Zed sandboxes the agent's terminal and fetch tools by default

What changed

Zed 1.14 runs the agent’s terminal and fetch tools under OS sandboxing: Seatbelt on macOS and Bubblewrap on Linux (a non-setuid bwrap must be on PATH), with Windows covered only through WSL. By default the agent can’t write outside project folders, can’t write to .git and can’t make network requests; it can ask for more access with a reason, which you allow once, per thread or permanently. The edit tool, ACP agents, language servers, MCP servers and the regular terminal aren’t sandboxed.

Who it affects

All Zed agent users, especially on Linux and Windows where setup is needed.

What to do

Install a non-setuid bwrap on Linux, use WSL shells on Windows, and expect prompts for network access.

Source: https://zed.dev/blog/sandboxing