FR
live
CVE-2025-15662 · CVSS 8.6 CVE-2025-50455 · CVSS 9.1 CVE-2025-59172 · CVSS 8.5 CVE-2025-68686 · Fortinet FortiOS
Cloud

Cloudflare OS puts an AI agent in every company browser — and open-sources the whole stack

On August 5, 2026, Cloudflare open-sourced Cloudflare OS, a platform that gives every employee an AI agent connected to internal systems, with a governance framework that tracks what the agent has read.

WE Walid ETTAYEB · Founder 5 August 2026 · 4 min
An empty workstation with a single monitor displaying a clean interface, an amber glow on the desk

August 5, 2026. 13:00 UTC. Cloudflare open-sourced Cloudflare OS, a platform that gives every person in an organization an AI agent and a workspace built around their company: its processes, terminology, and systems. The platform has already been used by thousands of Cloudflare employees across every function — including non-engineering — since May 2026.

The announcement is co-authored by Phillip Jones and Dan Carter, with a companion post by Sam Rhea, Cloudflare’s CIO, detailing the internal rollout. The repository is live on GitHub now.

Three components, one architecture

Cloudflare OS combines three pieces:

  • An agent workspace grounded in the context and skills your company curates. Each workspace includes an isolated runtime where the agent can write and run code, persistent sessions, and files. No terminal required — everything happens in the browser.

  • A security and governance framework that doesn’t stop at controlling which tools an agent can call. It records every resource the agent has observed and verifies the permissions of anyone trying to access the result. Authorization doesn’t end at the initial read — it follows the data everywhere the agent takes it.

  • A platform for modifiable apps where every “file” can be its own full-stack application with client code, server code, an API, and durable state. Apps are Workers loaded on demand as Durable Object Facets, each with its own isolated SQLite database.

Gatekeepers: the answer to “just give me the API key”

The number-one reflex of people experimenting with AI at work: asking for API keys to internal systems. Cloudflare OS rejects that model. Instead, it introduces Gatekeepers.

A Gatekeeper is a service-specific Worker that sits between Cloudflare OS and an external system (GitHub, a data warehouse, Salesforce). It understands the service’s API, its resources, and the allowed operations. The agent never sees an API key. It receives a typed TypeScript API — for example env.PROJECT.listIssues({ teamId: "ENG", state: "open" }). The Gatekeeper handles OAuth, holds the credential, enforces policy, and records what was read.

An agent can be granted access to a single GitHub repository, read-only on issues, with no source code access. Sensitive fields can be masked. Externally-visible actions (merge a PR) can require human approval.

Observation tracking

The real innovation is resource observation tracking. When an agent reads a sensitive table in a data warehouse and produces a dashboard, sharing that dashboard must not become a way to share the table. Cloudflare OS records every resource the agent has observed and attaches that history to the agent and its outputs.

When another person tries to open the workspace, interact with the agent, or view what it produced, Gatekeepers verify their access to the observed resources. The same observation log feeds policies that determine when the agent can make outbound requests, invite collaborators, or hand work to another agent.

The result: users don’t have to implement security themselves. The platform carries it.

Apps as Workers: the sharing model

Every Cloudflare OS app is a full-stack application with client code in the browser, server code running as a Dynamic Worker, and state in a SQLite database via Durable Object Facets. Client-server communication uses Cap’n Web, Cloudflare’s open-source object-capability RPC system.

Apps are shared in two ways:

  • Share the app itself: real-time collaboration on the same state.
  • Share a blueprint: others create their own copy with identical code but independent data, credentials, and history.

Apps instantiated from a blueprint can be modified by AI — the end user doesn’t need to know how to code to adapt the tool to their needs.

Models and costs: AI Gateway as the control plane

All inference goes through Cloudflare AI Gateway, giving the organization a single place to decide which models are available and which model handles which job. Every request is attributed to a person, team, or workspace. Administrators can see where inference spend is going, set budgets and rate limits, and decide what happens when a limit is hit.

The philosophy is explicit: not every task deserves the most expensive model. Summarizing your unread emails every morning doesn’t justify a frontier model at $15 per million tokens.

Open source, customizable, partner-ready

Cloudflare is releasing two repositories: the Cloudflare OS core and an example deployment based on Cloudflare’s internal instance. The deployment repo consumes the core without patching it, providing a place for configuration, custom UI, internal integrations, and deployment pipelines.

Strategic partners Presidio and Happy Cog are announced to help with enterprise deployments: curating shared skills, building custom interfaces, connecting internal systems through Gatekeepers and MCP Server Portals.

Verdict

Cloudflare OS is the first enterprise agent platform that treats the post-read authorization problem systemically. If your organization is experimenting with AI agents by handing out API keys to employees, stop — that’s the model Cloudflare OS replaces. Deploy the open-source release, connect your first systems with a Gatekeeper, and build your shared skills library before bad habits take root.

For teams already using Workers, Durable Objects, and AI Gateway, the integration is native. For everyone else, the starter repository promises deployment in minutes.

References

cloudflare ai-agents open-source gatekeeper mcp

The cyber brief, every Tuesday

The flaws that matter and the patches to apply, in a ten-minute read.

No spam. One-click unsubscribe.
read next

On the same topic

Three Pass-ta-key Attacks Bypass Google Passkeys — Chrome's Cloud Authenticator Validates Compromised Machines Without Checking the TPM

On August 3, 2026, Unit 42 (Palo Alto Networks) published three attacks dubbed Pass-ta-key that allow malware on a compromised Windows machine to hijack passkeys synced through Google Password Manager. The most severe, Golden Pass-ta-key, extracts the master encryption key from Chrome's memory and compromises all current and future passkeys on the victim's Google account.

WE Walid ETTAYEB 4 August 2026 · 5 min

AWS Interconnect connects AWS and Oracle Cloud privately — multicloud goes native

On **July 31, 2026**, **AWS** announced general availability of **AWS Interconnect** for **Oracle Cloud Infrastructure (OCI)**. For the first time, two competing hyperscalers offer native private interconnection without traversing the public internet. A pivotal shift for multicloud architectures.

WE Walid ETTAYEB 4 August 2026 · 4 min
← Back to the feed

Type at least two characters.

↑ ↓ navigate ↵ open esc dismiss