Cloudflare Open Sources AI Agent Operating System to Tackle Enterprise Security Risks

Web infrastructure leader Cloudflare has open-sourced a rebuilt version of Cloudflare OS, an enterprise platform designed to run autonomous AI agents and personal applications across distributed edge environments.

The move directly addresses critical security bottlenecks preventing enterprise adoption of autonomous AI tools, particularly the risk of leaking broad API keys across internal workflows. By placing an isolated execution layer between agents and systems of record, Cloudflare OS strips autonomous software of default credentials and forces all resource requests through service-specific Cloudflare Workers known as “Gatekeepers.”

Cloudflare Chief Information Officer Sam Rhea emphasized that distributing traditional API keys to agents creates long-lived, unscalable risks. “The security had to be part of the platform, not something every person building an app or using an agent has to implement correctly,” the company stated in its announcement. Unlike standard Model Context Protocol integrations that grant execution capabilities without granular credential restrictions, the framework logs every agent observation and verifies employee permissions before revealing sensitive outputs.

The system was originally built for internal use in May, when CEO Matthew Prince rolled out the initial version to Cloudflare’s entire workforce. Non-technical staff quickly adopted the agent workspaces to draft documents, design presentations, and automate repetitive tasks across departments.

Under the hood, the open-source platform allows workspaces to transform chat prompts into full-stack micro-applications that run on Dynamic Workers, Durable Object Facets, and Cap’n Web, Cloudflare’s object-capability RPC system. “If you can build a tool to do a job yourself, agents can use your tool to do the job when you’re not there,” the company noted.

While making the codebase open-source enables self-hosted governance and custom data integrations, the operating system remains anchored to Cloudflare’s proprietary edge network. Organizations deploying the framework will still depend on Cloudflare’s centralized infrastructure to host the underlying runtime, applications, and security layers.