Cloudflare open-sources its AI agent OS, because even bots need a bouncer 🚪

Cloudflare on Thursday released Cloudflare OS as an open-source platform for building and deploying AI agents inside enterprise environments, disclosing that every one of its thousands of employees received access to the first version in May. The company, which built the original system internally, said the rebuilt version is designed to let any organization connect agents to its own internal systems. "The security had to be part of the platform, not something every person building an app or using an agent has to implement correctly," Cloudflare said in its announcement.

The platform combines three components: an agent workspace that grounds each conversation in a company's curated context and skills, with an isolated runtime where the agent can write and run code; a security and governance framework that sits between agents and systems of record; and a layer for personal, modifiable apps that can turn a chat into a document, a workflow, or a small full-stack app. Cloudflare CIO Sam Rhea framed the security model as an alternative to handing out API keys directly, which he described as "dangerous and doesn't scale, because keys give broad, long-lived access that's hard to constrain or audit." Under the new setup, agents start with access to nothing and request specific resources through a Gatekeeper, a service-specific Cloudflare Worker that mediates access so the credential never touches the agent or its code.

Cloudflare said the approach addresses a gap in Model Context Protocol, which tells an agent which tools it can call but not which underlying resources it has actually seen. Cloudflare OS logs every observation and checks a user's access before they can open a workspace or view what an agent produced. Each app an agent builds runs as a Cloudflare Worker built on Dynamic Workers and Durable Object Facets, communicating with the client over Cap'n Web, the company's open-source object-capability RPC system. "If you can build a tool to do a job yourself, agents can use your tool to do the job when you're not there," the company wrote.

The release comes alongside a federal appeals court ruling that handed Perplexity an early win in its dispute with Amazon, with the Ninth Circuit Court of Appeals ruling Tuesday that Amazon is unlikely to succeed on its claim that Perplexity violated the Computer Fraud and Abuse Act. Cloudflare acknowledged that its open-source code still runs on its own edge infrastructure, meaning organizations adopting the platform rely on Cloudflare for runtime, governance, and the agents and apps deployed on top of it.