Cloudflare Open-Sources an OS for AI Agents at Work

Cloudflare just open-sourced the internal tool it built to stop its own employees from copy-pasting API keys into AI chatbots. Cloudflare OS gives every person in a company an AI agent workspace grounded in that company's own systems, and it ships with a security model that tracks not just which tools an agent can call, but which data it has actually seen, before that data can be shared with anyone else. Cloudflare has run it internally since May 2026 with thousands of daily users; as of August 5, 2026, any organization can deploy it themselves.

• Cloudflare OS combines an agent workspace, a Gatekeeper security layer, and a platform for building full-stack apps that anyone in a company can create and share, no deployment step required.
• Every agent and app starts with zero access. It requests typed, scoped capabilities to specific resources instead of holding raw API keys.
• The platform tracks every piece of data an agent has observed, not just what tools it called, so sharing an app or dashboard can't leak data the viewer isn't cleared to see.
• It's open source today on GitHub, runs on Cloudflare Workers, Durable Objects, and AI Gateway, and works with any model.

What is Cloudflare OS, actually?

It's a self-hosted platform, not a chat widget bolted onto your existing tools. A workspace is a browser-based conversation that's grounded in context and skills your company curates: your terminology, your recurring procedures, the tools your teams already use. From that conversation, an agent can write and run code, do research across connected systems, produce docs, slides, and spreadsheets that stay linked to live data, or build a small app with its own interface and state. Cloudflare says thousands of its own employees, most of them outside engineering, already use it daily to automate repeatable work.

RelatedMicrosoft Open-Sources Comic Chat After 30 Years

Why did Cloudflare build its own tool instead of buying one?

The first internal version, shipped in May 2026, exposed a problem most AI-at-work pitches gloss over: giving people API keys to internal systems so their agents can be useful does not scale, and knowing which tools an agent can call is not the same as knowing which data it has actually seen. Once employees started sharing workspaces, apps, and outputs with each other, Cloudflare needed a way to guarantee that sharing an app never leaked information the viewer wasn't cleared to see in the first place. That requirement, security built into the platform rather than left to whoever builds an app, is why the second version was rebuilt from the ground up rather than patched.

How does the security model actually work?

Every agent and app in Cloudflare OS starts with access to nothing. An agent has to request a specific resource, which a person can grant or deny, and generated code receives it as a typed, scoped capability rather than a credential, for example a binding like env.PROJECT.listIssues() that only exposes the operations a policy allows. A Gatekeeper, a small Worker that understands one external service's API, sits between the agent and that service: it can limit access to a single GitHub repository instead of the whole account, allow reading issues but not source code, mask specific fields, or require human approval before anything with a real side effect happens. Server code runs in a Dynamic Worker with outbound networking disabled by default, and the platform logs every resource an agent has observed. That observation log is what gets checked before a shared app, dashboard, or output is opened by someone else, closing the gap where sharing your work could quietly become sharing data you were never allowed to hand over.

What can you actually build with it?

Anything you'd normally ask a developer for, without waiting on one. Because every app is a full Worker with its own client code, server code, and Durable Object Facet (a per-app SQLite database separate from the core platform), a workspace can turn a one-off request into a real collaborative tool: a dashboard connected to live data, a small internal tool with its own logic, or a deterministic workflow that runs on a schedule instead of re-running a full agent session every time. Apps can be shared live, so a team edits the same state together, or shared as a blueprint, which hands over the code without the original data, credentials, or connected resources, so a teammate can fork it and make it their own. Every inference call is routed through Cloudflare's AI Gateway, so an administrator can pick cheaper models for routine jobs, cap spend per team, and see exactly where inference budget is going.

RelatedAstro 7 Ships a Rust Compiler and Vite 8 Speed Jump

How did we get from an internal tool to open source?

1. May 2026First version rolled out to all Cloudflare employees. Workspaces were individual, and apps were static rather than connected to live systems.
2. May–Jul 2026Thousands of daily users across every function. Collaboration exposes the need for resource-level, not just tool-level, access control.
3. Aug 5, 2026Cloudflare OS is rebuilt and open sourced. Two GitHub repos ship: the core platform and a starter deployment.
4. Coming nextA fully managed dashboard product. Plus containers for dev workflows and workspaces inside Slack and other chat tools.

What it means for the market

This is as much a Workers platform showcase as a productivity release. Cloudflare is using Cloudflare OS to prove out Dynamic Workers and Durable Object Facets, two primitives built specifically for this project, that let a company spin up a fully isolated, stateful app per user or per team without provisioning a server or container. For Cloudflare's own business, the pitch to enterprises is straightforward: don't send your internal data to a third-party AI vendor's cloud, run the whole thing, models included, on infrastructure you already control, with named partners Presidio and Happy Cog offering to handle the integration work. That's a direct shot at the assumption behind most enterprise AI-agent pricing, which bundles governance and infrastructure together and charges per seat for both. If self-hosted, open-source agent platforms with built-in data governance catch on, it pressures that bundle, and it gives Cloudflare a reason for more workloads, and more inference spend through AI Gateway, to land on its own network.

Our take

What makes this worth paying attention to is that Cloudflare dogfooded it first: thousands of its own employees used the rough version for months before anyone outside the company could touch it, which is a higher bar than most "enterprise AI agent platform" launches clear. The Gatekeeper and observation-log model is a genuinely useful answer to a problem every company adopting agents will hit, agents that can see more than the person viewing their output should be allowed to. The catch is that Cloudflare OS is infrastructure, not a finished product: today it's a GitHub repo and a starter deployment, and building real Gatekeepers for your own Jira, data warehouse, and internal tools is nontrivial engineering work. That's exactly why the managed dashboard Cloudflare says is coming next matters more than today's open-source drop. Until it ships, this is a tool for teams that already run on Cloudflare and have engineers to spare, not a drop-in replacement for a SaaS AI assistant.

Original analysis by GenZTech, based on Cloudflare's official announcement.