Cloudflare (@Cloudflare), founded by Matthew Prince, Michelle Zatlyn and Lee Holloway, introduced an early preview of Cloudflare Computer on August 3, wrapping its isolates, Durable Objects and Linux containers into one runtime for AI agents. The product gives each agent a persistent filesystem and lets developers move work between lightweight execution environments and full containers without building that coordination layer themselves, according to an announcement by Cloudflare engineers Matt Carey and Aron Carroll.
The release carries forward a technical instinct that has shaped Cloudflare since its 2009 founding: shared infrastructure becomes valuable when it can absorb work from many users without forcing each one to manage the machinery underneath. Prince and Holloway first built Project Honey Pot to track how spammers harvested email addresses; Cloudflare grew out of the thesis that that data could help make web traffic faster and safer. Holloway built Cloudflare's first working prototype.
Under Prince and Zatlyn, Cloudflare later made the same efficiency argument around application compute. Workers, introduced nearly a decade ago, runs code inside V8 isolates instead of assigning each workload a dedicated virtual machine. Computer applies that architecture to agents, which may remain active for long periods while performing only short bursts of demanding work.
Carey, a senior systems engineer whose Cloudflare author page shows prior work on agent and MCP-related products including Code Mode and Artifacts, and principal systems engineer Aron Carroll are turning that infrastructure into a developer-facing abstraction. Their premise is direct: an agent needs files, a shell and tools, while relatively few of its individual actions require an entire Linux environment.
A filesystem becomes the control plane
The core of Cloudflare Computer is a virtual filesystem held inside a Durable Object and backed by SQLite. An agent can read and edit files, work with Git repositories, prepare data and preserve state across execution environments.
Several execution backends ship in the preview, including a Cloudflare Container and isolate-based options for shell commands and JavaScript execution. Developers can also write their own backends.
Developers call those environments through a common runtime interface. Cloudflare Computer can connect a backend only when the agent first needs it, and a workspace can also operate without an execution backend when a task only requires filesystem access.
That design treats the filesystem as the stable object and compute as a temporary resource attached to it. File manipulation, data processing and Git operations can remain inside isolates. An instruction requiring Linux, npm
, a package manager or a native binary can move into a container while continuing to work against the same files.
Cloudflare says the system gates, audits and observes file operations, giving developers a record of what an agent changed. Cloudflare's example is a bug-triage agent. Product-specific tools, such as replying to the issue, can sit beside the general file, Git and shell tools.
The architecture reserves containers for work that needs Linux, npm
or native binaries. The underlying services are already commercial products: earlier in 2026, Cloudflare made Sandboxes and Containers generally available, giving Computer a commercial substrate for heavier execution while the new package remains a preview.
Cloudflare is challenging the container-per-agent default
Cloudflare argues that assigning a full container to every agent will become impractical as concurrent agent counts grow. Isolates start faster, can hibernate during idle periods and allow many workloads to share a process. Containers remain available for tasks that need operating-system compatibility or stronger separation from the isolate runtime.
Computer builds on Cloudflare's earlier 2026 general availability release for Sandboxes and Containers. It keeps those products in the path by making the container an escalation route inside a broader runtime, preserving the capability Cloudflare recently shipped while trying to reduce how often developers incur its startup and execution costs.
That distinction is Cloudflare's opening in an increasingly busy agent infrastructure market. E2B offers cloud sandboxes for agents. Daytona describes stateful sandboxes for agents. Vercel Sandbox runs untrusted code in ephemeral microVMs for Vercel users, while AWS AgentCore includes a managed code-interpreter environment.
Cloudflare is selling a different default: keep durable state near an isolate, then attach heavier compute only for the commands that require it. The approach fits Cloudflare's broader developer-platform strategy, which puts Workers at the center of Cloudflare's attempt to host, connect and secure autonomous software workloads.
Cloudflare also enters this contest with a large installed platform and the balance sheet to keep building lower in the stack. Cloudflare reported $639.8 million in first-quarter 2026 revenue, up 34% from a year earlier, and $4.16 billion in cash, cash equivalents and available-for-sale securities as of March 31. Those resources give Prince and Zatlyn room to develop agent infrastructure alongside Cloudflare's security and networking businesses rather than requiring the runtime to become a standalone business immediately.
The preview label matters
Cloudflare introduced Computer as an early preview and open-source experiment, a different status from the underlying Sandboxes and Containers services. Those services became generally available earlier in 2026.
Security will also shape adoption. Cloudflare's Workers security model uses V8 isolates so multiple tenants can share a process with low overhead. Cloudflare documents additional defenses against Spectre-style side-channel attacks, while tasks requiring native code are directed to containers. Computer inherits the practical appeal of that split and the obligation to make its boundaries understandable to developers running untrusted agent-generated code.
The open-source release gives Cloudflare a way to test the abstraction with developers. It also lets developers inspect the runtime, add their own backends and challenge Cloudflare's assumption that agents can reliably choose the least expensive environment capable of completing each task.
For Prince, Zatlyn and the engineers building Cloudflare's developer platform, Computer packages a decade of infrastructure choices into a single product bet. If the abstraction holds, developers can give agents something that behaves like a personal computer without reserving a personal machine for every idle agent.