Sandboxing

Zed 1.14 enables operating-system-enforced sandboxing by default for its agent panel’s terminal and fetch tools, restricting writes outside project directories, changes to .git, and network access unless users grant temporary or permanent elevated permissions with an accompanying reason. Implemented through macOS Seatbelt, Linux namespaces via Bubblewrap, and WSL on Windows, the feature is intended to provide stronger protection than instruction-following or command-based rules, particularly against prompt injection and malicious project files. The discussion highlights the complexity of secure sandbox design through a potential symlink-swap time-of-check-time-of-use attack, which Zed addresses by failing closed, while emphasizing that even narrow timing vulnerabilities must be treated seriously. Sandboxing is presented as one defense-in-depth layer rather than comprehensive protection, since other editing tools, external terminals, language servers, build scripts, procedural macros, and Git hooks may still execute harmful code outside its scope.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.