Cloudflare Open-Sources Cloudflare OS, Its Agent Workspace
TL;DR
- Cloudflare deployed OS internally across its own workforce first, validating the design under real enterprise conditions before releasing it publicly.
- Gatekeeper Workers retain all credentials; agents receive only scoped capability objects, so no raw API key ever reaches agent-generated code.
- Every source an agent reads is logged; that record travels with the output and re-checks permissions on every downstream reader.
The interesting part of Cloudflare's announcement today isn't the agent workspace itself, plenty of vendors have shipped one this year, but where the security boundary sits. In Cloudflare OS, agents start with no permissions, and every internal system they can touch is fronted by a per-service Gatekeeper Worker that grants scoped access. A Gatekeeper can, in the company's own words, "give it access to a single repository, allow it to read issues but not source code, mask particular fields, apply rate limits."
The context worth weighing is the operational history behind the drop. Cloudflare says the platform launched internally in May with thousands of employees using it daily. Most 'we open-sourced our internal thing' launches are code with no track record. This one at least claims a real deployment behind it, though take the scale claim as reported rather than independently verified. It follows Kitesurf by two days, making this Cloudflare's second agent-infrastructure launch of the week.
The architecture leans hard on Cloudflare's own primitives. Agent-built apps run as Dynamic Workers with Durable Object Facets, each getting its own SQLite database and isolated V8 runtime, with outbound networking disabled by default. Client-server RPC uses Cap'n Web, Cloudflare's open-source object-capability system, and model inference routes through Cloudflare AI Gateway so organizations can pick models per task and attribute inference costs.
For anyone shopping agent platforms, the current pitch from OpenAI, Anthropic, and the pure-play agent vendors is trust our sandbox. Cloudflare is offering a different bargain, you run the sandbox on our runtime, and a capability contract is the API. If your security team already balks at handing agents broad OAuth tokens, a Gatekeeper that lets an agent read GitHub issues but not source code is a shape they will recognize.
The catch is that this is deeply tied to Cloudflare's stack, so 'open source' does not mean 'portable.' The core repo and a starter template are live on GitHub, and Presidio and Happy Cog are named as strategic partners for deployment. Cloudflare has not published licensing detail, real cost profiles, or independent evidence that the observation-logging model actually blocks leaks when agents chain sensitive reads. The forward-looking read is that Cloudflare is quietly pitching Workers and Durable Objects as the default substrate for enterprise agents, and if security teams accept the capability model, that is a moat rivals will struggle to reproduce.
What others are reporting
-
Cloudflare Read →
First-party press release confirms the internal origin story, names implementation partners Happy Cog and Presidio, and frames Gatekeeper connectors as the enterprise-grade access control layer.
"Every employee needs the ability to build, iterate, and automate safely."
-
GitHub (cloudflare/cloudflare-os) Read →
Primary source code under Apache-2.0; README specifies per-Gadget sandbox isolation and async approval queuing so agents can proceed while human review catches up.
"Every Gadget runs in a separate sandbox from everyone else's, making it impossible for security bugs to leak your data."
-
Help Net Security Read →
Security-trade angle: focuses on the observation log that follows agent outputs and re-enforces source-data permissions on every downstream reader, solving cross-team data leakage.
"Authorization has to account for where the data can go next."
-
SiliconAngle Read →
Emphasizes the no-developer-bottleneck pitch: employees build micro-apps in natural language, companies retain data ownership, and bring-your-own-model flexibility controls inference spend.
"For AI to truly transform an enterprise, it can't live in a silo or behind a developer bottleneck."
-
Decrypt Read →
Raises the open-source tension: Apache-2.0 license is real, but production runtime depends entirely on Cloudflare Workers, making genuine infrastructure independence unlikely.
"The security had to be part of the platform, not something every person building an app has to implement correctly."
Originally reported by blog.cloudflare.com
Read the original article →Original headline: Cloudflare Open-Sources Cloudflare OS, an Agent Workspace With Capability-Based Gatekeeper Security