Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing.
Except actually, it's different. This is a remake of Sandstorm[.]io, my startup from 10 years ago, except this time built on Cloudflare Workers (the platform I've spent the last 9 years building) and deeply leveraging AI. This is more or less the culmination of my secret 10-year master plan.
This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug. We believe a company's security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.
How is that possible? It's the Sandstorm security model, revisited. A "Gadget" is the same thing as a Sandstorm "Grain": a fine-grained app instance. For example, if you have a document editor app, each document runs as a separate instance of the app, in a separate sandbox (one "Gadget").
This means two things, both of which I think are Big Deals:
1. The platform can manage all access control, by controlling who can access the Gadget at all. There is no way the Gadget can accidentally leak itself to an attacker -- even an attacker who has access to other Gadgets based on the same app.
2. Since everyone is running their own copy of the code, everyone can freely modify their copy of the code.
Think about #2 a bit more.
What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.
Sandstorm tried to change that 10 years ago, but the world wasn't ready, because not enough people had the skills or patience to actually modify their software. AI has changed that. Now you just ask the agent -- the same agent that you are using to help you interact with the Gadget can also modify the code of the Gadget.
This is really interesting. I built a similar product (not released yet), but it uses Kubernetes as the infrastructure layer instead of Cloudflare OS. I guess all these years later I am left with the same existential question that plagued Sandstorm. What is its relevance in the context of Linux containers? This is not a rhetorical question, is there a real benefit for a Sandstorm grain over a docker style Linux container? Does a containerized process not have all the same benefits of a Sandstorm grain, with the added benefit of not requiring any modifications of the containerized software?
One argument I could bring is that despite all its claims, OpenAI still had to switch from containers to MicroVMs because its agents under test still managed to break out from their containers. Is the security model of a Sandstorm grain so much better that agents wouldn't figure out how to break out of it?
Sandstorm's use of containers was just a means to an end. The real innovation was the fine-grained instances -- each document in its own container. No other container platform did that.
But honestly, it didn't work well, because of cold start times and memory usage. It's bad enough when a server takes seconds to start, but if every document you open has a long startup time and uses hundreds of MB of RAM, it's really painful.
Neat! How does that work with the AI Gateway portion? I see some references in the code but at a quick glance I can't tell if you can configure it to skip AI Gateway.
Maybe it is my bubble, but the experience people are having with Anthropic particularly is motivating a big “get this stuff back under control” effort so while it may not be strategically optimal for Cloudflare the local hosting would prove more valuable to enterprises than maybe a few years back, even if presented as a backup plan.
Not yet, but that's an obvious direction to take things. :)
I'm really excited by the idea that this platform makes it safe to use blueprints that someone else vibe coded, without worrying about whether they checked it for security bugs, etc. Basically if the app works, it works. So yeah, there absolutely should be a marketplace so everyone can try everyone else's stuff.
BTW there are three blueprints installed automatically (docs, slides, sheets).
There is also qm with smol machines. I found this out the long way, by looking at the contributors to qm at https://github.com/yc-software/qm where I found BinSquare, the founder of smol machines. Then I found a tweet about a public instance of it where I could try out having it code something agentically - I'm in the replies here: https://x.com/binsquares/status/2083305704274976819
I guess the lock-in is to Cloudflare Workers, which is limited to JavaScript. I would in fact look into projects that are built around MicroVMs. It seems Buzz would be happy to use smolmachines, or whatever. You'd have to roll your own permission system, but smolmachines would at least take care of being able to use stuff within an app, by offering persistent, portable containers.
Actually I think now I can finally say why this is lock-in. The promise is "you can pretty much go wild" and that you can hand it off to non-technical people to do that. Much as you squint, there is not a sophisticated access control system available to self-hosted users.
The article posted buries the lead. Cloudflare OS reads like almost any other AI knowledge base until midway when apps are introduced and then becomes overly technical with a code snippet.
No one? Like literally, I don't understand a thing of what the blog post is saying. It's vague to the point of meaning nothing. Every piece of text I've seen that explains CloudflareOS is clear except the blog post.
(Not meant as a nit-pick — it's just something that adds really fascinating historical colour to a useful expression, that people often mistakenly re-correct)
Of course, personal apps are more useful if they can connect to external services. Cloudflare OS introduces a "connector" system we call Gatekeepers. This is sort of like MCP (and MCP is supported as a kind of Gatekeeper), but with a lot more:
* Instead of exposing tools, a Gatekeeper exposes a Cap'n Web RPC API. That makes it appropriate for use by both agents (via code mode) and Gadgets.
* Gatekeepers integrate with the Cloudflare OS UI to provide inline audit logging and human-in-the-loop approvals for all side-effecting actions.
* When an action requires approval, the agent does not need to stop and wait for it. A Gatekeeper will simulate the outcome, allowing the agent to keep running and queue up more work. You can then approve everything in a batch at the end. Hopefully, this means you no longer feel the need to turn on auto-approve! (But you still can if you want.)
We have already built Gatekeepers for a huge number of services, from GitHub to Home Assistant. We've found, with the right skills, AI can basically crank these things out for any given API, solving the chicken-and-egg ecosystem problem. We are working on a "software factory" of sorts where you can input the API docs for your favorite service and get a well-written Gatekeeper. That's not quite ready yet -- so for now use the ones we provide or use the write-gatekeeper skill to write your own. You can add your own Gatekeepers to your personal deployment.
Interesting, so how does this work with regards to purposeful but naive changes? If, for example, we have a Notion integration, and a non-technical user can add a feature to it via prompt, would it be possible for them to accidentally add something that sends a bunch of internal-only proprietary data to Notion? Would this system prevent or flag that in some way?
Gatekeepers can specify the sensitivity of their data. A Gatekeeper can actually flag an observation (a read operation) as being so sensitive that the agent should be prohibited from writing anywhere else after having seen that.
This is what allowed us to connect Cloudflare OS to our own sensitive internal data sources, containing things like customer data, revenue info, etc. Once you connect to one of those, the system enforces no data can be shared out of it.
That said, the policies are a bit blunt right now, maybe overly restrictive. We're going to be evolving it further.
> * When an action requires approval, the agent does not need to stop and wait for it. A Gatekeeper will simulate the outcome, allowing the agent to keep running and queue up more work. You can then approve everything in a batch at the end. Hopefully, this means you no longer feel the need to turn on auto-approve! (But you still can if you want.)
Can you say more about how you simulate outcomes of approvals? For example, if I need an approval to be granted permission to read a document, how could it simulate the document contents?
Reads are, however, limited to only the resources you have explicitly attached.
Moreover, since agents and gadgets run in a sandbox with essentially no access to the outside world except via approved channels (Gatekeepers), it's essentially not possible for the agent to leak secrets it has seen unless you approve a later write.
In fact, the system actually keeps track of everything the agent / gadget has observed to know if it is "tained", and can use that to flag later actions as dangerous, e.g. due to prompt injection or possible leaking of secrets. (This is still evolving, but all the groundwork is there.)
(Of course, this assumes you trust the LLM provider itself not to steal secrets from your prompts. Most LLM providers offer zero-data-retention options, but if you don't trust them you can also use a local LLM. We support ollama and will support others in time.)
The key aspect here is "when an action requires approval". i.e. an action which writes. Presumably you are granting the read access when firing this process off in the first place.
When you share a Gadget, we verify that anyone you share with also has direct permission to access each of the resources it is connected to (via the Gatekeeper system). Hence, no security bug in the Gadget itself could accidentally grant people access to things they don't already have.
Everytime I read about new things from Cloudflare they look really cool but I cannot shake the feeling of not wanting to use them for fear of lock-in, am I too paranoid?
You can easily be locked in as Cloudflare's suite of tools can be quite exotic, and the dev ops for them can look quite unlike anything else. But you can also easily mentally estimate the magnitude of lock-in for every weird tool or technology that you use.
If you only do SPA/SSR websites over workers, then Cloudlfare has about zero lock in. Add in the sqlite? Well, it's just sqlite, but it's Cloudlfare's sqlite so there's still some learning to do. And the vector database? And the really exotic and powerful one, their durable objects.
Also as someone else has noted, Cloudflare is big and boring enough as a company that it's okay to experience some lock-in.
I feel exactly the same. The CF services I do use are DNS and R2. I'd be curious if there's a guide somewhere that lists their services through the lens of lock-in. For example, R2 is somewhat S3 compatible so it's less risky to use because I can swap providers.
Cloudflare seems mature enough at this point that if you're willing to accept any kind of vendor lock-in, then accepting it through them is likely acceptable. I won't say they're on-par with the big cloud providers, but if they offer the services you need and you'd be willing to lock-in with AWS, etc., then they should be considered.
If you're generally opposed to any vendor lock-in, then Cloudflare is definitely a hard sell. Many of their services are pretty specific to their ecosystem and I imagine trying to keep things portable would be infeasible any many scenarios. Granted, this is true in a provider like AWS, too, if you were depending heavily on their proprietary, managed services. But there's definitely value in knowing that you can stick to "generic" services as much as possible in AWS and be able to move away relatively easily.
Cloudflare is definitely becoming a "real" cloud provider (I'd say their release of R2, for me, pushed them into the "serious contender" category), but they focus on pretty specific features that aren't very portable. This Cloudflare OS service is a good example of that. If it is exactly what you need, then it is worth checking out and taking on the risk of vendor lock-in. But if you're doing something where long-term planning and portability is important, then you'll have a hard time warranting even considering them.
Yes. Be locked in. It's better to go 100% and only pay the switch costs if you have to.
Developing abstractions to let you switch technologies has 2 costs: The actual development, and not fully utilizing a specific technology. Lots of people prefer pain in small doses because it can be rationalized as eventual payoff.
There are degrees of this decision, of course, but I would say most folks worry too much about this particular champagne problem.
Yeah, with love the words "open source" mean a lot less here (de facto, of course not de jure) when the resulting open source product is entirely contingent on Cloudflare's PaaS.
And I think they suffer a little a little bit from their infrastructure being _comparatively_ unique. As providers go, they're on the harder end to replace with something else if you were to ever want to retarget your workloads.
Cloudflare is just another corporation with greed in their eyes and if you don't design yourself to their puzzle than you're not welcomed.
So, no, you're not. This is another stab at gatekeeping the upcoming Ai era of the internet. It's no different to the playbook of Google, Apple, and Facebook of the 00's. An extra wall in walled garden land; another one you will need to jump if you want to break free.
In terms of security: My firefox on FreeBSD instantly triggers loops of "prove your human" on their turnstile. I can't use old versions of android without being denied and a single VPN triggers all. Anything that they don't see as "secure" you're denied from.
What is stopping them from deeming my or your LLM as unsafe?
Scenario: You're ready to launch, you come up with the next best innovation for the next generation Ai internet. Revolutionary and your about to launch, blast off. Wait you're denied your launch because it threatens their service. Stories have been posted on HN on how startups have been sabotaged by rug-pulling of Cloud services from cloud providers.
It is vendor lock-in at it's best. Google & Co, would be jealous; if they were not in bed with. This is: "Your LLM/Ai isn't using our service, so your LLM/Ai isn't allowed within our garden" netting and what does Cloudflare offer as a service?
A turnstile to the Internet of Things but this time you get to self-host your own corner on their land but they still get the ticket sales and access policy of.
Remember folks, no corporation gives a rat's ass about you. Internally, or externally, you're just another sheep to extract wool from.
"OS for work" - like, what does it mean? OS is operating system, it runs on a hardware and provides you to operate the system. I hate when companies destroy the English language with vibe invented terms.
An operating system manages access to shared hardware (disk, CPU, memory, networking, display, etc. on a single machine OS). The naming makes sense to me.
This is not a traditional computer operating system. We use the term "operating system" in two senses:
- An operating system for the company to be productive with AI, in a way that is safe, so that the security team can sleep at night.
- An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.
I think because the idea of an "agent operating system" is starting to feel more and more inevitable. Since I can use AI to:
- Pull information from external sources
- Transform and/or augment that information
- Publish information
I almost do not need a traditional OS anymore. This obviously isn't entirely true: I still use it to interact directly with humans, and it's the way I access my LLM. For now.
Because AI enables a new layer more akin to an actual OS. But also because I imagine they all want all the things running through them and an OS is the widest net they can cast in that direction.
Indeed, at this point it's one of the most devalued terms in software. Every week I'm reading about some product calling itself "the Operating System for XYZ." It seems like it's what you do when "platform" just feels too modest. To me, if it's not bootable, calling your product an OS just reeks of marketing sleight of hand.
This represents a small part of what IT is worried about. Offer a beer and say the word "SharePoint" if you want the long version of where this could wind up.
The issue isn't letting end-users add features. The issue is twelve end-users customizing something that produces output, saving it, and now nobody can read it.
This can get solved. If it even gets a chance to gain traction (it should, though IT will of course push back). But let's not pretend we're there yet.
This is effectively a Codex/Claude app competitor. Good move from Cloudflare since it helps them sell their core infra offerings. I like the direction they’re going with access control.
The real question is, can Cloudflare become a equal or better OpenAI / Claude provider, while offering a vastly more robust platform than either?
I think the answer is yes, simply because both OAI and Anthropic leverage CF for their hosting today.
I used to meme back in 2008 (when Google docs first was becoming big) that "The problem has always been the sandbox". The problem Chrome and Firefox solved as the Sandbox - you can browse some random code across the web without worrying about getting hacked. The same problem has arisen today but now with AI agents.
There is likely to be huge winners in the AI space simply based on who can create the best way to contain AI agents and "expose AI value" safely.
So, that means even more pressure on OpenAI and Anthropic. I really don’t see how they will stay competitive long term. Cloudflare can offers way better product by integrating with the rest of their platform and offering a variety of models, including open models they host themselves
I can't help but wonder if these things that are now emerging have a sort of "borrowed time" component tied to them.
I see the examples, and they clearly tackle both organizational inefficiencies and human connection/communication as the core problems.
Sounds like things are converging to "my AI will talk to your AI" and the role of humans will just be a human "router" in the loop switching up nodes in a graph, like the return of Switchboard Operators from the 1950s.
> Cloudflare OS is available today and is open source. Check out the cloudflare-os GitHub repository. You can deploy it into your own Cloudflare account and use your own Access policies, AI Gateway configuration, data, and integrations.
It's open source, but it is so incredibly tied to their platform, that there is no vendor portability, which has made almost every of their product launches post-Workers kind of meh.
This is not a traditional computer operating system. We use the term "operating system" in two senses:
An operating system for the company to be productive with AI, in a way that is safe, so that the security team can sleep at night.
An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.
Engineers should be wary about being forced into using particular prompts/skills/instructions.
Why would I use a shared LLM-in-the-cloud, instead of my own? The shared one precludes any possibility to customize or differentiate my workflow, prompts, or skills. As an employee that sounds like a death sentence to doing my job effectively.
Everyone is building these same looking apps that look like Codex, Claude desktop. We don't need these. Slackbots work more than well enough to collaborate with agents.
This is the middle of Cloudflare's "Agents Week"... and I believe they had an Agents Week last year. We're like... at least a year or two into Cloudflare being in the AI party. ;)
I liked Kenton's take on this: https://x.com/KentonVarda/status/2084990137180590572?s=20
Text from tweet:
Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing.
Except actually, it's different. This is a remake of Sandstorm[.]io, my startup from 10 years ago, except this time built on Cloudflare Workers (the platform I've spent the last 9 years building) and deeply leveraging AI. This is more or less the culmination of my secret 10-year master plan.
This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug. We believe a company's security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.
How is that possible? It's the Sandstorm security model, revisited. A "Gadget" is the same thing as a Sandstorm "Grain": a fine-grained app instance. For example, if you have a document editor app, each document runs as a separate instance of the app, in a separate sandbox (one "Gadget").
This means two things, both of which I think are Big Deals: 1. The platform can manage all access control, by controlling who can access the Gadget at all. There is no way the Gadget can accidentally leak itself to an attacker -- even an attacker who has access to other Gadgets based on the same app. 2. Since everyone is running their own copy of the code, everyone can freely modify their copy of the code.
Think about #2 a bit more.
What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.
Sandstorm tried to change that 10 years ago, but the world wasn't ready, because not enough people had the skills or patience to actually modify their software. AI has changed that. Now you just ask the agent -- the same agent that you are using to help you interact with the Gadget can also modify the code of the Gadget.
And it is so fun.
This is really interesting. I built a similar product (not released yet), but it uses Kubernetes as the infrastructure layer instead of Cloudflare OS. I guess all these years later I am left with the same existential question that plagued Sandstorm. What is its relevance in the context of Linux containers? This is not a rhetorical question, is there a real benefit for a Sandstorm grain over a docker style Linux container? Does a containerized process not have all the same benefits of a Sandstorm grain, with the added benefit of not requiring any modifications of the containerized software?
One argument I could bring is that despite all its claims, OpenAI still had to switch from containers to MicroVMs because its agents under test still managed to break out from their containers. Is the security model of a Sandstorm grain so much better that agents wouldn't figure out how to break out of it?
Sandstorm's use of containers was just a means to an end. The real innovation was the fine-grained instances -- each document in its own container. No other container platform did that.
But honestly, it didn't work well, because of cold start times and memory usage. It's bad enough when a server takes seconds to start, but if every document you open has a long startup time and uses hundreds of MB of RAM, it's really painful.
Cloudflare OS doesn't use containers. It uses Dynamic Workers, which are 100x more efficient: https://blog.cloudflare.com/dynamic-workers/
So the stuff I have been building in Workers for the past 9 years turns out to be the thing that Sandstorm needed all along. What a coincidence. :)
Sandstorm without self hosting has no interest though. (Edit: see below, where the creator states it _can_ be run locally)
Buzz looks like a more reasonable direction than this does.
What do you mean? This is 100% open source and self-hostable!
https://github.com/cloudflare/cloudflare-os
It runs on the open source Workers Runtime:
https://github.com/cloudflare/workerd
You can run it at home if you want. There's even a Home Assistant Gatekeeper.
So you can run it off the public internet with no sneaky external dependency on cloudflare, slack etc?
And it would be functionally the same? With the same performance if you put enough hardware there?
If so cool, and that should have been clearly in the announcement, because as it sounded it is “I am a sucker, lock me in!”
> So you can run it off the public internet with no sneaky external dependency on cloudflare, slack etc?
Yes. It even supports ollama and works decently well with some local LLMs.
> And it would be functionally the same? With the same performance if you put enough hardware there?
Honestly it is faster running locally.
> If so cool, and that should have been clearly in the announcement,
We had so many things we wanted to say, it was hard to fit them all into one story.
The blog post is for an enterprise audience. My tweet thread is for the hacker audience.
Neat! How does that work with the AI Gateway portion? I see some references in the code but at a quick glance I can't tell if you can configure it to skip AI Gateway.
That is actually cool.
Maybe it is my bubble, but the experience people are having with Anthropic particularly is motivating a big “get this stuff back under control” effort so while it may not be strategically optimal for Cloudflare the local hosting would prove more valuable to enterprises than maybe a few years back, even if presented as a backup plan.
Do you have a store/list of public blueprints like sandstorm?
Not yet, but that's an obvious direction to take things. :)
I'm really excited by the idea that this platform makes it safe to use blueprints that someone else vibe coded, without worrying about whether they checked it for security bugs, etc. Basically if the app works, it works. So yeah, there absolutely should be a marketplace so everyone can try everyone else's stuff.
BTW there are three blueprints installed automatically (docs, slides, sheets).
There is also qm with smol machines. I found this out the long way, by looking at the contributors to qm at https://github.com/yc-software/qm where I found BinSquare, the founder of smol machines. Then I found a tweet about a public instance of it where I could try out having it code something agentically - I'm in the replies here: https://x.com/binsquares/status/2083305704274976819
I guess the lock-in is to Cloudflare Workers, which is limited to JavaScript. I would in fact look into projects that are built around MicroVMs. It seems Buzz would be happy to use smolmachines, or whatever. You'd have to roll your own permission system, but smolmachines would at least take care of being able to use stuff within an app, by offering persistent, portable containers.
Actually I think now I can finally say why this is lock-in. The promise is "you can pretty much go wild" and that you can hand it off to non-technical people to do that. Much as you squint, there is not a sophisticated access control system available to self-hosted users.
Yes, just like SaaS was a limitation to it's utility, PaaS is still a limitation, just on a different level.
That should have been the announcement.
The article posted buries the lead. Cloudflare OS reads like almost any other AI knowledge base until midway when apps are introduced and then becomes overly technical with a code snippet.
We really struggled with how to present this to multiple audiences at once.
My tweet thread, and the GitHub readme, is really the presentation intended for the HN crowd. The blog post is for a different audience.
https://github.com/cloudflare/cloudflare-os
> The blog post is for a different audience.
No one? Like literally, I don't understand a thing of what the blog post is saying. It's vague to the point of meaning nothing. Every piece of text I've seen that explains CloudflareOS is clear except the blog post.
Random trivia (and something I learned this way myself from an internet reply, though I can't remember when):
What gets buried is the "lede". It is a really unusual thing — a deliberate, engineered misspelling of "lead" that leaked into broader use:
https://www.merriam-webster.com/wordplay/bury-the-lede-versu...
(Not meant as a nit-pick — it's just something that adds really fascinating historical colour to a useful expression, that people often mistakenly re-correct)
https://xcancel.com/KentonVarda/status/2084990137180590572
[delayed]
> the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug.
This can only be correct when the application can’t affect anything outside the sandbox. Which would significantly restrict useful applications.
See my next tweet in the chain:
https://x.com/KentonVarda/status/2084990302784307363
-------------
Of course, personal apps are more useful if they can connect to external services. Cloudflare OS introduces a "connector" system we call Gatekeepers. This is sort of like MCP (and MCP is supported as a kind of Gatekeeper), but with a lot more:
* Instead of exposing tools, a Gatekeeper exposes a Cap'n Web RPC API. That makes it appropriate for use by both agents (via code mode) and Gadgets.
* Gatekeepers integrate with the Cloudflare OS UI to provide inline audit logging and human-in-the-loop approvals for all side-effecting actions.
* When an action requires approval, the agent does not need to stop and wait for it. A Gatekeeper will simulate the outcome, allowing the agent to keep running and queue up more work. You can then approve everything in a batch at the end. Hopefully, this means you no longer feel the need to turn on auto-approve! (But you still can if you want.)
We have already built Gatekeepers for a huge number of services, from GitHub to Home Assistant. We've found, with the right skills, AI can basically crank these things out for any given API, solving the chicken-and-egg ecosystem problem. We are working on a "software factory" of sorts where you can input the API docs for your favorite service and get a well-written Gatekeeper. That's not quite ready yet -- so for now use the ones we provide or use the write-gatekeeper skill to write your own. You can add your own Gatekeepers to your personal deployment.
Interesting, so how does this work with regards to purposeful but naive changes? If, for example, we have a Notion integration, and a non-technical user can add a feature to it via prompt, would it be possible for them to accidentally add something that sends a bunch of internal-only proprietary data to Notion? Would this system prevent or flag that in some way?
Gatekeepers can specify the sensitivity of their data. A Gatekeeper can actually flag an observation (a read operation) as being so sensitive that the agent should be prohibited from writing anywhere else after having seen that.
This is what allowed us to connect Cloudflare OS to our own sensitive internal data sources, containing things like customer data, revenue info, etc. Once you connect to one of those, the system enforces no data can be shared out of it.
That said, the policies are a bit blunt right now, maybe overly restrictive. We're going to be evolving it further.
> * When an action requires approval, the agent does not need to stop and wait for it. A Gatekeeper will simulate the outcome, allowing the agent to keep running and queue up more work. You can then approve everything in a batch at the end. Hopefully, this means you no longer feel the need to turn on auto-approve! (But you still can if you want.)
Can you say more about how you simulate outcomes of approvals? For example, if I need an approval to be granted permission to read a document, how could it simulate the document contents?
Reads do not require approval. Only writes do.
Reads are, however, limited to only the resources you have explicitly attached.
Moreover, since agents and gadgets run in a sandbox with essentially no access to the outside world except via approved channels (Gatekeepers), it's essentially not possible for the agent to leak secrets it has seen unless you approve a later write.
In fact, the system actually keeps track of everything the agent / gadget has observed to know if it is "tained", and can use that to flag later actions as dangerous, e.g. due to prompt injection or possible leaking of secrets. (This is still evolving, but all the groundwork is there.)
(Of course, this assumes you trust the LLM provider itself not to steal secrets from your prompts. Most LLM providers offer zero-data-retention options, but if you don't trust them you can also use a local LLM. We support ollama and will support others in time.)
The key aspect here is "when an action requires approval". i.e. an action which writes. Presumably you are granting the read access when firing this process off in the first place.
Or more directly:
When you share a Gadget, we verify that anyone you share with also has direct permission to access each of the resources it is connected to (via the Gatekeeper system). Hence, no security bug in the Gadget itself could accidentally grant people access to things they don't already have.
> What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
Yep, that's precisely the vision I formulated some months ago: https://manuel.kiessling.net/2025/11/04/what-if-software-shi...
Damn, this is a pretty big deal!
Can you explain why you think this is a big deal?
What particular feature/capability made you think this?
I do not disagree but i am curios. Lets have a discussion instead of just throwing feel good vibes around...
Everytime I read about new things from Cloudflare they look really cool but I cannot shake the feeling of not wanting to use them for fear of lock-in, am I too paranoid?
You can easily be locked in as Cloudflare's suite of tools can be quite exotic, and the dev ops for them can look quite unlike anything else. But you can also easily mentally estimate the magnitude of lock-in for every weird tool or technology that you use.
If you only do SPA/SSR websites over workers, then Cloudlfare has about zero lock in. Add in the sqlite? Well, it's just sqlite, but it's Cloudlfare's sqlite so there's still some learning to do. And the vector database? And the really exotic and powerful one, their durable objects.
Also as someone else has noted, Cloudflare is big and boring enough as a company that it's okay to experience some lock-in.
This is 100% open source and self-hostable.
https://github.com/cloudflare/cloudflare-os
It runs on top of our open source runtime.
https://github.com/cloudflare/workerd
No, you’re not too paranoid. It has already proven both in the software and hardware world what vendor lock-in can lead to.
Also check out Bunny.net.
I feel exactly the same. The CF services I do use are DNS and R2. I'd be curious if there's a guide somewhere that lists their services through the lens of lock-in. For example, R2 is somewhat S3 compatible so it's less risky to use because I can swap providers.
Cloudflare seems mature enough at this point that if you're willing to accept any kind of vendor lock-in, then accepting it through them is likely acceptable. I won't say they're on-par with the big cloud providers, but if they offer the services you need and you'd be willing to lock-in with AWS, etc., then they should be considered.
If you're generally opposed to any vendor lock-in, then Cloudflare is definitely a hard sell. Many of their services are pretty specific to their ecosystem and I imagine trying to keep things portable would be infeasible any many scenarios. Granted, this is true in a provider like AWS, too, if you were depending heavily on their proprietary, managed services. But there's definitely value in knowing that you can stick to "generic" services as much as possible in AWS and be able to move away relatively easily.
Cloudflare is definitely becoming a "real" cloud provider (I'd say their release of R2, for me, pushed them into the "serious contender" category), but they focus on pretty specific features that aren't very portable. This Cloudflare OS service is a good example of that. If it is exactly what you need, then it is worth checking out and taking on the risk of vendor lock-in. But if you're doing something where long-term planning and portability is important, then you'll have a hard time warranting even considering them.
Yes. Be locked in. It's better to go 100% and only pay the switch costs if you have to.
Developing abstractions to let you switch technologies has 2 costs: The actual development, and not fully utilizing a specific technology. Lots of people prefer pain in small doses because it can be rationalized as eventual payoff.
There are degrees of this decision, of course, but I would say most folks worry too much about this particular champagne problem.
They also provide cover to those doing the dirty stuff which drives the need for their other products.
Not remotely paranoid.
Yeah, with love the words "open source" mean a lot less here (de facto, of course not de jure) when the resulting open source product is entirely contingent on Cloudflare's PaaS.
And I think they suffer a little a little bit from their infrastructure being _comparatively_ unique. As providers go, they're on the harder end to replace with something else if you were to ever want to retarget your workloads.
Cloudflare is just another corporation with greed in their eyes and if you don't design yourself to their puzzle than you're not welcomed.
So, no, you're not. This is another stab at gatekeeping the upcoming Ai era of the internet. It's no different to the playbook of Google, Apple, and Facebook of the 00's. An extra wall in walled garden land; another one you will need to jump if you want to break free.
In terms of security: My firefox on FreeBSD instantly triggers loops of "prove your human" on their turnstile. I can't use old versions of android without being denied and a single VPN triggers all. Anything that they don't see as "secure" you're denied from.
What is stopping them from deeming my or your LLM as unsafe?
Scenario: You're ready to launch, you come up with the next best innovation for the next generation Ai internet. Revolutionary and your about to launch, blast off. Wait you're denied your launch because it threatens their service. Stories have been posted on HN on how startups have been sabotaged by rug-pulling of Cloud services from cloud providers.
It is vendor lock-in at it's best. Google & Co, would be jealous; if they were not in bed with. This is: "Your LLM/Ai isn't using our service, so your LLM/Ai isn't allowed within our garden" netting and what does Cloudflare offer as a service?
A turnstile to the Internet of Things but this time you get to self-host your own corner on their land but they still get the ticket sales and access policy of.
Remember folks, no corporation gives a rat's ass about you. Internally, or externally, you're just another sheep to extract wool from.
"OS for work" - like, what does it mean? OS is operating system, it runs on a hardware and provides you to operate the system. I hate when companies destroy the English language with vibe invented terms.
If this succeeds, it's going to be in spite of its branding and marketing.
An operating system manages access to shared hardware (disk, CPU, memory, networking, display, etc. on a single machine OS). The naming makes sense to me.
Why are companies slapping "OS" in their product naming? it's stupid
From the GitHub page:
I think because the idea of an "agent operating system" is starting to feel more and more inevitable. Since I can use AI to:
I almost do not need a traditional OS anymore. This obviously isn't entirely true: I still use it to interact directly with humans, and it's the way I access my LLM. For now.Does your LLM have hardware drivers in it? this is silly.
Because AI enables a new layer more akin to an actual OS. But also because I imagine they all want all the things running through them and an OS is the widest net they can cast in that direction.
Same reason why grifters adopted web3 when Web 3.0 was already an established term.
Cause they’re trying to build an ecosystem
It's better than "harness."
I disagree. Harness is a pretty great word, and it doesn't already have another familiar meaning.
Why do people add "OS" to their product/project name when it is not an OS at all?
Indeed, at this point it's one of the most devalued terms in software. Every week I'm reading about some product calling itself "the Operating System for XYZ." It seems like it's what you do when "platform" just feels too modest. To me, if it's not bootable, calling your product an OS just reeks of marketing sleight of hand.
This represents a small part of what IT is worried about. Offer a beer and say the word "SharePoint" if you want the long version of where this could wind up.
The issue isn't letting end-users add features. The issue is twelve end-users customizing something that produces output, saving it, and now nobody can read it.
This can get solved. If it even gets a chance to gain traction (it should, though IT will of course push back). But let's not pretend we're there yet.
Probably better if they make it obvious that you need Workers paid plan:
"Your Cloudflare account is on the Free plan, but the Cloudflare OS backend needs Dynamic Workers, which requires the Workers Paid plan."
Why?
I really don't know how folks accept such vendor lock-in. Imagine using Cloudflare Workers as your main tech stack. This is crazy.
This is effectively a Codex/Claude app competitor. Good move from Cloudflare since it helps them sell their core infra offerings. I like the direction they’re going with access control.
The real question is, can Cloudflare become a equal or better OpenAI / Claude provider, while offering a vastly more robust platform than either?
I think the answer is yes, simply because both OAI and Anthropic leverage CF for their hosting today.
I used to meme back in 2008 (when Google docs first was becoming big) that "The problem has always been the sandbox". The problem Chrome and Firefox solved as the Sandbox - you can browse some random code across the web without worrying about getting hacked. The same problem has arisen today but now with AI agents.
There is likely to be huge winners in the AI space simply based on who can create the best way to contain AI agents and "expose AI value" safely.
So, that means even more pressure on OpenAI and Anthropic. I really don’t see how they will stay competitive long term. Cloudflare can offers way better product by integrating with the rest of their platform and offering a variety of models, including open models they host themselves
Yep, a pre-wrapped Codex for enterprise. Seems like the logical evolution from setting up an MCP.
Codex for enterprise is Codex for enterprise.
So, a security-oriented cloud agent framework? Better call it an OS.
I can't help but wonder if these things that are now emerging have a sort of "borrowed time" component tied to them.
I see the examples, and they clearly tackle both organizational inefficiencies and human connection/communication as the core problems.
Sounds like things are converging to "my AI will talk to your AI" and the role of humans will just be a human "router" in the loop switching up nodes in a graph, like the return of Switchboard Operators from the 1950s.
how this can be compared against Microsoft agent framework?
> Cloudflare OS is available today and is open source. Check out the cloudflare-os GitHub repository. You can deploy it into your own Cloudflare account and use your own Access policies, AI Gateway configuration, data, and integrations.
In case anybody missed it.
It's open source, but it is so incredibly tied to their platform, that there is no vendor portability, which has made almost every of their product launches post-Workers kind of meh.
I am confused... it's not an OS, is it?
https://github.com/cloudflare/cloudflare-os#cloudflare-os-an...
This is not a traditional computer operating system. We use the term "operating system" in two senses:
An operating system for the company to be productive with AI, in a way that is safe, so that the security team can sleep at night. An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.
> We use the term "operating system" incorrectly.
FTF[them]
Wait, isn’t that what Mistral does for their Vibe interface for companies?
They had a demo https://news.ycombinator.com/item?id=49101234
Engineers should be wary about being forced into using particular prompts/skills/instructions.
Why would I use a shared LLM-in-the-cloud, instead of my own? The shared one precludes any possibility to customize or differentiate my workflow, prompts, or skills. As an employee that sounds like a death sentence to doing my job effectively.
That's why this is open source.
https://github.com/cloudflare/cloudflare-os
You're supposed to customize it.
Also it features a whole system for adding your own skills and context.
Everyone is building these same looking apps that look like Codex, Claude desktop. We don't need these. Slackbots work more than well enough to collaborate with agents.
gas town 2 real???
Setting up your public URLRetrying… (attempt 5 of 6) Fingers crossed!! The last one gotta be the one...
EDIT: It let me down... (Something unexpected went wrong on our side.)
Please let me now if deploying it on your custom domain worked for you please...
Seemingly Cloudflare’s strategy nowadays is shipping “open-source” projects that are coupled with their own infastructure. First EmDash CMS, now this.
Not a bad marketing strategy. Vendor lock in matters a lot less to some people than it does to me.
From: https://os.cloudflare.app/
> "Give every person an agent and workspace built around how your company works, what it knows, and the systems it relies on."
Hundreds of thousands of so called "AI startups" have been eliminated.
Or they can just transition to Cloudflare OS and keep their domain-specific data proprietary, which is where the money is in the first place.
Ah look, yet another one jumping into AI party.
This is the middle of Cloudflare's "Agents Week"... and I believe they had an Agents Week last year. We're like... at least a year or two into Cloudflare being in the AI party. ;)
This is close to what I need for my company. Currently I'm test driving Open WebUI.
https://github.com/open-webui/open-webui