Image: Zed / zed.dev Zed 1.14 Preview Adds OS-Level Sandboxing for the Agent's Terminal and Fetch Tools
Zed's latest preview release restricts what the AI agent can do in the terminal and on the network using native OS sandbox mechanisms — Seatbelt on macOS, Bubblewrap on Linux. Also: Skip Hooks, undo/redo for file ops, and adaptive thinking toggles.
Zed 1.14.1 preview, released July 29, adds something most AI coding tools haven’t shipped yet: OS-level sandboxing for the agent’s terminal and network access.
When an agent runs a terminal command or makes a fetch request inside Zed, the sandbox now restricts what it can actually do. On macOS, Zed uses Apple’s Seatbelt (sandbox-exec). On Linux, it uses Bubblewrap. Windows support runs through WSL. The restrictions are enforced at the operating system level — the agent isn’t just being asked to stay in bounds, it’s being prevented from leaving them.
What the sandbox blocks
By default, the sandboxed environment:
- Blocks writes outside the project directory and temporary locations
- Prevents outbound network connections unless explicitly approved
- Keeps the
.gitdirectory readable but not writable - Blocks access to Unix-domain sockets
The key case this addresses is a runaway or compromised agent that tries to exfiltrate code, write outside its workspace, or make unauthorized network calls during a long task. Without sandboxing, an agent with terminal access is operating under the same permissions as the user who launched it.
One clarification from the docs: sandboxing only applies to Zed Agent. It doesn’t cover language servers, extensions, regular terminal tabs, or external agents plugged in via the Agent Client Protocol. Those side channels remain unsandboxed.
Other features in 1.14.1
The preview also adds a Skip Hooks toggle when committing through Zed. If you have pre-commit or commit-msg hooks that run slowly (or that you want to bypass in specific situations), you can now skip them from the Git panel without dropping to the terminal.
Undo/redo for file operations in the Project Panel is new. If the agent creates, renames, or deletes files, you can reverse those operations directly from the panel instead of digging through history or undoing them manually.
There’s also a reasoning effort selector for Anthropic-compatible providers, surfaced when the selected model supports adaptive thinking. You can now pick effort level (low, medium, high) from within the editor rather than editing config manually.
And Agent Panel fonts are now configurable — a small thing that matters when you’re spending hours in the panel during long agent sessions.
When this lands in stable
1.14.1 is currently preview-only. The previous cycle moved features from preview to stable within about a week — 1.13.1 stable and 1.14.1 preview both shipped July 29. If the pattern holds, sandboxing could land in stable by early to mid-August.
Sources: Zed releases/preview · Zed sandboxing docs · Releasebot Zed updates