Cloudflare has open-sourced a new version of Cloudflare OS, a platform designed to give every employee an AI agent, a workspace, and tools to build small applications. The platform bundles an agent workspace, a security and governance layer built around what Cloudflare calls "Gatekeepers," and a mechanism for deploying personal apps that run as Cloudflare Workers.

The central proposition: organizations can run the entire system on their own infrastructure, connected to their own data, rather than handing agents broad API keys. That pitch enters a crowded enterprise AI agent market where Microsoft Copilot, Salesforce Agentforce, and Google Gemini for Workspace are all competing to embed AI assistants into daily work—and where security teams have repeatedly flagged the risks of giving large language model-based agents persistent, broad access to corporate systems.

Cloudflare originally built Cloudflare OS for internal use. In May, the company granted access to all of its thousands of employees, CEO Matthew Prince wrote. Workers outside of engineering began using it to draft documents, build slide decks, and automate repetitive tasks. Now, Cloudflare is releasing a rebuilt version that any organization can deploy and connect to its own internal systems.

"The security had to be part of the platform, not something every person building an app or using an agent has to implement correctly," the company stated in its announcement.

What's Inside Cloudflare OS

Cloudflare OS combines three components. The first is an agent workspace that grounds each conversation in a company's curated context and skills, featuring an isolated runtime where the agent can write and execute code. The second is a security and governance framework—new to this version—that sits between agents and an organization's systems of record. The third is a layer for personal, modifiable apps that enables a workspace to transform a chat into a document, a workflow, or a small full-stack application.

Cloudflare CIO Sam Rhea outlined the company's approach to security: handing API keys to people and agents is dangerous and does not scale, because keys confer broad, long-lived access that is difficult to constrain or audit. Instead, agents start with zero access. When an agent requests a specific resource, a Gatekeeper—a service-specific Cloudflare Worker—mediates the interaction. The credential never touches the agent or its code.

Cloudflare describes this as a cleaner model than the Model Context Protocol (MCP) alone. MCP tells an agent which tools it can call, but not which underlying resources it has actually accessed. Cloudflare OS logs every observation and verifies a person's access permissions before they can open a workspace or view what an agent produced, as detailed in the company's usage overview.

Each app an agent builds is a genuine Cloudflare Worker, running on Dynamic Workers and Durable Object Facets that Cloudflare built for this project, and communicating with the client over Cap'n Web, its open-source object-capability RPC system.

"If you can build a tool to do a job yourself, agents can use your tool to do the job when you're not there," the company noted.

The vision is ambitious, though some users may remain cautious: Cloudflare OS is a Cloudflare product, meaning the agents, apps, and governance tools it provides all run on Cloudflare's edge infrastructure. The "open" in open source provides access to the code, but the runtime remains controlled by a single entity. How much traction Cloudflare OS gains against better-funded proprietary rivals—and whether the open-source release attracts organizations that want self-hosted agent platforms without ceding infrastructure to a third party—are the questions to watch as adoption data emerges.