Cloudflare has launched Cloudflare OS, an open-source artificial intelligence workspace designed to help employees use AI agents, automate repetitive tasks, access authorized company data, and build internal applications from a web browser.
Unlike general-purpose AI assistants that know little about an organization’s internal processes, Cloudflare OS is designed around the terminology, systems, policies and working methods of the company deploying it. The platform allows organizations to provide employees with AI tools that understand company context while maintaining centralized security, governance and cost controls.
Cloudflare OS is available immediately as open-source software that organizations can deploy inside their own Cloudflare accounts. The company is also developing a fully managed version that will be accessible through the Cloudflare dashboard.
An AI Workspace Built Around Company Knowledge
Most workplace AI tools begin each conversation without understanding the organization using them. Employees may have to repeatedly explain internal terminology, procedures, approval requirements, and business context before the AI can complete a useful task.
Cloudflare OS takes a different approach. Companies can create a shared library of organisational context and reusable skills that agents can reference when performing work.
This could include instructions for preparing a sales report, reviewing a contract, responding to a customer issue, analysing operational data or following an internal approval process. Once a team documents the preferred method for completing a task, other employees can reuse that knowledge instead of creating new prompts and processes from scratch.
The platform begins with a browser-based conversation similar to other AI assistants. However, each workspace can include persistent files, connected resources, company-approved instructions and an isolated runtime in which agents can write and execute code.
Employees do not need to be developers or use a command-line interface to access the platform. They can ask an agent to conduct research, prepare documents, analyse live company data, build presentations or automate multi-step workflows from their browsers.
Developed Initially for Cloudflare Employees
Cloudflare OS was originally created as an internal platform for Cloudflare’s workforce.
“Cloudflare OS is how we run Cloudflare. For AI to truly transform an enterprise, it can’t live in a silo or behind a developer bottleneck. Every employee needs the ability to build, iterate, and automate safely,”
said Matthew Prince, co-founder and CEO of Cloudflare.
“We built this because nothing else did what we needed. Now any company can start from where it took us years to get.”
The company says it gave every employee access to the first version in May 2026. Thousands of employees across engineering and non-technical departments now use the system to create documents and presentations, automate repeatable tasks, research topics and build small applications for their daily work.
Cloudflare rebuilt the platform after identifying limitations in its first internal version. Early workspaces were primarily private, applications were mostly static and some predictable jobs continued to consume unnecessary AI tokens because users had to rerun agent instructions.
Collaboration also introduced a more serious challenge: controlling which information an agent had accessed and preventing that information from being exposed when an employee shared a workspace, application or AI-generated output.
The redesigned Cloudflare OS therefore combines an employee-facing agent workspace, an application-building platform and a new security framework for governing access to internal systems.
Employees Can Turn AI Outputs into Applications
Cloudflare OS is not limited to generating text or answering questions. Employees can turn conversations and outputs into working internal applications.
An employee could, for example, ask the workspace to create a dashboard that tracks project issues, an application for reviewing customer requests or a tool that visualises information from an approved company database.
Each application can include a browser interface, server-side code, an API and its own persistent database. Applications are private by default but can be shared with colleagues in a similar way to sharing a document.
Employees can share either the working application or a blueprint that allows another user to create an independent copy. A copied application receives its own data and connected resources rather than inheriting the original creator’s credentials, conversation history or stored information.
Because the applications remain editable, colleagues can ask AI agents to modify them without submitting a traditional software-development request. Cloudflare believes this model could allow employees to create smaller, highly specialized workplace tools without depending entirely on central engineering teams.
Support for Agents and Deterministic Workflows
Cloudflare OS can also convert recurring tasks into automated workflows.
Not every job requires an AI model to make every decision. Some business processes consist mainly of predictable steps, with AI needed only for specific activities that require interpretation or judgment.
The platform can combine conventional code for predictable actions with AI models for the parts that benefit from generative intelligence. Workflows can run manually, according to a schedule or when an event occurs in a connected business system.
This approach could help organisations reduce model usage and improve reliability by avoiding unnecessary AI inference for tasks that ordinary software can complete more efficiently.
Cloudflare OS also supports existing Model Context Protocol (MCP) servers via Cloudflare’s MCP Server Portals, allowing companies to connect approved tools and services already exposed via MCP.
Zero Trust Security and Gatekeepers
Security and governance are central to Cloudflare OS.
Access to the workspace is controlled through Cloudflare Access. Once inside the platform, every new agent and application begins without permission to access company resources.
Agents can request access to a specific resource, but the organisation determines whether that request should be approved. Credentials remain isolated from the agent and from any code the agent generates.
Cloudflare OS also limits network access. Server-side code runs in an isolated Cloudflare Worker without unrestricted outbound Internet connectivity, while browser-based code runs inside a sandbox. Connections to external services must be provided through explicitly approved capabilities.
A major part of this security system is a component Cloudflare calls a Gatekeeper.
Gatekeepers sit between Cloudflare OS and external services such as code repositories, databases or business applications. Instead of giving an agent broad access to an entire service, an administrator can restrict it to particular resources and actions.
For example, an agent could receive permission to read issues from one GitHub repository without being allowed to view the source code. A Gatekeeper could also hide sensitive fields, impose rate limits or require human approval before an action such as merging a pull request is completed.
Gatekeepers handle credentials, enforce access policies, record the resources an agent reads and mediate actions that could affect external systems.
Access Policies Follow the Data
Cloudflare OS also attempts to solve a difficult enterprise AI problem: controlling what happens after an agent has accessed sensitive information.
Restricting the first request is not always enough. An authorised employee might ask an agent to read a confidential database and produce a dashboard. Sharing that dashboard could unintentionally expose the underlying information to colleagues who were not authorised to access the original database.
To address this risk, Cloudflare OS keeps a record of the resources an agent has observed. That record remains attached to the workspace and its outputs.
When another person attempts to access the workspace, application or generated content, Gatekeepers can check whether the person also has permission to view the underlying resources. Information previously accessed by an agent can also affect whether the agent is permitted to send data externally, invite collaborators or transfer work to another agent.
Companies Can Choose Their AI Models
Cloudflare OS does not require organisations to use a single AI model provider.
Every model request passes through Cloudflare AI Gateway, giving administrators a central location for deciding which models employees and applications can use.
Companies could reserve more capable and expensive models for complex work while routing routine tasks to smaller, cheaper alternatives. This may help reduce the cost of deploying AI across a large workforce.
Administrators can attribute AI spending to individual employees, teams, applications, or workspaces. They can also establish budgets, impose rate limits, and determine what should happen when a spending threshold is reached.
You may also be interested in Cloudflare Wallets.
Open-Source Deployment and Implementation Partners
Cloudflare has released both the core Cloudflare OS repository and an example deployment based on its internal implementation.
Organisations can install the platform in their Cloudflare accounts and configure it with their own Cloudflare Access policies, AI Gateway settings, interfaces, data and integrations. Because the software is open source, companies retain greater control over the applications, skills and connections they build rather than tying them entirely to a closed workplace AI vendor.
Cloudflare is also working with implementation partners, including Presidio and Happy Cog, to help enterprises customise the platform. Partners can assist with connecting internal systems, creating organisation-specific interfaces, documenting shared skills and configuring security, compliance and cost controls.
Availability and Future Plans
Cloudflare OS is currently available through Cloudflare’s open-source GitHub repository. Organisations can explore the code, test a demonstration or deploy the starter version into their own Cloudflare accounts.
A managed Cloudflare OS product is expected to arrive through the Cloudflare dashboard. Cloudflare is also working on container support for development workflows and plans to bring Cloudflare OS workspaces into Slack and other workplace chat platforms.
The launch places Cloudflare more directly in the growing enterprise AI workspace market. However, rather than competing only as another workplace chatbot, the company is positioning Cloudflare OS as infrastructure through which organisations can give employees AI agents, application-building capabilities and governed access to internal systems.
Its open-source model, support for multiple AI providers, and emphasis on Zero Trust controls could make it particularly attractive to companies concerned about vendor lock-in, uncontrolled AI spending, and employees exposing sensitive business information through unapproved AI tools.
Read Cloudflare’s full announcement in this blog post.
Also see Why Cloudflare Is Betting on AI Agent Payments Now, And What It Means for the Bot-Driven Web.
