Major issue with Agent permissions after latest update

[secondl1ght]

Reproduction steps

1. Have this setting disabled (default)

2. Watch Agent run terminal commands without asking for permission

Current vs. Expected behavior

Previously with this setting, all terminal commands would need to be approved by the user in the Agent panel. Now the Agent has free-reign to do whatever it wants, with no way to prevent terminal or other tool calls from being executed.

Zed version and system specs

Zed: v0.220.2+stable.125.bf99a017312d2325476557e590b9dfb4f71241cf (Zed)
OS: Linux Wayland ubuntu 24.04
Memory: 62 GiB
Architecture: x86_64
GPU: AMD Radeon 890M (RADV GFX1150) || radv || Mesa 25.0.7-0ubuntu0.24.04.2

Attach Zed log file

Zed.log

Relevant Zed settings

settings.json

Relevant Keymap

keymap.json

(for AI issues) Model provider details

Anthropic via Zed Pro
Claude Opus 4.5
Agent Panel

If you are using WSL on Windows, what flavor of Linux are you using?

Ubuntu

[SalladinBalwer]

I'm also seeing this.
Zed: v0.220.2+stable.125.bf99a017312d2325476557e590b9dfb4f71241cf (Zed)
OS: macOS 26.2
Memory: 16 GiB
Architecture: aarch64

[benbrandt]

Hey all, just to confirm: Are you using a Zed Agent thread? Or Claude Code?

[secondl1ght]

@benbrandt Zed Agent.

Also looking at the new @rtfeldman commits referencing this issue I see what happened now, but this change was not documented in the release notes when I installed the update, this led to major confusion and scary behavior (appeared that the Agent had gone rogue).

This always allow command that was included is very dangerous! 🚨🚨🚨

f98d44e#diff-42e01d7aacb60673842554e30970b4ddbbaee7a2ec2c6f2be1c0b08b0dd89631L1003

An Agent would be able to add a script that does anything to your package.json and then run it via the run command...

[secondl1ght]

npm run is not a build or test command, it can run any arbitrary script that is defined in your project. Same with pnpm and yarn.

[rtfeldman]

@secondl1ght Yeah this was behind a feature flag, and was removed later, but made it into a stable release. Sorry about that! I'm pushing a revert to stable right now. I'll post here when it lands.

[secondl1ght]

@rtfeldman great thank-you! This is actually a nice feature, but of course major issues with what happened in this case.