Zed Editor Ships 1.14.2 with OS-Level AI Agent Sandboxing
Zed Editor 1.14.2 dropped on August 5, 2026, and the headline feature is exactly what you'd expect: the AI agent's terminal and network tools are now locked inside OS-enforced sandboxes. It ships as a default-on patch for the 1.14 stable series, and it represents a meaningful shift from hoping LLMs follow instructions to actually restricting them.
Zed has been pushing hard on AI agent usability since rolling out Parallel Agents back in April. The 1.14 series was always going to be about safety, and 1.14.2 is the stabilization pass that finalizes it. The default rules are pretty strict. Agents can't write outside your project directory, touch .git, or make any network requests. No internet access. That's enforced at the operating system level, not by prompting the model to behave.
How the sandbox actually works
macOS uses Seatbelt out of the box. Linux relies on bubblewrap with user namespaces, which means bwrap needs to be in your $PATH and run without the setuid bit. Windows gets WSL under the hood, which means non-WSL shells on the platform are completely unsupported for sandboxed agents. If an agent needs more access, it asks. You see exactly what it's requesting and why. You can grant it once, for the rest of the thread, or permanently. Agents cannot ask for .git write access directly either, since hook scripts would escape the sandbox entirely.
It's defense in depth. The sandbox only covers the terminal and fetch tools. It does not protect against other agent tools, ACP connections, LSP or MCP servers, or your regular built-in terminal. Zed's blog post spells out a symlink swap race condition as the most likely attack vector, and their implementation fails closed if it catches one. Fair enough.
Everything else in 1.14.2
On top of the sandbox, Zed packed a lot of refinements. AI users get a reasoning effort selector for Anthropic-compatible adaptive thinking models, a new agent.compaction_model setting for context compaction, and customizable fonts for the Agent Panel. The Git panel now has a "Skip Hooks" toggle so you can bypass pre-commit and commit-msg checks for a single push. File creation, deletion, and renaming in the Project Panel can finally be undone and redone. Large files type more responsively, too. If you're behind a corporate proxy, Zed now respects NO_PROXY and percent-encoded credentials.
One thing to watch out for: the default keymap has officially switched from VSCode to Zed. If you explicitly pinned base_keymap: "VSCode", some bindings will still shift because the overlay was tightened to match actual VS Code behavior. Inline Assistant moved to cmd-i on Mac and ctrl-i elsewhere. f5 now launches the debugger. Word navigation got reverted because recent changes caused regressions across brackets and delimiters.
The patch also quietly fixes roughly fifty bugs. Crash loops on launch, WGPU crashes with bidirectional text, terminal processes escaping after the window closes, and stale Git panel state after dropped file watcher events all got addressed. The work came from Zed Industries in partnership with the Zed Guild, with nearly two dozen community contributors getting named credits across the PRs. Not bad for a patch release.
It's a focused drop. You can grab the latest build from the Zed download page or check the GitHub releases for specific patch notes and commit hashes.
