Cloudflare has open-sourced Cloudflare OS, a browser-based workspace that gives each employee an AI agent grounded in their company’s own context, skills and internal systems. Any organization can deploy it in its own Cloudflare account, connect it to internal tools and customize it, the company said in its announcement.
“Cloudflare OS isn’t a traditional desktop OS,” Rita Kozlov, Cloudflare’s vice president of product, told CIO. “It reimagines the workplace computing environment for AI.”
Cloudflare gave the first version to every employee in May. Thousands of people, many outside engineering, now use it daily to make documents and slides, automate repeat tasks and build small apps. Kozlov told CIO that internal users created more than 4,000 apps, automations and tools over the previous 30 days, and that the sales team saved an estimated 10,000 hours on work such as territory planning and proposals.
Rebuilt around access control
The open-source release is a rebuild. In the first version, apps were static and repeat jobs meant running an agent skill again and spending more tokens. Sharing also exposed a gap: access to an MCP server showed which tools an agent could call, but not which underlying resources it had seen.
The new version is built on Workers, Dynamic Workers, Durable Objects and Cloudflare Access. Agents start with zero permissions and are granted only the tools a task needs. Access to outside services runs through Gatekeepers, Workers that sit between Cloudflare OS and a service such as GitHub. A Gatekeeper can limit an agent to one repository, let it read issues but not source code, mask fields, apply rate limits and require approval before merging a pull request. It handles OAuth and holds the credential, which never reaches the agent or any code it generates.
Cloudflare OS also records every resource an agent observes, so sharing a dashboard built from a sensitive table doesn’t hand that table to people who couldn’t open it directly. “Because agents act on people’s behalf and produce work others can access and modify, they require a new security model,” Kozlov said.
Spend and identity
Every model request is attributed to the person, team or workspace that made it, and admins can set budgets and rate limits. Cloudflare launched an Identity-Aware AI Gateway in beta alongside the release, plus AI Spend and User Insights tools that flag sessions costing more than twice an account’s 95th-percentile session cost. Kozlov said one customer used User Insights to catch an employee’s runaway AI session after it had generated a $30,000 bill.
Tech analyst Carmi Levy told CIO the name is a stretch, but a useful one. “This very much is not Windows, macOS, or Linux, and it isn’t an operating system by its common definition,” he said. “But Cloudflare’s use of this terminology implies familiarity to enterprise IT buyers.”
Partners Presidio and Happy Cog will help customers customize and roll out the platform. Cloudflare said it is working on a fully managed version in its dashboard, containers for development workflows, and workspaces inside Slack and other chat tools.
WebProNews is an iEntry Publication