Cloudflare Open-Sourced Its Company OS. The Agents Get Lied To.

TL;DR

On August 5, Cloudflare open-sourced Cloudflare OS, the browser-based AI workspace thousands of its own employees already use daily. The launch post and the Apache-2.0 repo describe three things: an agent chat preloaded with your company's context, "Gadgets" (per-user private instances of AI-built apps), and "Gatekeepers", a capability-based security layer with the most interesting human-in-the-loop design shipped this year: the agent is told its risky action succeeded, handed simulated results, and the human approves the real side effects in bulk later. It runs on Cloudflare Workers, but also locally on the open-source workerd runtime. The repo passed 3,100 GitHub stars within a day of going public.

Not a product. A fork target.

The framing is unusual for a vendor launch. Cloudflare built this tool internally, says a large portion of its workforce (engineering through sales) uses it every day, and is now publishing the whole thing so you can run your own. The README is explicit:

The idea is not that your company uses Cloudflare OS, but rather that you make it "Your Company OS".

That puts it in a different category from the enterprise AI workspaces it will get compared to. There is no per-seat SKU in the repo; there is a pnpm run-local that brings the entire stack up on your machine at localhost:8787, and a starter repo for customizing a deployment. The whole pitch fits in one command, which is more than most operating systems can say.

Gadgets: SaaS, except you own the fork

The core design bet is that multi-tenant SaaS stops making sense once every user can prompt an agent to write software. When you create a slide deck in Cloudflare OS, you are not opening your row in someone's shared database. The system spins up a private instance of the slide-deck app just for you, in its own sandbox. That instance is called a Gadget.

Two consequences fall out of that, per the README. First, the app cannot leak your data through its own bugs, because the sandbox owns all access to your copy. Second, you can safely ask the agent to modify the code of your instance: if your slide deck app is missing a feature, you prompt it in, and nobody else's slide decks are affected. Templates ("Blueprints") ship whole applications, not just content, and you can mint new Blueprints from your own Gadgets and share them.

Every Gadget is required to talk between client and server over Cap'n Web RPC, which has a useful side effect: every app automatically exposes an agent-callable API. You ask the AI to build the app, then you ask the AI to collaborate with you inside it, with no MCP server to write.

The productive lie

Gatekeepers are the security layer, and Cloudflare describes them as supercharged MCP servers: one Worker per external service, wrapping the native API in a clean interface, handling OAuth, scoping access to the specific resource you intended, and logging every action for review.

The novel part is what happens when an agent hits an action with side effects. Traditional human-in-the-loop is synchronous: the agent stops, you approve, it continues. You walk off for a coffee, come back, and find it stalled on step one. The README names the failure mode this produces, which is people setting agents to auto-approve, "or --dangerously-skip-permissions, which is, obviously, unsafe." A flag this audience has definitely never typed.

Gatekeepers instead simulate the outcome locally and let the agent proceed:

The Gatekeeper tells the agent that the action completed, and if the agent tries to read back the results, the Gatekeeper gives it simulated results.

The human then approves or rejects the queued actions in bulk, whenever convenient; rejected actions simply never happened in the real world. It works like a good executive assistant: every reply gets drafted and filed in the outbox while the boss is at lunch, and the boss signs off on the whole stack at once instead of being interrupted per email. The agent keeps its momentum, the human keeps the veto.

It really is shaped like an OS

The README claims the OS terminology "isn't entirely marketing", which may be the most honest sentence to come out of a themed launch week yet. The analogy holds up better than most: a kernel that connects users to programs and devices while enforcing sandboxing, drivers that mediate access to external hardware, processes, executables.

Under the hood it is a showcase of the newest Workers primitives, written by the team that built the runtime. Every workspace is its own Durable Object. Every Gadget runs in a Dynamic Worker Facet, features Cloudflare says were added to the runtime specifically for this product. The built-in agent is a Code Mode agent: it does its work by writing and immediately executing snippets of code rather than making one tool call at a time. Model choice goes through Cloudflare's AI Gateway, and the README says it works with major providers and self-hosted models alike.

The self-host question, answered honestly

Built-on-Workers usually means married-to-Cloudflare, so the README addresses it head on: workerd, the Workers runtime, is itself open source, and "Cloudflare OS can run entirely on top of it on your own servers." The local quick start already runs the full stack on wrangler and workerd with no Cloudflare account in the loop, though the README flags that mode as a demo rather than a production path.

For the self-hosting crowd this is the most interesting part of the release. An Apache-2.0 agent workspace that can point at self-hosted models and run on an open-source runtime is a rare shape for a launch from a company of this size. The gravity is still real (Durable Objects, Facets, and friends are at their best on Cloudflare's edge, and production self-hosting means operating workerd yourself), but the escape hatch is in the license and the code, not just the marketing.

The caveats, straight-faced

The README is candid that this is an early-access release under heavy development. What shipped is actually version 2, a ground-up rewrite of the internal version 1, and Cloudflare's own words are that it "is very capable, but still has many rough edges." There are no published benchmarks for its claim that the integrated coding agent uses fewer tokens than a general-purpose one, so treat that as a thesis, not a measurement.

Context also matters: this landed mid-way through a Cloudflare announcement week that has already produced @cloudflare/computer, the preview-only agent runtime released two days earlier. The company is carpet-bombing the agent-infrastructure space and open-sourcing as it goes; each piece is real, but the cadence is a marketing strategy, and version churn across these young repos should be expected.

Key Takeaways

• Cloudflare open-sourced Cloudflare OS on August 5 under Apache-2.0: the internal AI workspace thousands of its employees use daily, now published for companies to fork and customize.
• Gadgets replace multi-tenant SaaS with per-user private app instances: the agent builds the app, your copy runs in its own sandbox, and you can prompt new features into it safely.
• Gatekeepers implement async human-in-the-loop: the agent is handed simulated results for side-effecting actions so it never blocks, and the human approves or rejects the real actions in bulk later.
• The stack is a showcase of new Workers primitives: one Durable Object per workspace, one Dynamic Worker Facet per Gadget, Cap'n Web RPC between every Gadget's client and server, and a Code Mode agent.
• It runs locally on the open-source workerd runtime with one command, and supports self-hosted models, though the README calls local mode a demo and the whole release early access.
• The repo crossed 3,100 GitHub stars within a day; this is the second agent-infrastructure release of Cloudflare's launch week, after the preview-only @cloudflare/computer runtime.

Sources: Cloudflare Blog, cloudflare/cloudflare-os on GitHub, cloudflare/cloudflare-os-starter, Cloudflare press release, Phoronix, SiliconANGLE