Zed 1.14 introduces OS-enforced sandboxing for the agent panel's terminal and fetch tools, enabled by default. The sandbox prevents agents from writing outside project directories, touching .git, or making network requests without explicit user approval. Implemented via macOS Seatbelt, Linux Bubblewrap (bwrap), and WSL on Windows, it defends against prompt injection attacks where malicious content in reviewed code could hijack an agent. The post details a TOCTOU symlink-swap attack vector that Zed's sandbox catches by failing closed, and honestly acknowledges sandbox limitations — the edit tool, MCP servers, LSP servers, and the regular terminal remain outside the sandbox's scope.
Table of contents
Why sandboxing?Sandboxing in ZedCan't I just tell my agent not to edit certain files?But what about fine-grained rules?Sandboxes are tricky to get rightHow safe is the sandbox?Wrapping upFootnotesBuilding a platform that open sources itselfIntroducing Zed for BusinessIntroducing Parallel Agents in Zed2 Impressions