--- title: "Sandboxing — Zed's Blog" url: https://daily.dev/posts/sandboxing-zed-s-blog-nfgnz2mdn source_url: https://zed.dev/blog/sandboxing type: article source: "Zed" published: 2026-08-05T17:02:23.697Z updated: 2026-08-05T17:19:54.089Z tags: ["ai-agents", "prompt-injection", "zed"] reading_time: 9 upvotes: 2 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Sandboxing — Zed's Blog **[Zed](https://daily.dev/sources/zed)** · 9 min read · 2 upvotes · 0 comments ## Summary Zed 1.14 introduces OS-enforced sandboxing for the agent panel's terminal and fetch tools, enabled by default. The sandbox prevents agents from writing outside project directories, touching .git, or making network requests without explicit user approval. Implemented via macOS Seatbelt, Linux Bubblewrap (bwrap), and WSL on Windows, it defends against prompt injection attacks where malicious content in reviewed code could hijack an agent. The post details a TOCTOU symlink-swap attack vector that Zed's sandbox catches by failing closed, and honestly acknowledges sandbox limitations — the edit tool, MCP servers, LSP servers, and the regular terminal remain outside the sandbox's scope. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Implementing a secure sandbox for local agents · Cursor](https://daily.dev/posts/implementing-a-secure-sandbox-for-local-agents-cursor-k9xthzl85) · Cursor · 1 upvotes · 0 comments - [BubbleWrap your dev env and agents](https://daily.dev/posts/bubblewrap-your-dev-env-and-agents-ydwxzef1o) · Lobsters · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#zed](https://daily.dev/tags/zed) [View this post on daily.dev](https://daily.dev/posts/sandboxing-zed-s-blog-nfgnz2mdn)