Cloudflare has taken a notable step with the open-sourcing of its internal AI workspace. The company calls it Cloudflare OS. Built directly on its existing infrastructure of Workers, Access and the AI Gateway, this browser-based system gives employees company-specific AI agents. They handle research, generate documents and apps, and run automations. No terminals required. No new hardware or complex setups.
The launch, detailed in the company’s official announcement, positions the tool as a foundational layer for organizations shifting toward agent-driven work. Employees interact through a familiar browser window. Agents pull from curated internal knowledge, terminology and approved systems. Outputs stay within controlled environments. And security kicks in from the first click.
But here’s the twist. Agents begin with zero permissions. They request access only for specific tasks. Gatekeepers, implemented as dedicated Workers, mediate every interaction with internal tools or data sources. These intermediaries handle OAuth flows, enforce rate limits, mask sensitive fields and even require human approval before certain actions. Credentials never reach the agents themselves. The approach avoids the credential-leaking risks common in other agent frameworks.
Cloudflare tested the concept rigorously inside its own walls. In May, the first version rolled out to every employee. Thousands across functions used it daily. They created documents, built slides, automated tasks and even developed small apps to visualize data. Sales teams alone saved roughly 10,000 hours on territory planning and proposal generation. The internal deployment mirrored the company’s actual systems, policies and language. Results informed the open-source release.
Rita Kozlov, vice president of product at Cloudflare, explained the thinking in coverage from CIO. “Cloudflare OS isn’t a traditional desktop OS,” she said. “It reimagines the workplace computing environment for AI.” She added that because agents act on behalf of people and produce shareable work, they demand a fresh security model. “Thus, Cloudflare OS tracks the resources an agent requires so the right access controls follow its work when it is shared.”
The model-agnostic design stands out. Organizations route requests through the AI Gateway. Admins set budgets, attribute spend to individuals or teams, and direct simple tasks to cheaper models while reserving frontier ones for complex analysis. Every inference carries identity context thanks to integration with Cloudflare Access. Logs capture who or what triggered each call. This visibility addresses a growing headache for IT leaders: runaway token costs and unmonitored AI activity.
Recent coverage highlights how these controls matter now. A Cloudflare blog post from the same period introduced the Identity-Aware AI Gateway in beta. It ties model requests to verified identities, replaces raw API keys, and enables filtering, rate limiting and data anonymization. Combined with AI Spend tracking and User Insights, which flag sessions deviating from normal patterns, the system spots anomalies fast. One example cited an employee session that racked up a $30,000 bill. Insights helped identify and shut it down quickly.
Tech analyst Carmi Levy weighed in on the CIO piece. “This very much is not Windows, macOS, or Linux, and it isn’t an operating system by its common definition,” he noted. “But Cloudflare’s use of this terminology implies familiarity to enterprise IT buyers.” He contrasted the approach with offerings from Microsoft and Google. Those vendors market multiple products in the AI and workspace space but lack the same cohesive branding or infrastructure focus. Cloudflare presents a single-source option that handles networking, compute, security and AI routing together.
Yet the platform remains app-agnostic. It coexists with tools from OpenAI, Anthropic, Google, Microsoft or open-source alternatives. Employees sign in and continue familiar workflows. The difference lies in the persistent, stateful workspace where agents remember context across sessions and connect outputs to live data sources.
Developers and tinkerers have already begun experimenting. Posts on X show teams forking the GitHub repo to run localized versions with Ollama for private LLMs. One Japanese community created a translated fork. Others discuss integrating it as a harness far more capable than tools like Claude Artifacts, with potential for self-hosted deployments behind corporate firewalls. Taiyo Kimura, an AI agent specialist, posted that “Cloudflare OS is OSS so, the things you can do are on another level.” He suggested modifications could support local models and vastly expand what individual agents achieve.
The open-source nature lowers barriers. Companies deploy the starter kit into their own Cloudflare accounts. They customize Access policies, connect proprietary systems through new Gatekeepers, and brand the interface. Partners such as Presidio and Happy Cog stand ready to assist larger rollouts. Cloudflare plans to offer a managed version inside its dashboard, add container support for development, and bring workspaces into Slack and other chat platforms.
Security remains the constant theme. Every app created inside the workspace runs as a Dynamic Worker. These lightweight V8 isolates store state, implement logic and expose capabilities through object-capability style calls rather than broad network access. Client code stays sandboxed in the browser. Servers have no outbound internet except through explicitly granted bindings. Observations of data flows inform future policy decisions. If an agent reads from a sensitive table, it cannot later write to external systems or share the output without approval.
Phillip Jones and Dan Carter, authors of the original blog post, captured the intent clearly. “Every organization has a mission, a reason for being. Organizations pass that mission — along with their terminology, procedures, systems, standards, and ways of working — to their people.” Agents need that same context to be effective. Without it, they operate in isolation. With it, they accelerate work while staying inside defined guardrails.
Industry conversation continues to build. Recent X threads describe Cloudflare OS as a persistent platform for complex AI workloads that could speed innovation across non-technical teams. Others see it as the base layer for “Your Company OS,” tailored exactly to internal processes. The absence of vendor lock-in appeals to CIOs wary of committing entire workflows to a single proprietary stack.
Challenges remain. Adoption will hinge on how easily organizations map their existing tools to Gatekeepers. Training agents on accurate company context requires upfront effort. And while internal metrics at Cloudflare look strong, results at other firms may vary based on data quality and policy maturity.
Still, the release signals a shift. Enterprises no longer treat AI as an add-on chat interface. They seek an operating layer that embeds agents into daily operations with governance baked in from the start. Cloudflare OS offers one vision for that layer. Open source, infrastructure-native, and focused on controlled action over raw capability. Whether it becomes the standard many organizations adopt will unfold over the coming quarters. For now, the code sits on GitHub, ready for inspection and deployment.
View Comments (0)