{"slug": "cloudflare-os-v2-open-source-ai-agent-workspace", "title": "Cloudflare OS v2: Open-Source AI Agent Workspace", "summary": "Cloudflare open-sourced Cloudflare OS v2, an AI agent workspace that runs on Cloudflare Workers, on August 5 during its Agents Week event. The platform, available under Apache-2.0, lets AI agents build sandboxed applications called Gadgets, each with its own Worker, Durable Object, and SQLite database, and enforces zero-permission defaults via Gatekeepers. Cloudflare deployed v1 internally in May 2026, and by August thousands of employees were using it daily.", "body_md": "Ten years ago, Kenton Varda built Sandstorm.io — an app platform where every document was its own isolated application, controlled by a zero-trust security model. It failed. Not because the idea was wrong, but because the infrastructure to run it didn’t exist yet. Varda spent the next decade building that infrastructure at Cloudflare. On August 5, Cloudflare open-sourced the result: **Cloudflare OS v2**.\n\n## What Actually Shipped\n\nCloudflare OS is an AI agent workspace released during the company’s two-week “Agents Week” event. It’s open source under Apache-2.0, available at [github.com/cloudflare/cloudflare-os](https://github.com/cloudflare/cloudflare-os), and runs on Cloudflare Workers. The distinction worth making: this is not a chatbot with connectors. Every competitor is building that. Cloudflare OS is an environment where AI agents build applications.\n\nCloudflare deployed v1 internally in May 2026. By August, thousands of employees — engineers and non-engineers alike — were using it daily to write docs, create slide decks, and build small internal tools. The v2 open-source release is a complete rewrite and is explicitly labeled “early access.”\n\n## Apps, Not Files\n\nThe fundamental unit of Cloudflare OS is the **Gadget**. When you ask the agent to build a dashboard, it doesn’t open a document. It generates a sandboxed application — its own Cloudflare Worker, its own Durable Object, its own SQLite database. The Gadget persists, stays live, and can be modified later by the same agent.\n\nThis is the inversion that matters: you’re not creating a file that an AI reads. You’re asking an AI to build you a running application. Each one is isolated from every other. A bug in one Gadget cannot touch another.\n\nOne app per document. Capabilities instead of credentials. Nothing reachable that you didn’t hand it. Kenton got that model right with Sandstorm years before the infrastructure existed to run it.\n\nDane Knecht, Cloudflare\n\n## Gatekeepers: Agents Start With Nothing\n\nEvery agent in Cloudflare OS begins with zero permissions. To connect to Slack, GitHub, or any external service, the agent needs a capability explicitly granted through a **Gatekeeper**.\n\nGatekeepers are Cloudflare’s answer to MCP — and deliberately go further. Rather than exposing a flat list of tools, a Gatekeeper exposes a Cap’n Web RPC API with built-in audit logging and human-in-the-loop approval hooks for any action with a side effect. MCP is supported as one type of Gatekeeper, but Gatekeepers enforce a stronger contract: policy follows data. When you share a Gadget, the Gatekeeper re-validates the recipient’s access to the underlying data sources before rendering anything.\n\nIn practice, an agent cannot silently read your Slack history, send email on your behalf, or query a database it wasn’t explicitly given access to. The architecture is designed for a world where agents write code that runs in production — and where a bad permission grant stays contained.\n\n## The Stack\n\n**Workers**— user workspace runtime** Durable Objects**— per-user state and per-Gadget persistence** Dynamic Workers**— the agent-generated Gadget applications** SQLite**— per-Gadget database via Durable Object Facets** AI Gateway**— model inference from 14+ providers** Cap’n Web**— RPC protocol between client and Worker-side app code\n\nThe [cloudflare-os-starter repo](https://github.com/cloudflare/cloudflare-os-starter) handles deployment configuration. Fill in `deployment.jsonc`\n\nwith your account ID and Worker names, run `pnpm check`\n\n, then `pnpm deploy`\n\n. Local evaluation uses `pnpm run-local`\n\n. Production self-hosting on the open `workerd`\n\nruntime is possible but documentation is still forthcoming.\n\n## The Business Model You Should Understand\n\nThe code is free. The infrastructure is not. Cloudflare OS runs on Workers, Durable Objects, Dynamic Workers, and AI Gateway — all billed Cloudflare services. Workers Paid starts at $5/month; actual costs scale with usage and model token consumption through AI Gateway. Cloudflare open-sources the workspace and earns on the compute. If you’re deploying this for a large organization with significant inference traffic, run cost estimates before committing.\n\n## Part of a Larger Bet\n\nCloudflare OS was one of more than 20 launches during [Agents Week](https://blog.cloudflare.com/agents-week-in-review/). Others included agent wallets with spend limits and human-in-the-loop financial controls, Agent Memory as a managed service, Browser Run with full CDP access for agents, and DeepSeek V4 Flash on Workers AI with a 1M-token context window.\n\nCloudflare is building the full agent infrastructure stack: compute, connectivity, security, economics, workspace. Whether Cloudflare OS becomes the default internal tooling platform for developer teams depends on how fast the rough edges get resolved. But the architectural decisions are [genuinely different](https://lord.technology/2026/08/05/cloudflare-os-is-an-architecture-of-distrust.html) from everything else in this space — and 6,000 GitHub stars in two days suggests developers noticed.", "url": "https://wpnews.pro/news/cloudflare-os-v2-open-source-ai-agent-workspace", "canonical_source": "https://byteiota.com/cloudflare-os-v2-open-source-ai-agent-workspace/", "published_at": "2026-08-20 08:12:22+00:00", "updated_at": "2026-08-20 08:43:21.416439+00:00", "lang": "en", "topics": ["ai-agents", "ai-products", "ai-infrastructure", "ai-tools", "ai-policy"], "entities": ["Cloudflare", "Kenton Varda", "Sandstorm.io", "Cloudflare OS", "Cloudflare Workers", "Durable Objects", "AI Gateway", "Cap'n Web"], "alternates": {"html": "https://wpnews.pro/news/cloudflare-os-v2-open-source-ai-agent-workspace", "markdown": "https://wpnews.pro/news/cloudflare-os-v2-open-source-ai-agent-workspace.md", "text": "https://wpnews.pro/news/cloudflare-os-v2-open-source-ai-agent-workspace.txt", "jsonld": "https://wpnews.pro/news/cloudflare-os-v2-open-source-ai-agent-workspace.jsonld"}}