Cloudflare OS Review: The Security-First AI Workspace That Wants to Be Your Company's Operating System

Cloudflare OS is not a traditional computer operating system. It is an AI productivity environment—an "operating system for the company"—that originally ran inside Cloudflare's own walls before being open-sourced under the Apache 2.0 licence in August 2026. The project emerged from a real internal need: Cloudflare employees were building unvetted generative AI workflows that required elevated administrative access, creating security risks that the company's own security team could not tolerate. The result is a browser-based workspace that combines agent chat, sandboxed app development, and a capability-based security model into a single deployable stack built on Cloudflare Workers.

This review examines the repository at github.com/cloudflare/cloudflare-os, covering its architecture, security model, use cases, limitations, and overall value for organisations considering an AI-first workplace platform.

Table of Contents

• Key Features at a Glance
• What Cloudflare OS Actually Does
• The Three Building Blocks: Gadgets, Gatekeepers, and Blueprints
• Architecture and Technical Stack
• Security Model: Zero Permissions by Default
• Deployment and Pricing
• Pros and Cons
• Who Should Use Cloudflare OS?
• Verdict

Key Features at a Glance

What Cloudflare OS Actually Does

Cloudflare OS provides three core capabilities, as stated directly in the repository README:

1. An agent chat interface where users ask agents to complete tasks, grounded in company-specific knowledge about how the organisation operates.
2. Sandboxed application development that lets users ask agents to build "gadgets"—small personal apps—and safely share what they have built with colleagues.
3. A security framework called Gatekeepers that applies guardrails to both agents and apps, enabling non-technical users to experiment freely without creating security incidents.

The platform is designed to be forked and customised. Cloudflare's stated intention is not that your company uses Cloudflare OS, but that you make it "Your Company OS" by modifying terminology, procedures, interfaces, integrations, and policies to fit your organisation.

The Three Building Blocks: Gadgets, Gatekeepers, and Blueprints

Gadgets

A Gadget is a private instance of a productivity application. When you create a slide deck in Cloudflare OS, the system does not call out to a shared SaaS application. Instead, it creates a private instance of the slide deck software just for you, running in an isolated sandbox separate from everyone else's. Each Gadget runs as a Dynamic Worker Facet with outbound networking disabled by default, communicating only through explicitly bound Workers resources.

This architecture has two profound effects. First, it becomes structurally impossible for a slide deck app to leak your slides to an attacker through a shared vulnerability, because there is no shared instance. Second, because every user runs their own copy of the code, every user can freely modify their copy—prompting an agent to add features that would be impossible in a traditional SaaS model.

Gatekeepers

Gatekeepers are the security backbone of Cloudflare OS. Instead of exposing broad API keys to agents, each Gatekeeper is a service-specific Cloudflare Worker that holds credentials on the agent's behalf and exposes only narrowly scoped capabilities. A Gatekeeper could allow an agent to read issues in one GitHub repository while blocking source-code access, applying rate limits, masking sensitive fields, or requiring human approval before a pull request is merged.

The Gatekeeper completes the OAuth handshake, keeps the credential, enforces policy, and logs everything that was read. When a second person opens a shared workspace or output, Gatekeepers check that person against the observed resources before showing anything. This means access controls follow the work even after it is shared.

Blueprints

A Blueprint is a shareable template that captures an app's source code and required connections. When you share a Blueprint, recipients can instantiate their own copy of the app, connecting it to their own resources. Critically, Blueprints do not include chat history, database contents, or live credentials. This allows organisations to distribute useful applications without leaking sensitive data or authentication tokens.

Architecture and Technical Stack

Cloudflare OS is built entirely on Cloudflare's own infrastructure stack. The key components are:

The platform is browser-based and runs inside an enterprise's Cloudflare account. It can be deployed locally using pnpm run-local for evaluation, or deployed to a Cloudflare account through the hosted deployment flow. The backend requires a Workers Paid plan.

A notable architectural detail: the generated server code for Gadgets runs in a Dynamic Worker with outbound networking disabled by default, while browser code runs in a sandboxed iframe. This means a Gadget cannot make arbitrary network requests even if its code is malicious or compromised.

Security Model: Zero Permissions by Default

The security model is the most distinctive aspect of Cloudflare OS and the reason the project exists at all. The core principles are:

Agents start with zero permissions. No agent has any access to any resource until a Gatekeeper explicitly grants it. Every capability must be provisioned for a specific task.

Capabilities are narrow, not broad. Rather than granting an agent "GitHub access," a Gatekeeper grants "read issues in repository X." Rather than "Google Drive access," it grants "read document Y." This capability-based model enforces enterprise policies at the infrastructure level, not through prompt engineering or trust in the model.

Access controls follow the work. The platform records every resource an agent has observed. When a Gadget or output is shared, Gatekeepers check the new viewer against the observed resources. This prevents sensitive data from being indirectly exposed through a shared dashboard, a new collaborator, another agent, or an outbound request.

There is no way for a Gadget to leak itself. Because each Gadget runs in its own sandbox with no shared state, an attacker who compromises one Gadget cannot access another Gadget based on the same app, even if both are running the same code.

This model directly addresses the problem that led to Cloudflare OS's creation: employees building AI workflows with elevated administrative access that bypassed security review. By making secure behaviour the default—and unsafe behaviour architecturally difficult—Cloudflare aims to let non-technical users "go nuts" without causing incidents.

Deployment and Pricing

Cloudflare OS is open source under the Apache 2.0 licence. The core platform is available in the cloudflare/cloudflare-os repository, and a starter deployment template is available in cloudflare/cloudflare-os-starter, which adds branding, sign-in, integrations, and upgrade controls around a pinned upstream release.

There is no licence fee for the software itself. However, deploying Cloudflare OS requires:

• A Cloudflare account with a Workers Paid plan (the backend cannot run on the free tier)
• Cloudflare Workers, Durable Objects, Dynamic Workers, and AI Gateway usage, which are billed according to Cloudflare's standard consumption pricing
• Optionally, a self-hosted server if you prefer not to deploy entirely within Cloudflare's infrastructure, though the platform is deeply integrated with Cloudflare services

Cloudflare is also developing Cloudflare Wallets, a stable web identity and restricted virtual wallet system with spending caps, merchant allowlists, and transaction limits. Handle reservations are open, with full wallet funding planned for the coming months.

Pros and Cons

Who Should Use Cloudflare OS?

Cloudflare OS is best suited for organisations that meet several criteria:

You are already on Cloudflare. The platform assumes Cloudflare Workers, Access, Durable Objects, and AI Gateway. Deploying it outside Cloudflare's ecosystem is technically possible but contradicts the architecture's design assumptions.

You have a security-conscious culture. The Gatekeeper model is most valuable when the alternative—granting agents broad API access—is unacceptable. If your organisation is comfortable with agents holding broad credentials, Cloudflare OS's primary advantage is less compelling.

You want non-technical staff building with AI. The private-instance Gadget model makes it safe for sales, marketing, and operations teams to create and modify applications without engineering oversight.

You are prepared for early-access software. This is not a mature product. Expect breaking changes, incomplete integrations, and a fast-moving upstream. The repository even notes that Google Docs with multiple or nested tabs were blocked by a Gatekeeper implementation detail as recently as September 2026.

Verdict

Cloudflare OS is the most architecturally interesting enterprise AI workspace released in 2026. Its capability-based security model—where agents have zero permissions by default and every access grant is narrow, logged, and revoked when the work is shared—is a genuine contribution to how organisations should think about AI agent security. The private-instance Gadget model solves a real problem: it makes user modification of software safe in a way that shared SaaS instances cannot.

It is also clearly early-access software. The platform is a version 2 rewrite with known rough edges, tight coupling to Cloudflare's ecosystem, and a paid-tier requirement that limits casual experimentation. The documentation, while surprisingly thorough for a GitHub repository, is not yet a substitute for enterprise deployment guidance.

For organisations already invested in Cloudflare's platform, Cloudflare OS is a compelling foundation for an internal AI productivity environment—provided you are willing to treat it as early-access software and invest engineering time in customisation. For everyone else, it is a valuable reference architecture and a sign of where enterprise AI workspaces are heading, even if it is not yet a turnkey solution.

Score: 7.5/10 — A security-first design with real substance, held back by early-access maturity and platform lock-in.