Cloudflare OS: The Open Platform That Turns Company Knowledge Into Agent-Driven Work

Cloudflare just dropped the source code for something its own teams have run for months. The company calls it Cloudflare OS. It is not a kernel or a server OS in the classic sense. Instead it is a browser-based workspace where every employee gets an agent that knows the company’s terminology, procedures and systems.

Announced today in a pair of detailed posts, the platform lets non-engineers build apps, automate tasks and query internal data without handing out API keys. The Cloudflare Blog describes it as an open platform for agents, apps and work. Any organization can deploy the code, connect its own tools and customize the experience.

Phillip Jones and Dan Carter, engineers at Cloudflare, wrote the main announcement. They explain that work takes many forms. Some outputs are easy to judge. Code runs or it fails. Documents, relationships and physical outcomes prove harder. Agents need context and safe access to succeed beyond developer use cases.

That need drove the project. In May Cloudflare gave every employee access to an early version. Thousands now use it daily across functions. The system holds a shared library of context and skills. One person’s better process becomes available to all. When the company open sourced today’s release it made that internal tool available for others to run in their own accounts.

Sam Rhea, Cloudflare’s CIO, detailed the internal rollout in a companion post. His team started with five principles. Use AI for customer problems first. Give everyone superpowers. The human owns the output. Context matters. And AI gets no extra permissions. Those rules shaped everything that followed.

Early pilots split between engineers and everyone else. Engineers received an Engineering Codex with guardrails. Agents flagged issues in code reviews and designs. The system blocked thousands of risky merges. Non-engineers got a magic email bot that handled mundane triage. That bot evolved into shared skill and context files anyone could reference.

The first version focused on individual workspaces. Agents operated through private sessions. Apps stayed mostly static. Collaboration revealed the real problem. Once people shared workspaces or outputs, sensitive data could leak to unauthorized eyes. MCP servers defined which tools an agent could call. They did not track what data the agent had already seen or where that data might travel next.

Cloudflare rebuilt the platform around a stricter model. Security sits inside the core, not as an afterthought for each builder. Agents start with zero access. Users or administrators grant specific capabilities. Generated code receives those capabilities as typed bindings. Credentials never reach the agent or its runtime.

Gatekeepers handle the heavy lifting. Each is a Worker that sits between Cloudflare OS and an external service. It understands the service’s API, resources and safe operations. An agent might receive access to one GitHub repository but not the whole account. It can read issues yet not touch source code. The Gatekeeper applies rate limits, masks fields, logs observations and requires approval for risky actions.

Policy follows the data. Cloudflare OS records every resource an agent observes. Those observations travel with the workspace, the outputs and any shared apps. When another user tries to open the same material, Gatekeepers check that person’s permissions against the observed resources. A dashboard built from sensitive warehouse tables cannot be viewed by someone without table access. The same log blocks the agent from sending restricted data to external systems or inviting unauthorized collaborators.

Server code runs in Dynamic Workers with outbound networking disabled except through explicit capabilities. Client code lives in a sandboxed browser frame. The combination keeps agents contained. The Cloudflare Blog notes that this approach reuses existing Cloudflare One and Zero Trust controls. No new permissions for AI.

Apps represent the most surprising part. A user asks the agent to create a document, spreadsheet or interface. The agent writes both client and server code. The server becomes a Dynamic Worker backed by a Durable Object Facet. Each app receives its own isolated SQLite database. V8 isolates keep runtimes lightweight and separate.

Communication happens over Cap’n Web, Cloudflare’s open-source object-capability RPC. Client and agent call the same methods. The result feels like a normal JavaScript function yet stays capability-safe. These apps are full-stack, stateful and modifiable. They start private but can be shared like documents. When data sources change the app can update automatically. Export to Google Drive remains possible.

Deterministic workflows add another layer. Not every task needs constant model calls. Many follow known steps with judgment required only at a few points. Workspaces turn those patterns into scheduled or event-driven processes. Code handles the predictable parts. The model steps in only where value appears. Token costs drop. Reliability rises.

Internal results already show impact. Cloudflare reports more than 10,000 hours saved and 4,000 apps created. Active users continue to climb. Early adopters from across departments and summer interns drove adoption. The platform surfaced patterns that let teams stop repeating explanations to every new model session.

Challenges appeared along the way. Some employees needed time to become AI-ready. Others flooded the system with low-value “vibe coding.” Token consumption required attention. Yet the company views these as expected growing pains. The second version addresses many of the first version’s limits.

The open-source release includes two repositories. The core lives at github.com/cloudflare/cloudflare-os. A starter repository shows how to deploy and customize without patching the upstream code. Organizations can add branding, internal integrations, analytics and their own Access policies. The code carries an Apache 2.0 license.

Phoronix covered the announcement within hours, noting that Cloudflare explicitly says this is not a traditional computer operating system. The name instead reflects its role as a workspace operating environment for agents and people. A live demo runs at os.cloudflare.app.

Reactions on X mixed excitement with practical questions. One developer asked whether custom dashboards could pull live Cloudflare observability data. Others praised the capability-contract architecture, isolated V8 runtimes and per-agent SQLite. The emphasis on production safety without prompt-injection risk stood out in several posts.

Cloudflare positions the project as the sum of years of internal experimentation. It combines Workers, Durable Objects, AI Gateway, Zero Trust, Access and newer primitives built specifically for agents. The company first built for its own needs then chose to release the result.

That decision fits a pattern. Cloudflare has open-sourced debuggers, protocol implementations and other infrastructure tools before. This time the target is the way entire companies work with AI. The bet is that shared context, governed access and modifiable apps will prove more valuable than isolated chat interfaces.

Executives acknowledge the platform will evolve. Sam Rhea wrote that Cloudflare feels an obligation to equip teams safely as AI changes how work gets done. The internal rollout continues. External deployments will generate new lessons. The repositories invite contributions and custom forks.

Look past the marketing language and the architecture reveals careful trade-offs. Capabilities over ambient authority. Observation tracking over simple role-based checks. Dynamic isolated runtimes over static containers. Browser-first interfaces over terminal or IDE defaults. Each choice addresses a failure mode observed when agents meet real enterprise data.

Whether other companies adopt the exact stack matters less than the ideas. Many organizations already run Workers or similar serverless platforms. They can replicate pieces or draw inspiration from the open code. The shared library of skills and context offers a different path to knowledge management than pure retrieval systems.

Security teams will study the Gatekeeper pattern. It turns every integration into an explicit policy surface. Developers will examine how Cap’n Web and Durable Object Facets create stateful apps with almost zero marginal cost. AI practitioners will test how well observation-based policy prevents leakage compared with prompt-only safeguards.

Cloudflare itself gained measurable productivity inside its walls before releasing a line of code. That sequence lends credibility. The platform survived real use by thousands before facing external scrutiny. Today’s open sourcing marks the moment the experiment becomes available for others to run, break, extend and measure against their own missions.

Plenty of questions remain. How well does the model scale across organizations with different compliance needs? Can Gatekeepers keep pace with every SaaS API vendors ship? Will the shared context library avoid becoming another stale wiki? Early internal metrics look promising. The next twelve months of external deployments will supply clearer answers.

For now the code sits on GitHub under an open license. The demo runs in a browser. Companies can spin up their own instance in minutes using the starter kit. The agents, the workspaces, the Gatekeepers and the modifiable apps wait for new contexts and new missions. One organization’s better way of working can, in theory, become another’s starting point. That possibility is what Cloudflare chose to release today.