terminal and fetch tools, enabled by default. The sandbox prevents agents from writing outside... og:url: https://daily.dev/posts/sandboxing-zed-s-blog-nfgnz2mdn og:image: https://api.daily.dev/og/posts/NfGnZ2MdN.png og:image:alt: Sandboxing — Zed's Blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Sandboxing — Zed's Blog **[Zed](https://daily.dev/sources/zed)** · 9 min read · 2 upvotes · 0 comments ## Summary Zed 1.14 introduces OS-enforced sandboxing for the agent panel's terminal and fetch tools, enabled by default. The sandbox prevents agents from writing outside project directories, touching .git, or making network requests without explicit user approval. Implemented via macOS Seatbelt, Linux Bubblewrap (bwrap), and WSL on Windows, it defends against prompt injection attacks where malicious content in reviewed code could hijack an agent. The post details a TOCTOU symlink-swap attack vector that Zed's sandbox catches by failing closed, and honestly acknowledges sandbox limitations — the edit tool, MCP servers, LSP servers, and the regular terminal remain outside the sandbox's scope. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does Zed's sandboxing feature restrict for AI agents starting in version 1.14? Starting with the 1.14 release, Zed enables sandboxing by default for the agent panel's terminal and fetch tools, enforced at the operating system level rather than by agent compliance. Default rules forbid writing outside project directories, writing to .git, or making network requests. Agents can request temporary privilege escalation, showing the user which privileges are requested and why. _daily.dev surfaces coverage like this for developers hardening their AI agent workflows against unsafe defaults._ ### How does Zed implement agent sandboxing on macOS, Linux, and Windows? Zed implements sandboxing using native operating system APIs: Seatbelt on macOS, Linux namespaces via the Bubblewrap (bwrap) tool, and WSL on Windows, meaning non-WSL shells on Windows do not support sandboxing. Linux and WSL users need a working bwrap binary without the setuid bit set available in their PATH for sandboxing to function. _engineers comparing agent sandboxing approaches across platforms can track these implementation details on daily.dev._ ### What is the symlink swap TOCTOU attack against agent sandboxes and does Zed block it? The symlink swap attack exploits a time-of-check-time-of-use gap: a malicious agent requests write access to a subdirectory, then races to replace that directory with a symlink to a sensitive path before the sandbox tool (bwrap) mounts it, potentially gaining write access to files like SSH authorized_keys. Zed's sandbox catches this attack and fails closed, blocking the untrusted command rather than executing it. _security-minded developers evaluating agent sandbox robustness can follow writeups like this via daily.dev._ ## Similar posts on daily.dev - [Implementing a secure sandbox for local agents · Cursor](https://daily.dev/posts/implementing-a-secure-sandbox-for-local-agents-cursor-k9xthzl85) · Cursor · 1 upvotes · 0 comments - [Package Manager Sandboxing](https://daily.dev/posts/package-manager-sandboxing-rxvo2u0vl) · Andrew Nesbitt · 0 upvotes · 0 comments - [BubbleWrap your dev env and agents](https://daily.dev/posts/bubblewrap-your-dev-env-and-agents-ydwxzef1o) · Lobsters · 0 upvotes · 0 comments - [Sandboxing AI agents in Linux](https://daily.dev/posts/sandboxing-ai-agents-in-linux-8gbhps1vs) · Hacker News · 0 upvotes · 1 comments - [I gave Claude Code its own disposable computer, and stopped caring what it installed](https://daily.dev/posts/i-gave-claude-code-its-own-disposable-computer-and-stopped-caring-what-it-installed-iqddqhras) · XDA Developers · 2 upvotes · 1 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#zed](https://daily.dev/tags/zed) [View this post on daily.dev](https://daily.dev/posts/sandboxing-zed-s-blog-nfgnz2mdn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Sandboxing — Zed's Blog","url":"https://daily.dev/posts/sandboxing-zed-s-blog-nfgnz2mdn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sandboxing-zed-s-blog-nfgnz2mdn"},"datePublished":"2026-08-05T17:02:23.697Z","dateModified":"2026-09-14T09:00:26.227Z","description":"Zed 1.14 introduces OS-enforced sandboxing for the agent panel's terminal and fetch tools, enabled by default. The sandbox prevents agents from writing outside...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a118b2202374d16a57ff5df9360b040e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a118b2202374d16a57ff5df9360b040e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Zed","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Zed","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/6048f0f184b149f394a08a0f835fd052","url":"https://daily.dev/sources/zed"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sandboxing-zed-s-blog-nfgnz2mdn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,prompt-injection,zed","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Zed","item":"https://daily.dev/sources/zed"},{"@type":"ListItem","position":3,"name":"Sandboxing — Zed's Blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/sandboxing-zed-s-blog-nfgnz2mdn#faq","mainEntity":[{"@type":"Question","name":"What does Zed's sandboxing feature restrict for AI agents starting in version 1.14?","acceptedAnswer":{"@type":"Answer","text":"Starting with the 1.14 release, Zed enables sandboxing by default for the agent panel's terminal and fetch tools, enforced at the operating system level rather than by agent compliance. Default rules forbid writing outside project directories, writing to .git, or making network requests. Agents can request temporary privilege escalation, showing the user which privileges are requested and why. daily.dev surfaces coverage like this for developers hardening their AI agent workflows against unsafe defaults."}},{"@type":"Question","name":"How does Zed implement agent sandboxing on macOS, Linux, and Windows?","acceptedAnswer":{"@type":"Answer","text":"Zed implements sandboxing using native operating system APIs: Seatbelt on macOS, Linux namespaces via the Bubblewrap (bwrap) tool, and WSL on Windows, meaning non-WSL shells on Windows do not support sandboxing. Linux and WSL users need a working bwrap binary without the setuid bit set available in their PATH for sandboxing to function. engineers comparing agent sandboxing approaches across platforms can track these implementation details on daily.dev."}},{"@type":"Question","name":"What is the symlink swap TOCTOU attack against agent sandboxes and does Zed block it?","acceptedAnswer":{"@type":"Answer","text":"The symlink swap attack exploits a time-of-check-time-of-use gap: a malicious agent requests write access to a subdirectory, then races to replace that directory with a symlink to a sensitive path before the sandbox tool (bwrap) mounts it, potentially gaining write access to files like SSH authorized_keys. Zed's sandbox catches this attack and fails closed, blocking the untrusted command rather than executing it. security-minded developers evaluating agent sandbox robustness can follow writeups like this via daily.dev."}}]} ```