Cloudflare has released Cloudflare OS as open source, turning an internal AI agent workspace into a platform other organizations can examine and run. The project is designed for employees who may not be software developers, but who still want AI assistance to create workflows, automate tasks, and build lightweight applications.
The move puts Cloudflare OS in the middle of a larger workplace question: how can companies let more people use AI coding tools without creating uncontrolled security, quality, and cost problems?
What Cloudflare OS Is Built To Do
Cloudflare first developed Cloudflare OS for its own employees. The platform lets people describe workflows in natural language, then relies on an AI agent to turn those instructions into working applications.
According to the company, thousands of Cloudflare employees use the system daily to “create documents and slides, automate repeatable tasks, and build small apps to visualize data and help them do their work.” That range matters because the platform is not presented only as a coding tool. It is also a workplace automation layer for people doing knowledge work across many systems.
The company spent several months building and internally testing Cloudflare OS before announcing the open source version’s availability on GitHub in an August 5 blog post. By open-sourcing it, Cloudflare is making the platform available to developers and organizations that want to inspect the stack and try it for themselves.
The central idea is simple: give non-technical users access to AI agents, but place that activity inside a workspace with stronger boundaries than a loose collection of coding tools.
Security Is The Core Pitch
Cloudflare is positioning security as one of the main reasons Cloudflare OS can be used by people outside engineering teams. Kenton Varda, principal engineer at Cloudflare, described it as “a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild—the AI cannot introduce a significant security bug.”
Varda also wrote that Cloudflare believes “a company’s security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.” The claim is not that every risk disappears. The platform’s design is meant to reduce the damage a flawed AI-generated app can cause.
The security model uses fine-grained app instances. If someone builds or uses a document editor app, each document can run as a separate instance in a separate sandbox. Cloudflare OS manages access to each instance, and each person runs their own copy of the code that they can modify.
This approach is based on Dynamic Workers, an existing Cloudflare feature. Instead of typical software containers, it uses “isolates,” which are instances of the V8 JavaScript execution engine. The source article says those isolates can start in a few milliseconds and use only a few megabytes of memory, making them 100 times faster and 10–100 times more memory-efficient than a standard container.
Cloudflare OS also starts AI agents with no permissions to access or share resources. Agents must request access through the platform. Server code runs with “global outbound networking disabled,” while client code “runs in a sandboxed frame in the browser.” In Cloudflare’s description, “neither can reach the Internet except through capabilities you explicitly provide.”
Why Vibe Coding Needs Guardrails
The open source release arrives as AI coding agents are spreading through workplaces, but the source article makes clear that security boundaries remain a concern. Researchers at Pillar Security published a report on sandbox escapes and boundary bypasses in AI coding agents including Cursor, Codex, Gemini CLI, and Antigravity.
Cloudflare’s answer is to treat AI-generated work as something that should be contained by default. The platform’s permission model is meant to prevent an agent from freely reaching company data or the public Internet unless those capabilities are specifically granted.
That matters for non-engineering users because they may not recognize when generated code is risky. It also matters for engineering teams, because a flood of small internal apps can become difficult to review, maintain, and secure if every tool behaves like a normal application with broad access.
Cloudflare’s own experience reflects that tension. Sam Rhea, chief information officer at Cloudflare, wrote that one early mistake was giving people outside engineering “the same tools with slightly friendlier user interfaces.” The problem was that AI coding harnesses built for engineers were not a clean fit for knowledge work involving “one-off outputs and work on projects that involve dozens of systems of record.”
“If you give everyone a harness workspace that is great at writing code, you’ll wind up with way more code than you need,” Rhea wrote. “The result became a flood of vibe coded apps looking for a problem to solve.”
Cost And Quality Controls Are Part Of The System
Cloudflare OS can work with just about any AI model, which lets organizations choose a model based on the task. Rhea argued that not every user needs the most expensive or powerful model mode for everyday work, writing, “Not every user needs access to the max thinking mode of the latest frontier lab model.” He added, “And we do not need team members spending $20 to summarize their email inbox every hour.”
The platform includes tools for administrators to monitor AI inference spending, set budgets, and apply rate limits. That gives companies a way to manage AI model use before costs become difficult to control.
Cloudflare also changed how skill files run for specific workflows. Rhea said the company moved toward more deterministic steps, using AI inference only when needed instead of requiring a “token-hungry inference session” each time.
Quality is another concern. Rhea said the growing use of AI agents meant “anyone at Cloudflare could now write bad code, faster, thanks to AI.” In response, Cloudflare created the Cloudflare Engineering Codex, described as an “authoritative guide” to help human engineers and AI agents review code and catch issues.
Over the past four months, Timo Reimann, a systems engineer at Cloudflare, said the company’s AI code reviewer “flagged nearly a quarter of a million deviations from Cloudflare engineering standards and blocked 16,000 merges.” That figure shows how quickly AI-assisted development can scale both output and review burden.
Open Source Does Not Mean Free To Deploy
Developers can try to run the full Cloudflare OS stack on their own machines. But there is an important limitation: the backend can only be deployed by Cloudflare users subscribed to the Workers Paid plan.
That requirement was not initially clear at the start of deployment. A GitHub user raised the issue after their Workers Free plan was stopped from deploying the backend partway through. The user mac2net wrote, “You have a right to charge but requirements should be completed before starting the deployment process.” They added, “I wasted 20 minutes I will never get back.”
Cloudflare updated the deployment process so users are told about the paid plan requirement at the beginning. A company representative also responded on GitHub.
The result is a more complete picture of Cloudflare OS: it is open source, built for AI-assisted workplace app creation, and designed around sandboxing, permissions, cost controls, and code review. But running it in practice still depends on Cloudflare’s paid infrastructure for backend deployment.