Why AI tools know nothing about your company — until now
The New Stack Adrian Bridgwater ● Covered by 6 sources
Cloudflare launched CloudflareOS, an open AI workspace wired to your company's systems. No more re-explaining how your business works to AI, every session.
Cloudflare spent this week convincing the tech press that virtual desktops are a relic, and the pitch has some teeth. CloudflareOS is an open-source workspace that gives every employee AI tools plus live, verified access to whatever internal systems they're cleared to touch — documents, spreadsheets, workflows, even full-stack apps generated on the fly. The company has been running the thing internally for a while now; thousands of its own staff use it daily, which is a decent stress test before handing it to strangers.
The engineering problem underneath the marketing is real, though. Rita Koslov, Cloudflare's VP for developers and AI, points out that agentic tools have started pulling company data out of controlled systems wholesale, often via employees requesting raw API keys for whatever tool they're using that week. Cloudflare's answer is what it calls capability-based access: instead of an agent getting a key that opens ten doors, it gets one specific resource, and the platform logs exactly what it saw. Anyone who later views that output has to be independently cleared to see the source data too. Under the hood this runs on Dynamic Workers for isolated, on-demand code execution and Durable Objects Facets for sandboxed SQLite storage, with outbound networking off by default and Gatekeepers — Cloudflare's term for service-specific brokers — deciding what an agent is actually allowed to reach.
Koslov didn't sugarcoat what happens without this kind of guardrail. She's heard from other companies about internal data quietly copied into AI tools IT never approved, API keys baked directly into agent-built apps, and sensitive files ending up visible to people — sometimes the whole internet — who had no business seeing them. Building a proper in-house fix for that mess, she notes, usually takes years and a budget in the millions, which is exactly why Cloudflare decided to open-source the platform it already built for itself rather than sell a locked-down product.
Not everyone is fully sold on the framing. Vladimir Beskorovainyi, an enterprise AI architect who runs Besk Tech, likes the capability-access model and especially the per-person, per-team cost breakdown — he calls it the first time a vendor has treated spend as an engineering signal instead of just a bill. But he thinks the industry's whole obsession with token pricing misses what's actually expensive here: writing down, accurately, how a company's processes really work, and then keeping that description current as the business changes. Owning your context, he argues, isn't the same as having good context, and that gap is where he expects most CloudflareOS rollouts to eventually struggle — not because of anything Cloudflare built, but because nobody budgets for context going stale the moment it's written.
Matthew Prince, Cloudflare's CEO, frames the whole project simply: they built it because nothing else did the job. Whether that job includes indefinitely maintaining an accurate internal knowledge base is a separate question, and one every company that adopts this will end up answering for itself.
My take
The capability-based access model is the smart part of this launch — handing an agent one narrow permission instead of a master key is exactly the kind of boring, unglamorous security work the AI industry keeps skipping in favor of demos. But the open-source angle is doing a lot of heavy lifting in the marketing, because owning the platform for free doesn't make the actual grind — keeping a company's process documentation honest quarter after quarter — any less painful or any cheaper. Expect a wave of case studies about how easy setup was, followed a year later by quieter stories about drift, stale docs, and agents confidently executing on outdated approval chains. That's not a Cloudflare problem, it's an org-discipline problem, and no platform, open or closed, has ever solved that one for anybody.
Read more about this at: The New Stack
