Zed turned on operating-system-level sandboxing by default for its coding assistant's terminal and web-fetch tools, starting with release 1.14. The agent cannot write outside project folders, alter the .git folder, or reach the network unless the user grants permission in response to a prompt that states the reason. The protection does not extend to Zed's file-editing tool, the ordinary terminal, or agents connected through other interfaces.
What changed
Zed relied on the agent following instructions and on pattern-matching rules for terminal commands, which a determined agent could bypass.
What it unlocks
Running Zed's coding agent with terminal and web-fetch access while the operating system itself blocks writes outside the project, writes to .git, and network requests.
- enabled by default from the 1.14 release
What you need to act on it
- Zed 1.14 or later
- on Linux, a working bwrap binary without the setuid bit in $PATH
- on Windows, running inside WSL
- zed.dev2026-08-05