{"slug": "cloudflare-gives-away-the-ai-workspace-to-sell-the-cloud", "title": "Cloudflare Gives Away the AI Workspace to Sell the Cloud", "summary": "Cloudflare Inc. released Cloudflare OS, an open-source agent workspace under the Apache 2.0 license on August 5, which the company's employees have used since May, allowing organizations to deploy a browser-based environment for AI agents and app generation within their own Cloudflare account. The product features a security architecture that defaults to denying network access and isolates credentials via Gatekeepers, and it uses Durable Objects to give each user a private app instance, positioning the workspace as a strategy to drive adoption of Cloudflare's underlying cloud infrastructure.", "body_md": "[Cloud & Infra](https://sourcefeed.dev/c/cloud)Article\n\n# Cloudflare Gives Away the AI Workspace to Sell the Cloud\n\nThe Apache 2.0 release is real; so is the gravitational pull of the Workers primitives underneath.\n\n[Lenn Voss](https://sourcefeed.dev/u/lennart_voss)\n\nCloudflare just did something none of its competitors in the enterprise-AI race will: it open-sourced the whole product. [Cloudflare OS](https://blog.cloudflare.com/cloudflare-os/), announced August 5 under Apache 2.0, is the agent workspace the company's own employees have been using since May — a browser-based environment where anyone in an organization can chat with agents, generate documents against live data, and spin up full-stack internal apps. You deploy it into your own Cloudflare account, wire it to your own identity provider, and point it at whatever model vendor you like.\n\nThe instinct is to file this under \"another AI workspace,\" next to Microsoft Copilot, Google's Gemini Enterprise, Glean, and OpenAI's AgentKit-flavored offerings. That would miss the two parts that actually matter: a security architecture that takes prompt injection seriously at the platform level, and a business model designed to make the per-seat AI workspace obsolete.\n\n## The security model is the real news\n\nMost MCP-connected agent deployments today have what Simon Willison dubbed the lethal trifecta: access to private data, exposure to untrusted content, and a way to exfiltrate. The standard integration pattern — paste an API key into a config, hand the agent a pile of [MCP](https://modelcontextprotocol.io) tools, hope the system prompt holds — has all three. Every security team knows this; almost nobody has shipped an architectural answer.\n\nCloudflare OS is the most serious attempt I've seen productized. Agent-generated server code runs in a Dynamic Worker with outbound networking disabled by default; client code runs in a sandboxed browser frame. In Cloudflare's words, neither can reach the internet \"except through capabilities you explicitly provide.\" External services sit behind \"Gatekeepers\" — service-specific Workers that hold the credentials and expose typed, capability-based bindings, so the agent and its generated code never see a raw API key. The platform tracks which resources an agent has observed, and when someone shares an agent or app, access is enforced against the *recipient's* permissions, not the creator's. Entry to the whole thing runs through Cloudflare Access, and every inference call routes through [AI Gateway](https://developers.cloudflare.com/ai-gateway/), which is where model allow-lists, logging, and DLP rules live.\n\nNone of these ideas is novel in isolation — object-capability security is decades old, and Cloudflare has been rehearsing the pieces in public for a year: Cap'n Web for capability-based RPC, Code Mode for having agents write sandboxed code against typed APIs instead of raw tool calls. What's new is a full product where default-deny egress and credential isolation aren't hardening you bolt on afterward. They're the floor. If you're currently assembling an internal agent portal from Open WebUI, a fleet of MCP servers, and a secrets manager full of over-scoped tokens, this is the design you'd want to steal even if you never deploy the product.\n\n## One app instance per user\n\nThe second interesting bet is what the repo calls \"gadgets\": when an agent builds you an app, you don't get a row in someone's multi-tenant SaaS database — you get your own private instance, with its own server code and its own SQLite database, courtesy of [Durable Objects](https://developers.cloudflare.com/durable-objects/) and the new Facets feature. Shareable \"Blueprints\" let a colleague stamp out their own copy rather than logging into yours.\n\nThis inversion has been theoretically attractive forever — Clay Shirky was calling it \"situated software\" in 2004 — but economically absurd when every app instance meant a container and a database server. Millions of scale-to-zero stateful isolates make it merely a billing question. Whether disposable per-user software is a feature or a governance nightmare is genuinely unsettled; 4,000 apps created in a month (Cloudflare's internal figure) is either a productivity explosion or 4,000 things nobody will maintain. Probably both.\n\n## Open code, gravitational cloud\n\nNow the strategy. Microsoft, Google, and Glean sell AI workspaces per seat, per month. Cloudflare is giving the workspace away and charging for what it consumes: Workers invocations, Durable Objects storage, AI Gateway traffic, inference. This is commoditize-your-complement executed cleanly — if the workspace layer becomes free open-source software, the value collapses into infrastructure, which is the layer Cloudflare happens to sell. It's also the company's oldest habit: Access itself grew out of Cloudflare's internal zero-trust tooling before becoming a product.\n\nBut be clear-eyed about what \"open\" buys you. The code is Apache 2.0 and runs on the open-source workerd runtime locally (`pnpm run-local`\n\ngets you a full instance on localhost), but the architecture is Workers-native to its bones — Dynamic Workers, Facets, AI Gateway. There's no credible path to running this on AWS Lambda or bare Kubernetes. The license is open; the gravity is not. And the [repo](https://github.com/cloudflare/cloudflare-os) is explicit that external contributions are mostly not being accepted, so this is open code, not open governance. You can read it, fork it, and self-deploy it — you can't steer it.\n\nThe model layer, at least, is genuinely unbundled: \"Cloudflare OS can be used with any model,\" with AI Gateway as the switchboard. That's a sharper openness story than Copilot or Gemini Enterprise can tell, where the workspace exists substantially to sell you the vendor's own models.\n\n## Should you run it?\n\nIf you're a platform team at a company already on Cloudflare — using Access for SSO, comfortable in TypeScript and Workers — this is worth a real pilot now. The starter repo deploys into your account, Gatekeepers already exist for GitHub, Google, Slack, Notion, Confluence, and Supabase, and writing one for an internal system is just writing a Worker, which beats maintaining bespoke MCP auth glue. What it replaces is either a five-figure-per-month Glean/Copilot seat bill or the DIY portal your infra team was going to half-build this quarter.\n\nIf you're not on Cloudflare, the calculus is harsher: you're adopting a runtime, an identity layer, and a billing relationship to get a workspace — and it's early access, with the managed dashboard version still on the roadmap. Treat the internal metrics (10,000 sales hours saved monthly, 16,000 merges blocked by review agents) as vendor-reported, because they are.\n\nMy read: the AI workspace category was always going to consolidate into something infrastructure vendors give away, the way web servers and Kubernetes did. Cloudflare just moved first, and open-sourced a security architecture the rest of the industry should be embarrassed it hasn't shipped. The workspace is the loss leader. The capability model is the contribution.\n\n## Sources & further reading\n\n-\n[Cloudflare OS: an open platform for agents, apps, and work](https://blog.cloudflare.com/cloudflare-os/)— blog.cloudflare.com -\n[How we're rethinking work at Cloudflare with Cloudflare OS](https://blog.cloudflare.com/how-we-use-ai-with-cloudflare-os/)— blog.cloudflare.com -\n[cloudflare/cloudflare-os](https://github.com/cloudflare/cloudflare-os)— github.com -\n[Cloudflare Announces Open-Source Cloudflare OS As AI Operating System](https://www.phoronix.com/news/Cloudflare-OS)— phoronix.com\n\n[Lenn Voss](https://sourcefeed.dev/u/lennart_voss)· Cloud & Infrastructure Writer\n\nLenn writes about cloud platforms, Kubernetes internals, and the infrastructure decisions that quietly make or break engineering organizations. Based in Berlin's vibrant tech scene, they have a talent for turning dense platform-engineering topics into prose that people actually finish reading.\n\n## Discussion 0\n\nNo comments yet\n\nBe the first to weigh in.", "url": "https://wpnews.pro/news/cloudflare-gives-away-the-ai-workspace-to-sell-the-cloud", "canonical_source": "https://sourcefeed.dev/a/cloudflare-gives-away-the-ai-workspace-to-sell-the-cloud", "published_at": "2026-08-05 15:09:48+00:00", "updated_at": "2026-08-05 15:42:34.189987+00:00", "lang": "en", "topics": ["ai-agents", "ai-products", "ai-infrastructure", "ai-safety"], "entities": ["Cloudflare", "Cloudflare OS", "Microsoft Copilot", "Google Gemini Enterprise", "Glean", "OpenAI AgentKit", "Simon Willison", "Durable Objects"], "alternates": {"html": "https://wpnews.pro/news/cloudflare-gives-away-the-ai-workspace-to-sell-the-cloud", "markdown": "https://wpnews.pro/news/cloudflare-gives-away-the-ai-workspace-to-sell-the-cloud.md", "text": "https://wpnews.pro/news/cloudflare-gives-away-the-ai-workspace-to-sell-the-cloud.txt", "jsonld": "https://wpnews.pro/news/cloudflare-gives-away-the-ai-workspace-to-sell-the-cloud.jsonld"}}