Cloudflare OS: an open platform for agents, apps, and work
Cloudflare Blog ● Covered by 5 sources
Cloudflare open-sourced its internal AI work platform, called Cloudflare OS, so any company can run it themselves. It's a big bet that agents need company-specific context and locked-down access, not just chatbots with API keys.
Cloudflare has been running an internal AI tool since May that gives every employee, not just engineers, a personal agent workspace tied into company systems. Today it's releasing a rebuilt, open-source version called Cloudflare OS, and the story behind the rebuild is more interesting than the launch itself. The first version let people chat with agents to make docs, slides, and small apps, but apps were static snapshots rather than live software, and sharing anything quickly turned into a security headache. Giving an agent access to an MCP server told Cloudflare which tools it could call, but not which sensitive data it had already seen, which meant a shared dashboard could accidentally leak a database table to someone who never had permission to view it.
So the company rebuilt the whole thing around access control by default. Every agent and app inside Cloudflare OS starts with zero permissions. If an agent wants to touch GitHub issues or a data warehouse, it has to request that specific resource, and admins grant or deny it as a typed binding in code rather than a raw API key. The actual credential never touches the agent; a purpose-built middleman called a Gatekeeper holds it, enforces rules like read-only access or field masking, and logs exactly what the agent has observed. That observation log then follows the work around, so if an agent reads something sensitive, Cloudflare OS can block it from later emailing that data out, inviting a collaborator, or handing the task to another agent.
The apps side is where this gets genuinely different from typical office software. Instead of a fixed menu of docs, sheets, and slides, each file can be its own tiny application, written on the fly by an agent, with a real backend, its own SQLite database, and an API. These run as Cloudflare's lightweight Dynamic Workers, so there's no server sitting idle waiting to be used. The clever bit: the same server method a person calls from the browser can also be called directly by an agent, meaning any tool a team builds for itself instantly becomes something an agent can operate on its own, later, without a human present.
Cloudflare is also trying to solve the boring-but-real problem of model spend. Every inference call routes through Cloudflare's AI Gateway, so a company can decide that summarizing inbox clutter doesn't need a frontier model while a harder analytical task might. Spend gets attributed per person, team, or workspace, with budgets and rate limits admins can set and adjust.
The pitch, ultimately, is that this isn't a SaaS product to subscribe to but source code to deploy and shape. Cloudflare is shipping both the core platform and an internal example deployment as separate repos, plus lining up partners, Presidio and Happy Cog, to help companies customize it. Whether organizations actually want to run and maintain their own AI operating system, instead of renting one, is the open question nobody in the announcement quite answers.
My take
Open-sourcing the plumbing while keeping the actual value, the curated context and skills, as something you have to build yourselves is a smart move dressed up as generosity. It also quietly admits that the API-key-sharing approach most companies are using for AI right now is a security disaster waiting to happen, and Cloudflare is right about that even if it's also selling the fix. The real test isn't the code drop, it's whether any company outside Cloudflare has the discipline to actually maintain a Gatekeeper for every internal system instead of just handing an agent a master key because it's Tuesday and someone's in a hurry.
Read more about this at: Cloudflare Blog
