Cloudflare has open-sourced Cloudflare OS, a platform it originally built for internal use to let employees create apps with AI agents, including people who are not software developers or engineers. The company says the system is paired with a security framework meant to reduce the risk that employee “vibe-coding” sessions will introduce serious vulnerabilities or cause data exposure.
cloudflare os
From internal workspace to public release
In an August 5 blog post, Cloudflare said it spent several months developing and testing Cloudflare OS before opening it up on GitHub. The platform lets employees describe a workflow in natural language, then uses an AI agent to turn that request into an application. According to Cloudflare, thousands of employees now use it every day to create documents and slides, automate repetitive tasks, and build small apps that visualize data and help them work.
Kenton Varda, principal engineer at Cloudflare, described the product on X as “a full-on personal app vibe coding platform,” adding that the sandbox is designed to be secure enough that “the AI cannot introduce a significant security bug.” He said the company believes its security team can let non-technical users “vibe code” without needing to worry about major risk.
Security built around isolated app instances
The core of Cloudflare OS is a fine-grained sandbox model. Cloudflare says each document editor or similar app can run as a separate instance in its own sandbox, while the platform manages access permissions for each instance. Each user runs their own copy of the code and can modify it freely.
That approach relies on a preexisting Cloudflare capability called Dynamic Workers rather than conventional software containers. Instead of containers, the platform uses “isolates,” which are instances of the V8 JavaScript execution engine. Cloudflare says they start in just a few milliseconds and consume only a few megabytes of memory, making them 100 times faster and 10–100 times more memory-efficient than a standard container.
Limiting what AI agents can touch
Cloudflare also says the system is designed to minimize exposure of company data. AI agents begin with no permissions to access or share resources and must request those permissions through the platform. Server code runs with “global outbound networking disabled,” while client code “runs in a sandboxed frame in the browser,” which means neither can access the internet except through capabilities explicitly provided by the user or administrator.
That model may be useful in practice even if it cannot eliminate every risk. Cloudflare’s announcement comes as researchers at Pillar Security have published a report on sandbox escapes and boundary bypasses in AI coding agents including Cursor, Codex, Gemini CLI, and Antigravity.
Cloudflare’s effort to make AI coding less wasteful
Cloudflare says Cloudflare OS can work with nearly any AI model, giving organizations flexibility to choose the model that makes sense for a task. Sam Rhea, Cloudflare’s chief information officer, wrote in a separate blog post that “not every user needs access to the max thinking mode of the latest frontier lab model,” adding, “And we do not need team members spending $20 to summarize their email inbox every hour.”
Rhea also said the company changed the platform so that skill files for specific workflows depend more on deterministic steps, with AI inference used only when necessary instead of requiring a “token-hungry inference session” each time. That shift is meant to make the system more efficient and predictable.
The platform also gives administrators tools to monitor AI inference spending and to set budgets and rate limits. Cloudflare framed that capability as important for organizations trying to control costs as AI usage spreads across teams.
- Model flexibility: organizations can select the AI model best suited to the task.
- Spending controls: admins can monitor inference costs.
- Budget tools: teams can set budgets and rate limits.
- Safer execution: AI agents begin with no default access to company resources.
Lessons learned from internal use
Cloudflare said it learned several lessons while adapting AI tools for broader employee use. One early mistake, Rhea said, was giving people outside engineering “the same tools with slightly friendlier user interfaces.” He argued that AI coding harnesses built for engineers are often poorly suited to knowledge work that involves “one-off outputs and work on projects that involve dozens of systems of record.”
“If you give everyone a harness workspace that is great at writing code, you’ll wind up with way more code than you need,” Rhea wrote. “The result became a flood of vibe coded apps looking for a problem to solve.”
The expansion of AI use inside the company also created a new challenge: “anyone at Cloudflare could now write bad code, faster, thanks to AI,” Rhea said. In response, Cloudflare created the Cloudflare Engineering Codex, which it describes as an “authoritative guide” for both human engineers and AI agents to review code and catch problems.
AI review at scale
Cloudflare says that over the past four months, its AI code reviewer flagged nearly a quarter of a million deviations from Cloudflare engineering standards and blocked 16,000 merges. That figure, shared by systems engineer Timo Reimann in a blog post about the Engineering Codex, suggests the company is using AI not just to generate code but also to enforce internal engineering rules.
Open source, with a paid-plan catch
Developers can now try to run the full Cloudflare OS stack on their own machines, but there is an important limitation: the backend can only be deployed by Cloudflare users on the Workers Paid plan.
That requirement was not initially obvious. A GitHub user pointed out the issue and included a screenshot showing that deployment was halted partway through on a Workers Free plan. The user, mac2net, wrote: “You have a right to charge but requirements should be completed before starting the deployment process,” adding, “I wasted 20 minutes I will never get back.”
Cloudflare later updated the deployment flow to warn users about the paid-plan requirement at the beginning, and a company representative responded on GitHub.
Explore more: Blog Our Services Contact Us
Source: Original report
Was this helpful?
Last Modified: August 7, 2026 at 6:37 pm
0 views
