Cloudflare Launches Open-Source AI Agent OS With Enterprise Security and Governance

Cloudflare has introduced Cloudflare OS, a new open-source platform designed to help enterprises securely deploy AI agents, AI-generated applications, and automated workflows while maintaining centralized control over data access, credentials, networking, and governance.

The platform combines an AI agent workspace with application-building capabilities and a security architecture intended to address one of the biggest challenges facing enterprise AI adoption: allowing autonomous agents to interact with sensitive corporate resources without giving them unrestricted access.

Cloudflare began testing an earlier version of the platform internally in May, making agent workspaces available to employees across both technical and non-technical teams.

Cloudflare Launches Open-Source AI Agent OS

Workers reportedly used the environment to generate documents and presentations, create data visualizations and lightweight applications, and automate recurring business processes.

Cloudflare said experience from the internal deployment influenced the open-source architecture, particularly its approach to collaboration, authorization, data access, and policy enforcement.

A central security principle behind Cloudflare OS is zero access by default. AI agents and applications generated within the environment initially have no permission to access enterprise resources.

Instead of placing database passwords, API keys, or other raw credentials directly into an agent’s runtime, organizations provide access through specifically defined typed capabilities. An agent must therefore receive explicit authorization before interacting with a protected service or dataset.

Cloudflare Access controls user entry into the environment, while individual agents can request access to approved resources. When server-side application code needs to communicate with a resource, it receives an authorized capability binding.

Sensitive credentials remain separated from both generated application code and the AI agent itself, reducing the risk of credential exposure through prompt injection, malicious generated code, or unintended agent behavior.

Cloudflare has also placed restrictions around outbound network communications. Dynamic Workers created through the platform have global outbound networking disabled by default, while browser-side application components execute within sandboxed frames.

Consequently, generated applications cannot freely communicate with arbitrary Internet destinations unless administrators explicitly provide the required capability.

This architecture addresses a growing security concern surrounding autonomous enterprise agents. An AI system with simultaneous access to confidential databases and unrestricted external networking could potentially expose sensitive information following prompt injection, compromised instructions, or application logic errors.

Cloudflare OS further introduces Gatekeepers, service-specific Workers positioned between AI agents and connected services. Gatekeepers understand the APIs, resources, and supported operations of individual integrations, enabling organizations to enforce granular authorization policies.

They can manage OAuth credentials, control permitted operations, record resource-access activity, and restrict actions capable of producing external consequences.

Existing Model Context Protocol (MCP) servers can also be integrated through MCP Server Portals. Importantly, authorization context can follow information into generated applications.

For example, when an agent accesses restricted warehouse information and creates a dashboard, Cloudflare OS can verify whether another user attempting to view that dashboard has permission to access the underlying source.

The same security records can help restrict downstream operations such as external data transfers, collaborator invitations, agent handoffs, or outbound network requests.

This provides additional protection against situations where an agent legitimately accesses sensitive information but subsequently attempts to move it somewhere unauthorized.

Applications generated through Cloudflare OS contain browser-side client components and server-side logic. Server workloads operate through Dynamic Workers, while Durable Object Facets and SQLite storage provide isolated application state.

Generated applications remain private by default but can be shared for real-time collaboration. Users can also distribute application blueprints that allow colleagues to create independent copies without automatically inheriting credentials, connected resources, conversation histories, or original application data.

AI inference is routed through Cloudflare AI Gateway, providing administrators with centralized control over approved models, spending attribution, budgets, rate limits, and access to expensive frontier models.

By releasing its core platform and example deployment resources as open source, Cloudflare is positioning Cloudflare OS as customizable infrastructure for enterprise agent deployment.

Organizations can deploy it within their own Cloudflare environments, create internal Gatekeepers, integrate corporate services, and enforce organization-specific Access and AI Gateway policies.

The architecture demonstrates an increasingly important cybersecurity principle for enterprise AI: autonomous agents should receive narrowly scoped capabilities instead of inheriting unrestricted credentials and network access.