Cloudflare Open-Sources Cloudflare OS, Its Agent Workspace

The interesting part of Cloudflare's announcement today isn't the agent workspace itself, plenty of vendors have shipped one this year, but where the security boundary sits. In Cloudflare OS, agents start with no permissions, and every internal system they can touch is fronted by a per-service Gatekeeper Worker that grants scoped access. A Gatekeeper can, in the company's own words, "give it access to a single repository, allow it to read issues but not source code, mask particular fields, apply rate limits."

The context worth weighing is the operational history behind the drop. Cloudflare says the platform launched internally in May with thousands of employees using it daily. Most 'we open-sourced our internal thing' launches are code with no track record. This one at least claims a real deployment behind it, though take the scale claim as reported rather than independently verified.

The architecture leans hard on Cloudflare's own primitives. Agent-built apps run as Dynamic Workers with Durable Object Facets, each getting its own SQLite database and isolated V8 runtime, with outbound networking disabled by default. Client-server RPC uses Cap'n Web, Cloudflare's open-source object-capability system, and model inference routes through Cloudflare AI Gateway so organizations can pick models per task and attribute inference costs.

Why this matters if you are evaluating agent platforms: the current pitch from OpenAI, Anthropic, and the pure-play agent vendors is trust our sandbox. Cloudflare is offering a different bargain, you run the sandbox on our runtime, and a capability contract is the API. If your security team already balks at handing agents broad OAuth tokens, a Gatekeeper that lets an agent read GitHub issues but not source code is a shape they will recognize.

The honest caveats: this is deeply tied to Cloudflare's stack, so 'open source' does not mean 'portable.' The core repo and a starter template are live on GitHub, and Presidio and Happy Cog are named as strategic partners for deployment. What the reporting doesn't give you is licensing detail, real cost profiles, or independent evidence that the observation-logging model actually blocks leaks when agents chain sensitive reads. The forward-looking read is that Cloudflare is quietly pitching Workers and Durable Objects as the default substrate for enterprise agents, and if security teams accept the capability model, that is a moat rivals will struggle to reproduce.