diff --git a/src/client/chat/configurePythonEnvTool.ts b/src/client/chat/configurePythonEnvTool.ts
index 6117285a523e..9f18d1480291 100644
--- a/src/client/chat/configurePythonEnvTool.ts
+++ b/src/client/chat/configurePythonEnvTool.ts
@@ -19,6 +19,7 @@ import { TerminalCodeExecutionProvider } from '../terminals/codeExecution/termin
 import {
     getEnvDetailsForResponse,
     getToolResponseIfNotebook,
+    getUntrustedWorkspaceResponse,
     IResourceReference,
     isCancellationError,
     raceCancellationError,
@@ -54,6 +55,9 @@ export class ConfigurePythonEnvTool implements LanguageModelTool<IResourceRefere
         options: LanguageModelToolInvocationOptions<IResourceReference>,
         token: CancellationToken,
     ): Promise<LanguageModelToolResult> {
+        if (!workspace.isTrusted) {
+            return getUntrustedWorkspaceResponse();
+        }
         const resource = resolveFilePath(options.input.resourcePath);
         const notebookResponse = getToolResponseIfNotebook(resource);
         if (notebookResponse) {
diff --git a/src/client/chat/createVirtualEnvTool.ts b/src/client/chat/createVirtualEnvTool.ts
index 78e3a5263d81..87f57ccd4ec3 100644
--- a/src/client/chat/createVirtualEnvTool.ts
+++ b/src/client/chat/createVirtualEnvTool.ts
@@ -21,6 +21,7 @@ import {
     doesWorkspaceHaveVenvOrCondaEnv,
     getDisplayVersion,
     getEnvDetailsForResponse,
+    getUntrustedWorkspaceResponse,
     IResourceReference,
     isCancellationError,
     raceCancellationError,
@@ -69,6 +70,9 @@ export class CreateVirtualEnvTool implements LanguageModelTool<ICreateVirtualEnv
         options: LanguageModelToolInvocationOptions<IResourceReference>,
         token: CancellationToken,
     ): Promise<LanguageModelToolResult> {
+        if (!workspace.isTrusted) {
+            return getUntrustedWorkspaceResponse();
+        }
         const resource = resolveFilePath(options.input.resourcePath);
         let info = await this.getPreferredEnvForCreation(resource);
         if (!info) {
diff --git a/src/client/chat/getExecutableTool.ts b/src/client/chat/getExecutableTool.ts
index 125e3a1f98da..8c1bed632384 100644
--- a/src/client/chat/getExecutableTool.ts
+++ b/src/client/chat/getExecutableTool.ts
@@ -10,6 +10,7 @@ import {
     LanguageModelToolInvocationPrepareOptions,
     LanguageModelToolResult,
     PreparedToolInvocation,
+    workspace,
 } from 'vscode';
 import { PythonExtension } from '../api/types';
 import { IServiceContainer } from '../ioc/types';
@@ -19,6 +20,7 @@ import {
     getEnvDisplayName,
     getEnvironmentDetails,
     getToolResponseIfNotebook,
+    getUntrustedWorkspaceResponse,
     IResourceReference,
     raceCancellationError,
 } from './utils';
@@ -45,6 +47,10 @@ export class GetExecutableTool implements LanguageModelTool<IResourceReference>
         options: LanguageModelToolInvocationOptions<IResourceReference>,
         token: CancellationToken,
     ): Promise<LanguageModelToolResult> {
+        if (!workspace.isTrusted) {
+            return getUntrustedWorkspaceResponse();
+        }
+
         const resourcePath = resolveFilePath(options.input.resourcePath);
         const notebookResponse = getToolResponseIfNotebook(resourcePath);
         if (notebookResponse) {
diff --git a/src/client/chat/getPythonEnvTool.ts b/src/client/chat/getPythonEnvTool.ts
index 5ec8e77c6c1e..75bb5035b557 100644
--- a/src/client/chat/getPythonEnvTool.ts
+++ b/src/client/chat/getPythonEnvTool.ts
@@ -10,13 +10,20 @@ import {
     LanguageModelToolInvocationPrepareOptions,
     LanguageModelToolResult,
     PreparedToolInvocation,
+    workspace,
 } from 'vscode';
 import { PythonExtension } from '../api/types';
 import { IServiceContainer } from '../ioc/types';
 import { ICodeExecutionService } from '../terminals/types';
 import { TerminalCodeExecutionProvider } from '../terminals/codeExecution/terminalCodeExecution';
 import { IProcessServiceFactory, IPythonExecutionFactory } from '../common/process/types';
-import { getEnvironmentDetails, getToolResponseIfNotebook, IResourceReference, raceCancellationError } from './utils';
+import {
+    getEnvironmentDetails,
+    getToolResponseIfNotebook,
+    getUntrustedWorkspaceResponse,
+    IResourceReference,
+    raceCancellationError,
+} from './utils';
 import { resolveFilePath } from './utils';
 import { getPythonPackagesResponse } from './listPackagesTool';
 import { ITerminalHelper } from '../common/terminal/types';
@@ -44,6 +51,10 @@ export class GetEnvironmentInfoTool implements LanguageModelTool<IResourceRefere
         options: LanguageModelToolInvocationOptions<IResourceReference>,
         token: CancellationToken,
     ): Promise<LanguageModelToolResult> {
+        if (!workspace.isTrusted) {
+            return getUntrustedWorkspaceResponse();
+        }
+
         const resourcePath = resolveFilePath(options.input.resourcePath);
         const notebookResponse = getToolResponseIfNotebook(resourcePath);
         if (notebookResponse) {
diff --git a/src/client/chat/installPackagesTool.ts b/src/client/chat/installPackagesTool.ts
index 36544128582a..b40ba1c6e2aa 100644
--- a/src/client/chat/installPackagesTool.ts
+++ b/src/client/chat/installPackagesTool.ts
@@ -10,12 +10,14 @@ import {
     LanguageModelToolInvocationPrepareOptions,
     LanguageModelToolResult,
     PreparedToolInvocation,
+    workspace,
 } from 'vscode';
 import { PythonExtension } from '../api/types';
 import { IServiceContainer } from '../ioc/types';
 import {
     getEnvDisplayName,
     getToolResponseIfNotebook,
+    getUntrustedWorkspaceResponse,
     IResourceReference,
     isCancellationError,
     isCondaEnv,
@@ -42,6 +44,10 @@ export class InstallPackagesTool implements LanguageModelTool<IInstallPackageArg
         options: LanguageModelToolInvocationOptions<IInstallPackageArgs>,
         token: CancellationToken,
     ): Promise<LanguageModelToolResult> {
+        if (!workspace.isTrusted) {
+            return getUntrustedWorkspaceResponse();
+        }
+
         const resourcePath = resolveFilePath(options.input.resourcePath);
         const packageCount = options.input.packageList.length;
         const packagePlurality = packageCount === 1 ? 'package' : 'packages';
diff --git a/src/client/chat/selectEnvTool.ts b/src/client/chat/selectEnvTool.ts
index ba0b7d16c77b..5f1c2f6b7c36 100644
--- a/src/client/chat/selectEnvTool.ts
+++ b/src/client/chat/selectEnvTool.ts
@@ -24,6 +24,7 @@ import {
     doesWorkspaceHaveVenvOrCondaEnv,
     getEnvDetailsForResponse,
     getToolResponseIfNotebook,
+    getUntrustedWorkspaceResponse,
     IResourceReference,
 } from './utils';
 import { resolveFilePath } from './utils';
@@ -61,6 +62,10 @@ export class SelectPythonEnvTool implements LanguageModelTool<ISelectPythonEnvTo
         options: LanguageModelToolInvocationOptions<ISelectPythonEnvToolArguments>,
         token: CancellationToken,
     ): Promise<LanguageModelToolResult> {
+        if (!workspace.isTrusted) {
+            return getUntrustedWorkspaceResponse();
+        }
+
         const resource = resolveFilePath(options.input.resourcePath);
         let selected: boolean | undefined = false;
         const hasVenvOrCondaEnvInWorkspaceFolder = doesWorkspaceHaveVenvOrCondaEnv(resource, this.api);
diff --git a/src/client/chat/utils.ts b/src/client/chat/utils.ts
index cd13dc867615..2d5598a00cbd 100644
--- a/src/client/chat/utils.ts
+++ b/src/client/chat/utils.ts
@@ -97,6 +97,10 @@ export async function getEnvironmentDetails(
     return message.join('\n');
 }
 
+export function getUntrustedWorkspaceResponse() {
+    return new LanguageModelToolResult([new LanguageModelTextPart('Cannot use this tool in an untrusted workspace.')]);
+}
+
 export async function getTerminalCommand(
     environment: ResolvedEnvironment,
     resource: Uri | undefined,
@@ -208,6 +212,9 @@ export async function getEnvDetailsForResponse(
     resource: Uri | undefined,
     token: CancellationToken,
 ): Promise<LanguageModelToolResult> {
+    if (!workspace.isTrusted) {
+        throw new Error('Cannot use this tool in an untrusted workspace.');
+    }
     const envPath = api.getActiveEnvironmentPath(resource);
     environment = environment || (await raceCancellationError(api.resolveEnvironment(envPath), token));
     if (!environment || !environment.version) {