August 2026 Summaries

Zed 1.14 enables operating-system-enforced sandboxing by default for its agent panel’s terminal and fetch tools, restricting writes outside project directories, changes to .git, and network access unless users grant temporary or permanent elevated permissions with an accompanying reason. Implemented through macOS Seatbelt, Linux namespaces via Bubblewrap, and WSL on Windows, the feature is intended to provide stronger protection than instruction-following or command-based rules, particularly against prompt injection and malicious project files. The discussion highlights the complexity of secure sandbox design through a potential symlink-swap time-of-check-time-of-use attack, which Zed addresses by failing closed, while emphasizing that even narrow timing vulnerabilities must be treated seriously. Sandboxing is presented as one defense-in-depth layer rather than comprehensive protection, since other editing tools, external terminals, language servers, build scripts, procedural macros, and Git hooks may still execute harmful code outside its scope.