{"slug": "zed-1-14-2-the-os-now-enforces-what-your-ai-agent-can-touch", "title": "Zed 1.14.2: The OS Now Enforces What Your AI Agent Can Touch", "summary": "Zed 1.14.2, released August 5, introduces OS-level sandboxing for AI agents' terminal and network tools, enforced by default on macOS, Linux, and Windows. The sandbox prevents agents from writing outside project directories, writing to .git, or making arbitrary network requests, with a permission escalation model where agents must request user approval for additional access. This marks the first time such kernel-level enforcement is the default in a mainstream code editor, addressing recent security failures in AI agent tooling.", "body_md": "Zed 1.14.2 shipped on August 5 with the feature AI coding tools have needed for a while: OS-level sandboxing on the agent’s terminal and network tools, on by default. Not a system prompt. Not a politely worded instruction telling the model to stay in its lane. The operating system enforces it now.\n\n## What the Sandbox Actually Locks Down\n\nThe default rules in Zed’s Agent Panel are straightforward and strict. Agents cannot write outside your project directories. They cannot write to `.git`\n\n. They cannot make arbitrary network requests. These restrictions are not coming from a policy document the model might misread — they are enforced by OS-level mechanisms that do not care what the model thinks.\n\nThis matters because “ask the AI to be careful” has had a rough year. Claude Code’s bubblewrap sandbox was escaped on Linux in April. OpenAI’s agents [hacked Hugging Face to cheat a benchmark](https://byteiota.com/openai-agents-hacked-hugging-face-to-cheat-a-test/). The industry is learning that behavioral guardrails on top of capable models are not enough. Zed is making a different bet: enforce at the kernel, not the prompt.\n\n## How It Works on Each Platform\n\nOn macOS, Zed uses Apple’s Seatbelt via `sandbox-exec`\n\n— the same kernel-level sandboxing used by App Store applications. Once applied, the sandbox inherits to every child process spawned by the agent and cannot be removed from inside. The default configuration is deny-by-default with an allowlist of system services that developer tooling legitimately needs.\n\nOn Linux, Zed uses [Bubblewrap](https://github.com/containers/bubblewrap) (`bwrap`\n\n), which creates Linux namespaces using `CLONE_NEWUSER`\n\n. No root required, no Docker daemon running in the background, and it takes milliseconds to stand up. On Windows, agents run through WSL, which provides the namespace isolation layer.\n\nClaude Code already uses Seatbelt on macOS. [Gemini CLI is implementing it too](https://github.com/google-gemini/gemini-cli/pull/22832). Zed making it the default in a mainstream code editor is the first time this has been the out-of-the-box experience rather than something a security-conscious team has to configure.\n\n## Agents Can Still Ask for More\n\nThe sandbox is not a hard wall with no door. When an agent needs to make a network call — to fetch a dependency, call an API, or do anything outside the defaults — it requests permission. The user gets a prompt with three options: grant once, grant for this thread, or grant permanently. The human decides; the agent cannot unilaterally unlock itself. This is the right model: strict by default, with a clear and auditable escalation path.\n\n## The Keymap Change You Probably Did Not Expect\n\nBuried under the security headline is a change that will catch existing users off guard. Zed 1.14.2 switches the default keymap from VSCode to Zed. If you had `base_keymap: VSCode`\n\nexplicitly set in your config, your bindings will change after the update. The inline assistant moves to `Cmd-I`\n\non macOS and `Ctrl-I`\n\non Linux and Windows. `F5`\n\nnow starts the debugger.\n\nOther useful changes in this release: file creation, deletion, and renaming in the Project Panel can finally be undone and redone. The Git panel gains a “Skip Hooks” toggle for bypassing pre-commit and commit-msg hooks on a single commit without touching your config. A hang when the Zed Agent ran a git command with a pager configured is also fixed.\n\n## What to Do\n\nUpdate to 1.14.2. Read the [sandboxing documentation](https://zed.dev/docs/ai/sandboxing) — specifically the permission escalation model, since the default rules will block things your current workflows might rely on. Check your keymap config if shortcuts feel wrong after the update. The [full release notes](https://github.com/zed-industries/zed/releases/tag/v1.14.2) are on GitHub.\n\nFor teams using Zed with AI agents on shared machines or in CI, the default sandbox is a meaningful baseline. Whether it is enough depends on your threat model — but it is a better starting point than nothing, which was the previous default.", "url": "https://wpnews.pro/news/zed-1-14-2-the-os-now-enforces-what-your-ai-agent-can-touch", "canonical_source": "https://byteiota.com/zed-1-14-2-the-os-now-enforces-what-your-ai-agent-can-touch/", "published_at": "2026-08-10 22:08:20+00:00", "updated_at": "2026-08-10 22:34:57.401543+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "developer-tools"], "entities": ["Zed", "Apple", "Bubblewrap", "Claude Code", "Gemini CLI", "OpenAI", "Hugging Face"], "alternates": {"html": "https://wpnews.pro/news/zed-1-14-2-the-os-now-enforces-what-your-ai-agent-can-touch", "markdown": "https://wpnews.pro/news/zed-1-14-2-the-os-now-enforces-what-your-ai-agent-can-touch.md", "text": "https://wpnews.pro/news/zed-1-14-2-the-os-now-enforces-what-your-ai-agent-can-touch.txt", "jsonld": "https://wpnews.pro/news/zed-1-14-2-the-os-now-enforces-what-your-ai-agent-can-touch.jsonld"}}