Cloudflare has open-sourced Cloudflare OS, an AI agent workspace originally built to run its own global workforce, making the platform available for any organization to deploy on Cloudflare's infrastructure. The system gives every employee a browser-based workspace where AI agents can create documents, build custom applications called "Gadgets," automate repetitive tasks, and securely connect to internal systems through a capability-based security layer named Gatekeepers. After months of internal testing across thousands of Cloudflare employees in engineering, sales, and other functions, the company is releasing version 2 as an early-access open-source project on GitHub.

The announcement, made August 5, 2026, positions Cloudflare OS as a response to the gap between generic AI tools that know little about a specific company's operations and the years-long, million-dollar projects typically required to build tailored enterprise AI platforms. By open-sourcing the same platform Cloudflare uses internally, the company aims to let organizations capture their institutional knowledge, processes, and system connections once — then have that context travel with every employee's workspace from day one, without vendor lock-in.

What's New / Specs

  • Agent Workspace: Browser-based chat interface preloaded with company-specific knowledge, terminology, procedures, and skills captured as executable instructions.
  • Gadgets (Personal Apps): Each user runs their own isolated instance of every application — documents, slide decks, whiteboards, dashboards — as a separate sandboxed "Gadget" built on Dynamic Workers and V8 isolates.
  • Gatekeepers (Security Layer): Capability-based connectors that wrap external APIs (GitHub, Google Docs, etc.) with OAuth, narrow resource scoping, action logging, and asynchronous human-in-the-loop approval that simulates outcomes so agents don't stall.
  • Zero-Trust Foundation: Built on Cloudflare Access; agents start with zero permissions and must request access per task through Gatekeepers.
  • Bring-Your-Own-Model: Via Cloudflare AI Gateway, organizations can connect any model provider, route tasks by complexity (small models for routine work, frontier models for reasoning), and monitor token spend by person, team, or app with budgets and rate limits.
  • Runtime: Built on Cloudflare Workers, Durable Objects (one per workspace), Dynamic Workers, and Facets — several runtime features were added specifically to support Cloudflare OS.
  • Deployment: Requires a Cloudflare Workers Paid plan; local development via pnpm run-local on workerd (open-source Workers runtime).
  • Open Source: Apache 2.0 licensed at github.com/cloudflare/cloudflare-os; managed dashboard deployment and partner-led implementations (Presidio, Happy Cog) coming soon.

The platform's architecture draws a direct line to Sandstorm.io, the capability-based personal app platform created by Cloudflare principal engineer Kenton Varda a decade ago. Each Gadget runs as a fine-grained isolate — a separate V8 instance that starts in milliseconds and uses megabytes of memory — making it roughly 100 times faster and 10–100 times more memory-efficient than container-based sandboxing. Server-side code executes with global outbound networking disabled; client code runs in a sandboxed browser frame. Neither can reach the internet except through explicitly granted capabilities.

Gatekeepers represent a significant advance in human-in-the-loop design. Traditional synchronous approval forces agents to pause and wait for user confirmation before each side-effect action, leading many users to disable safeguards entirely. Gatekeepers instead simulate the outcome locally, let the agent continue queuing actions with simulated results, and defer bulk or per-action approval to a convenient time. Each Gatekeeper is implemented as a separate Worker, with a future vision of independently deployed and maintained Gatekeeper services.

Why It Matters

Enterprise AI adoption has largely split into two unsatisfying paths: generic chat assistants that lack organizational context, or custom-built platforms that consume years of engineering effort and millions in maintenance. Cloudflare OS attempts a third path — a ready-to-deploy, open-source foundation that encodes the security, governance, and integration patterns Cloudflare refined while running its own 3,000+ person workforce. The platform's emphasis on capturing institutional knowledge as executable "skills" from day one addresses the cold-start problem where every new AI session begins with zero context about how the company actually operates.

The security model is equally consequential. By treating AI agents as distinct principals with capability-based permissions — not as users with broad ACLs — Cloudflare OS enables organizations to give non-technical employees the ability to "vibe code" custom applications without creating shadow IT sprawl or data leakage risks. The isolate-based sandbox means a vulnerability in one user's slide-deck Gadget cannot leak another user's documents, even if both Gadgets share the same underlying code. This fine-grained isolation, combined with Gatekeepers' simulated async approval, could set a new baseline for safe enterprise agent deployment.

Cost governance arrives at a critical moment. As organizations roll out AI tools broadly, token spend has become unpredictable and often opaque. Cloudflare OS bakes in per-person, per-team, per-app observability through AI Gateway, with routing rules that automatically direct routine summarization tasks to cheaper models while reserving frontier models for genuine reasoning workloads. The platform also learned from internal missteps: an early version simply gave non-engineers "friendlier UIs" on engineering-grade coding harnesses, producing "a flood of vibe-coded apps looking for a problem to solve." The rewrite shifted toward deterministic skill files that use AI inference only when needed, reducing token consumption for repetitive workflows.

Our Take

Cloudflare OS is arguably the most ambitious open-source enterprise AI platform released to date, not because it invents new model capabilities but because it stitches together runtime isolation, capability-based security, organizational knowledge capture, and cost governance into a single deployable stack. The Sandstorm lineage shows in the Gadget model — each user truly gets their own modifiable copy of every app — and the Gatekeeper design solves the human-in-the-loop usability trap that plagues most agent frameworks. For organizations already on Cloudflare's network, the path from zero to a governed, context-aware agent workspace is now measured in hours rather than quarters.

Caveats are real and acknowledged by Cloudflare itself. The v2 release carries an "early access" label with "many rough edges." Deployment requires a Workers Paid plan, a detail that initially caught early GitHub users off guard before the deploy flow was updated to warn upfront. The platform's power is also its complexity: Gatekeepers must be written or configured for each external system, and the skill/blueprint authoring experience will determine whether non-technical teams can actually capture their workflows without engineering help. Partner-led implementations from Presidio and Happy Cog signal that enterprise rollouts will often need integration expertise. Still, by open-sourcing the exact platform that runs Cloudflare — and licensing it Apache 2.0 so organizations own their customizations — the company has set a high bar for what "enterprise AI workspace" should mean.

FAQ

What exactly is a "Gadget" in Cloudflare OS?

A Gadget is a personal, sandboxed application instance — such as a slide deck, whiteboard, or data dashboard — that runs in its own V8 isolate with dedicated storage and permissions. Unlike SaaS apps where all users share one multi-tenant instance, each user gets their own copy they can freely modify via AI prompts without affecting others. Gadgets are created from Blueprints (templates that specify the full application code) and can be shared securely for collaboration.

How do Gatekeepers differ from traditional MCP servers or API connectors?

Gatekeepers wrap external services with a capability-based security model: they expose a clean Cap'n Web API, handle OAuth, enforce narrow resource scoping (e.g., only the specific Google Doc the user attached), log every action, and implement asynchronous human-in-the-loop approval by simulating outcomes so agents don't stall waiting for synchronous confirmation. Each Gatekeeper runs as a separate Worker.

Can Cloudflare OS run without a Cloudflare account?

The backend requires a Cloudflare Workers Paid plan for deployment to Cloudflare's network. However, the open-source workerd runtime allows running the entire stack on your own servers. Local development via pnpm run-local uses wrangler and workerd for a zero-cost trial, but this is not intended for production use.

What AI models does Cloudflare OS support?

Through Cloudflare AI Gateway, organizations can connect any model provider — OpenAI, Anthropic, Google, open-source models hosted on Workers AI, or custom endpoints. Administrators can set routing rules by task complexity, budgets, and rate limits per person, team, or application, with detailed spend observability.

Is Cloudflare OS ready for production deployment today?

Cloudflare labels the August 2026 v2 release as "early access" with "many rough edges." The platform is used daily by thousands of Cloudflare employees, but external organizations should expect to invest in configuration (Gatekeepers, Blueprints, skills) and potentially engage implementation partners like Presidio or Happy Cog for enterprise-grade rollouts. A managed dashboard deployment option is planned for the near future.

Sources