Cloudflare Just Open-Sourced the AI Workspace It Built for Its Own Employees

Cloudflare has open-sourced Cloudflare OS, the AI agent platform it originally built to run its own workforce, under an Apache 2.0 license. The code went public on August 5, 2026, alongside a technical blog post from Cloudflare engineers Phillip Jones and Dan Carter and a same-day press release.

Despite the name, this isn't a traditional operating system in the Windows or Linux sense. Cloudflare describes it as an operating system for a company to be productive with AI safely, and separately, as a management layer for AI workloads — the same relationship a conventional OS has to compute workloads. Cloudflare says it started building the internal version in May 2026 after finding that AI coding tools worked well for developers but non-technical employees had no equivalent: agents needed both organizational context and controlled access to internal systems, and neither existed off the shelf.

The platform has three parts. The Agent Workspace is a browser-based environment where agents get persistent state, file storage, and an isolated runtime to write and execute code, loaded with a company's own context and reusable skills. The App Platform lets those agents turn a working session into a real, shareable application — each one deployed as its own Cloudflare Worker with an isolated SQLite database, talking to the browser client over Cap'n Web, Cloudflare's own capability-based RPC system.

The part drawing the most attention from security press is the third: the Security & Governance Framework. Agents start with zero access to anything. To reach an external system, an agent requests a specific resource and gets back a typed capability object — not a raw API key or OAuth token — scoped to exactly what it asked for. A per-service "Gatekeeper" Worker sits in front of every external system Cloudflare OS touches, and it can be scoped down to a single repository, read-only issue access, field-level masking, rate limits, or a required approval step before a pull request merges, rather than blanket account access. Every resource an agent reads is also logged and stays attached to whatever the agent produces from it, so a dashboard built from data a user wasn't cleared to see can't quietly leak that data to someone else who opens it later. As the blog post puts it: "controlling the initial read is not enough."

Cloudflare's own press release adds that the company's thousands of employees across every function have been using an internal version daily since May, for research, document drafting tied to live data, and building small working apps. CEO Matthew Prince framed the release this way: AI, he said, "can't live in a silo or behind a developer bottleneck." Cloudflare has also lined up early implementation partners, including Presidio and Happy Cog, whose co-founder Matt Weinberg made the case in the same release that governance can't be an afterthought once agents are acting autonomously.

The code is on GitHub at cloudflare/cloudflare-os, with a separate starter/example repo showing how Cloudflare configured its own internal deployment without touching the core platform code.

My read

The interesting bet here isn't the "AI workspace" framing — plenty of vendors sell that. It's that Cloudflare is open-sourcing the access-control layer specifically, at a moment when most agent platforms still hand agents a static API key or a broad OAuth scope and hope logging catches whatever goes wrong after the fact. A per-service Gatekeeper with field-level masking and its own approval rules is a meaningfully different design, and shipping it as Apache 2.0 code rather than a proprietary feature means other platforms can copy the pattern directly instead of waiting for their own vendor to build something similar. Whether it actually gets adopted outside Cloudflare's own ecosystem is a separate question this post can't answer yet — it's four days old as of this writing (August 10, 2026), too early for adoption data to exist.

Sources

• Cloudflare OS: an open platform for agents, apps, and work — technical detail on all three components, the security model, direct quotes, GitHub links, authorship and publish date
• Cloudflare OS Is the First AI Workspace Built Around How Companies Actually Work — Matthew Prince and Matt Weinberg quotes, internal-rollout context, launch partners
• Cloudflare OS goes open source with a record of everything its agents read — independent security-press verification of the Gatekeeper/observation-logging model
• Cloudflare Announces Open-Source Cloudflare OS As AI "Operating System" — independent confirmation of license, GitHub repo, and release date