Wait, Cloudflare Made an OS?
So. Cloudflare. The company that spent the last decade being the internet's bouncer: blocking bots, absorbing DDoS attacks, and occasionally looking at your website traffic like a disappointed mall cop. That Cloudflare just dropped an "OS." Yes, really. And no, it is not a desktop OS for your grandma.
Cloudflare OS is an open source AI agent platform, and the announcement has serious "we got tired of waiting for someone else to fix enterprise AI, so we did it ourselves" energy. It gives every person an agent and a workspace built around how their company actually works.
Meet Your New Coworker: An Agent With Ambition
Technically, Cloudflare OS is an "open platform for agents, apps, and work." In human language: every employee gets an agent and a workspace shaped around their organization. Not generic chatbot energy. The platform loads your company's terminology, procedures, and best-known workflows into the agent's context before you say hi.
Cloudflare has been dogfooding this thing since May. Thousands of people across every function, many of them outside engineering, use it every day to create documents and slides, automate repeatable tasks, and build small apps to visualize data. When one person figures out a better way to do something, everyone else gets that skill. Knowledge management vendors are sweating.
It starts like every other AI chat: a conversation in your browser. But then the conversation can grow up and become a doc, an app, or a workflow that keeps doing the work while you sleep. A workspace bundles agent sessions, persistent state, outputs, resource access, and an isolated runtime where the agent can write and run code. No terminal. No dev skills. Just a browser and a goal.
What can your new AI coworker do?
- Research a topic using company context without dragging an entire dataset into the model's context window
- Turn research into a document or spreadsheet that stays connected to live data, not a static file
- Build a small app with its own interface, logic, and state for the whole team
- Convert predictable jobs into mostly deterministic workflows that run on demand, on a schedule, or when an event fires
The "each file is an app" bit is the wildest part. Most suites give you documents, spreadsheets, and presentations. Cloudflare OS says every file can be its own full-stack app with client code, server code, an API, and durable state. Private by default, shareable like a doc, and teammates can remix it with AI instead of filing a feature request.
Every inference call runs through Cloudflare's AI Gateway, so the platform works with any model. One place to decide which model handles which job, and which jobs do not need the expensive frontier brain. Summarizing your unread emails does not require a $200-a-month ego.
The Security Flex: Start With Nothing, Earn Everything
Now for the part that made security people clutch their coffee mugs. Handing out API keys to agents is a disaster, and Cloudflare knows it. Keys provide broad, long-lived access that is hard to constrain, share safely, and audit. So the platform starts every agent and app with access to nothing. An agent has to ask for a specific resource, and a human grants or denies it.
Between the agent and the outside world sits a Gatekeeper: a service-specific Worker that understands the service's API, its resources, and what you can do to them. It handles OAuth, holds the credential, enforces policy, records what was read, and mediates anything with an externally visible side effect.
The example they use is spicy. Giving an agent your entire GitHub account is too broad. A Gatekeeper can limit it to a single repository, let it read issues but not source code, mask particular fields, apply rate limits, and require human approval before merging a pull request. That is the correct amount of trust.
The other flex is the observation log. MCP servers tell you which tools an agent can call, but not which underlying resources the agent actually observed. Cloudflare OS records every resource an agent sees, and Gatekeepers verify access to observed resources before anyone else can open the workspace.
That is how they close the classic leak: an agent reads a sensitive table, builds a live dashboard from it, and someone shares that dashboard with a coworker who was never allowed to see the table. The Gatekeeper checks the log and shuts it down.
The security checklist reads like a paranoid sysadmin's wishlist:
- Agents and apps start with zero access by default
- Generated server code runs in a Dynamic Worker with global outbound networking disabled
- Client code runs in a sandboxed frame in the browser
- Nothing reaches the Internet except through capabilities you explicitly provide
- Existing MCP servers plug in through MCP Server Portals
This is the "let the platform handle it so humans do not have to" argument, and it is a genuinely good one. Most people will never write a correct authorization policy. Cloudflare OS tries to make the defaults safe enough that they do not have to.
Open Source, So Everyone Gets to Play. The code is on GitHub right now, in two repositories: the Cloudflare OS core and an example deployment based on how Cloudflare runs it internally. Deploy it into your own Cloudflare account in minutes. Partners Presidio and Happy Cog can customize it, because the source code is only the starting point.
Next up: a fully managed product in the Cloudflare dashboard, containers for dev workflows, and workspaces landing in Slack and other chat tools.
Is this an "OS" in the way Windows is an OS? No. Is it the most ambitious attempt yet to make AI agents feel like actual coworkers instead of chat toys? Honestly, yes. The internet's bouncer just turned its energy toward enterprise AI, and the fun part is that it might actually work.
Comments