Cloudflare just open-sourced the AI workspace it built for its own employees, and it’s the most interesting enterprise agent story in months.
The company announced Cloudflare OS on August 4. It’s an open source platform that gives every employee an agent, an app builder, and governed access to internal systems. You can deploy it into your own Cloudflare account today, per the press release.
This isn’t another chatbot wrapper. Cloudflare says thousands of its own people use it daily to research, build documents tied to live data, automate workflows, and ship small apps. The company open-sourced what it runs on, which is rare and worth paying attention to.
What this AI workspace actually is
Cloudflare OS combines three parts, per the company’s blog post: an agent workspace grounded in the context and skills your company curates, a security and governance framework for internal data, and a platform for personal apps people can build and share.
What begins as a conversation can become a doc, an app, or a workflow that continues doing the work. Agents get an isolated runtime where they can write and run code. Non-developers use it from the browser, no terminal required.
The agent workspace angle is where this gets practical. Cloudflare says a workspace combines agent sessions, persistent state, outputs and files, resource access, and an isolated runtime where agents can write and run code. Teams share a library of context and skills, so the best-known way to do a task becomes an instruction an agent can follow. When one person figures out a better way, everyone else gets it.
The system supports Model Context Protocol servers you already run, through what Cloudflare calls MCP Server Portals. So the tooling you’ve built for other agents can plug in here too.
The AI workspace model isn’t new. The open source part is. Your organization owns its AI workspace, because it runs in your Cloudflare account with your Access policies, your AI Gateway config, and your data. SiliconANGLE notes that running on your own account means organizations own what they build on it. The code is Apache 2.0 licensed, as Phoronix noted, and two repositories are live: the core platform and an example deployment based on how Cloudflare runs it internally.
The zero-trust part is the real story
Here’s the part that matters. Agents and apps start with access to nothing. No ambient API keys, no standing permissions. When an agent needs a resource, it asks, and a Gatekeeper decides.
A Gatekeeper is a service-specific worker that sits between Cloudflare OS and an external service. It holds the credential, understands the API, and grants narrow scope. Per the blog, a Gatekeeper can give an agent access to a single repository, let it read issues but not source code, mask fields, apply rate limits, and require approval before merging a pull request.
That’s the capability model, not the “here’s a token for everything” model. It’s the same instinct behind the agent containment work I’ve been covering, where agents escaped test environments, and METR’s independent agent investigations. Everyone is finally treating agent access like a security boundary instead of a demo feature.
Policy also follows what an agent has seen. If an agent reads a sensitive table and builds a live dashboard from it, sharing that dashboard doesn’t become a backdoor to the table. Gatekeepers verify access to observed resources before anyone else opens the work.
An AI workspace that runs on Cloudflare’s terms
The honest caveat: open source here doesn’t mean portable. The whole thing is built on Cloudflare primitives, Workers, Durable Objects, AI Gateway. AI Weekly calls the deep tie to Cloudflare’s stack the real moat, and that take is right.
You bring your own model through AI Gateway, and you’re not locked to one vendor. Administrators see spend by person, team, or app, and can set budgets, rate limits, or route routine tasks to cheaper models. That’s the cost control enterprises actually need, and it’s built in rather than bolted on.
Managed hosting is coming to the Cloudflare dashboard soon. Partners like Presidio and Happy Cog will sell tailored deployments. But the source is out today, and the starter repository is designed to get you running in minutes.
The bottom line
Cloudflare OS is the first AI workspace I’d tell a small team to actually try, because it flips the enterprise AI pitch. Instead of trusting a vendor’s sandbox, you run the sandbox on your own account, and the security model is built on capabilities instead of hope.
The zero-access default is the part that should scare the enterprise AI incumbents. Cloudflare is selling the governance layer as the product, and it’s shipping it as code. If you’ve been worried about handing agents broad access, this is the most honest open source answer yet.
Worth a deploy this week if you already live in Cloudflare’s world. The starter repository is a few minutes from a working instance. If you’re not a Cloudflare shop, wait for the managed option, but keep an eye on the Gatekeeper model either way. That’s the pattern everyone else will copy.
