Zed 1.14.2: OS-Level AI Agent Sandboxing Arrives

Zed 1.14.2, released August 5, is the first major AI coding editor to sandbox its agent’s terminal commands at the OS level. Not by prompting the model to behave — by running it through macOS Seatbelt, Linux bubblewrap, or Windows WSL so the kernel enforces the restrictions. If your Zed agent tries to write outside your project directory or phone home without approval, it will be blocked regardless of what the prompt says.

What “OS-Level” Actually Means Here

Every other major AI coding editor — Cursor, GitHub Copilot, Claude Code — handles local agent security through instruction-following: the model is told not to exfiltrate files. That works until it doesn’t, and in 2026 it is not working well. OWASP’s latest report tracked prompt injection attacks at 340% year-over-year growth, and real CVEs in Cursor and GitHub Copilot already showed that malicious source code can hijack agent terminal sessions without any user interaction.

Zed’s sandbox applies to two agent tools only: terminal (shell commands the agent runs) and fetch (outbound HTTP/S requests). Language servers, extensions, regular terminal tabs, and Terminal Threads all run with your full user permissions. That is worth understanding before you assume this release closes every door.

What the Agent Can and Cannot Do by Default

Out of the box, a sandboxed Zed agent can read most of your filesystem, write inside open project directories, and access a temporary directory per thread. What it cannot do: write outside those directories, make outbound network requests, or open Unix-domain sockets. Writes to .git directories are blocked and cannot be unlocked even with explicit approval — a deliberate design choice to prevent history tampering.

When the agent hits a restriction, Zed prompts with three options: approve for this action only, approve for the current thread, or approve always (which writes persistently to settings.json). Start with single-action approvals for anything that reaches outside the project or makes a network call you did not expect.

How to Configure Persistent Permissions

Pre-approving known-safe hosts and paths eliminates repeated prompts on common workflows. Add a sandbox_permissions block to your settings.json:

{
  "agent": {
    "sandbox_permissions": {
      "network_hosts": ["github.com", "*.npmjs.org"],
      "write_paths": ["/Users/you/.cache/my-tool"],
      "allow_all_hosts": false,
      "allow_unsandboxed": false
    }
  }
}

Use exact hostnames or leading-wildcard patterns for network hosts. Keep allow_all_hosts and allow_unsandboxed at false. Flipping either to true defeats the point of the feature.

Platform Setup

macOS: Works immediately after updating. Zed uses sandbox-exec with Apple’s Seatbelt framework. Approved network access routes through an HTTP proxy so you whitelist specific hosts rather than opening everything.

Linux: Requires a non-setuid bwrap binary on your $PATH. On Ubuntu 23.10 and later, AppArmor restricts unprivileged user namespaces by default, which breaks bubblewrap with a Permission denied error. Install the AppArmor profile to fix it:

sudo apt install bubblewrap apparmor-utils
sudo install -m 0644 /usr/share/apparmor/extra-profiles/bwrap-userns-restrict   /etc/apparmor.d/bwrap-userns-restrict
sudo apparmor_parser -r /etc/apparmor.d/bwrap-userns-restrict

Windows: Sandboxing only functions inside WSL. Native Windows shells get no protection. NTFS paths can escape sandbox grants due to WSL’s implementation limits — documented by Zed and difficult to exploit in practice, but not impossible.

What This Does Not Protect Against

The primary escape vector is config file poisoning. A malicious repository can embed a payload in a Makefile, a Rust procedural macro, or a Git submodule config. When the agent runs make or triggers a build, those commands execute outside the sandbox. The sandbox covers what the agent directly invokes via its terminal tool — not what those commands spawn in turn.

Zed’s own documentation is direct about this: “A sandbox is not a substitute for good security practices. It is one layer in a defense-in-depth strategy.” The right mental model is a blast radius reduction, not a closed perimeter.

Other Changes in 1.14.2

The release swaps the default keymap from VSCode to Zed — a breaking change if you relied on the VSCode layout. The inline assistant moves to Cmd+I/Ctrl+I and the debugger to F5. A Skip Hooks toggle now appears on the commit panel for bypassing pre-commit and commit-msg hooks, the Project Panel gains undo/redo for file operations, and there is a new reasoning effort selector for Anthropic-compatible models with adaptive thinking. The full release notes list roughly 60 additional bug fixes.

Enable It Now

Update to 1.14.2, run the Ubuntu AppArmor fix if you are on Linux, and set sandbox_permissions narrowly. Default-deny on network and filesystem writes is the right starting point — grant access as you hit legitimate agent needs, not in advance. OS-level sandboxing does not close every hole, but it meaningfully raises the cost of exploitation compared to instruction-following alone.