What Cloudflare OS is
Cloudflare OS is the AI agent workspace Cloudflare built for its own staff. A first version went out to everyone at the company in May 2026, and what has now been published is a rebuild informed by that experience.
The entry point is a conversation in the browser, which is no different from other AI tools. The difference is what happens next: it does not stop at returning text.
The three parts of Cloudflare OS
Cloudflare is also explicit about what was wrong with the first version: apps were static rather than connected to internal systems, and even deterministic jobs meant running an agent skill again and burning more model tokens.
In May of this year, we gave every person at Cloudflare access to the first version of Cloudflare OS. ／ Today, we are open sourcing a new version of Cloudflare OS . ／ Introducing Cloudflare OS ／ Cloudflare OS starts with a conversation in your browser, like many other AI tools. ／ Cloudflare OS combines three parts: An agent workspace grounded in context and skills your company curates, with an isolated runtime where agents can write and run code. ／ A platform for personal, modifiable apps that people can build, share, and continue changing. ／ A new security and governance framework for safe access to internal data and services. ／ In Cloudflare OS, each “file” can be its own application, written by an agent for one person, one project, or one team. ／ Apps were static rather than live software connected to internal systems, and mostly deterministic jobs still required running an agent skill again and consuming more model tokens. — From the passages on when the first version went out internally, this open sourcing, the entry point, the three parts, and the problems found in the first version
The Gatekeeper design that never hands an agent a key
This is the part that matters most in practice. When people start experimenting with AI at work, the first request is almost always for an API key. Keys tend to be broad and long-lived, and they are hard to constrain, share safely or audit.
Cloudflare OS cuts that route off. Agents start with no access. Who may enter is handled by Cloudflare Access — the company's service for putting connections behind an approval policy — while individual resources and actions are handled by a Gatekeeper.
A Gatekeeper is a service-specific Worker (a small program running on Cloudflare) that sits between Cloudflare OS and an external service. The credential is held by the Gatekeeper, not the agent. It handles OAuth — an authentication scheme that passes permission rather than a password — applies policy, records what was read, and mediates anything with an externally visible side effect.
The granularity is fine. Cloudflare's own examples: allow access to a single repository, allow reading issues but not source code, mask particular fields, apply rate limits, and require approval before merging a pull request.
What can go wrong once permissions are handed over is visible in the incident where an evaluation reached a real company and in the AI worm that spreads through Word documents. A design that avoids distributing keys at all is the answer to that same problem from the other side.
A new security and governance framework for safe access to internal data and services ／ As people begin experimenting with AI at work, one of their first requests is often for API keys to company systems. ／ Keys often provide broad, long-lived access that is difficult to constrain, share safely, and audit. ／ Agents start with no access ／ Cloudflare Access controls who can enter Cloudflare OS. ／ Gatekeepers govern resources and actions ／ A Gatekeeper is a service-specific Worker that sits between Cloudflare OS and an external service. ／ A Gatekeeper can give it access to a single repository, allow it to read issues but not source code, mask particular fields, apply rate limits, and require approval before merging a pull request. ／ The Gatekeeper handles OAuth , holds the credential, enforces policy, records what was read, and mediates anything with an externally visible side effect. — From the passages on the API key problem, the initial permissions of agents, the definition and control granularity of a Gatekeeper, and who holds the credential
What to check before bringing it in-house
Two repositories were published: the core, and an example deployment based on how Cloudflare runs it internally. The deployment side consumes the core without patching it, so configuration, custom UI, internal integrations, analytics and deployment pipelines all live there. That split is what lets you shape it to your organisation without editing the core. Cloudflare notes that its internal deployment reflects its own systems, terminology, policies and ways of working, and the design assumes you will add your own interface, your own Gatekeepers and organisation-specific features.
The model is not fixed either. Cloudflare states that it can be used with any model and that you control what it costs, which keeps both model choice and spend on the operator's side. Writing your own Gatekeeper means handling JSON configuration and API responses, so formatting and checking them as you go is the safer path.
Open source, so you can make it yours ／ Cloudflare OS is available today and is open source. ／ We are releasing two repositories: the Cloudflare OS core and an example deployment based on how we run it internally at Cloudflare. ／ The deployment repository consumes the core without patching it, providing a place for configuration, custom UI, internal integrations, analytics, and deployment pipelines. ／ Our internal deployment reflects Cloudflare’s systems, terminology, policies, and ways of working. ／ Cloudflare OS is designed so you can customize the interface, add internal Gatekeepers, and build organization-specific features without changing the core product. ／ Use any model, and control what it costs ／ Cloudflare OS can be used with any model. — From the passages on the open sourcing, the two repositories and their division of roles, the status of the internal deployment, the expected customisation, and model choice
How to read Cloudflare OS
The centre of Cloudflare OS is not model intelligence but permission design. Concentrating the question of how far an agent may reach into the Gatekeeper is the skeleton of it. If you want to evaluate it, start by counting the integrations where you have already handed out a key.
