I run these things in VMs, and as a user in the VM, and give them access to just the tree I want to work on via mounting. I use Parallels on macOS for this but any VM will do.

That way my actual primary machine is at least strongly isolated. I also run them on VMs on my home Proxmox box.

Zed, as an IDE, can connect to a VM via ssh and both edit and run things like Claude or its built-in agentic harness on your code with the stuff running in the VM.

That way if an AI goes Skynet all over the machine, it's at least isolated. There's malicious injection attacks but there's also edge case failures I've seen where the AI decides it "needs" to do something asinine.