Cloudflare says the isolation is tight enough to let non-developers rewrite the code of their own copy; the agents doing it start with no standing permissions and reach company data only through named grants.
Cloudflare has open-sourced Cloudflare OS, the platform it built for its own staff to make the work software they needed. The code is on GitHub, in the company's cloudflare-os repository, under the Apache-2.0 license.
A request for a document or a dashboard starts its own sandboxed instance — Cloudflare calls it a Gadget — inside a tightly scoped V8 isolate managed by workerd, the runtime the company already publishes as open source. Because nobody else is running that copy, a user can point generative AI at its source code and have the software rewritten while they are using it — which the shared model rules out.
Access to company data runs through a capability model Cloudflare named Gatekeepers: agents hold no ambient permissions and are handed named resources one at a time, with a person's sign-off required before anything destructive runs. Model Context Protocol connections, as they are commonly implemented, do close to the reverse.
The platform came out of a problem the company already had. Chief information officer Sam Rhea has described employees standing up unvetted AI workflows as bespoke “SuperApps”, wired to production API tokens across dozens of internal systems of record. Staff have been working in Cloudflare OS since May 2026, and Rhea said employees without technical backgrounds assembled over 4,000 tools in 30 days.
Lead architect Kenton Varda argues the per-instance sandbox settles access control by governing who may reach a Gadget at all, so a flaw inside one could not hand out access its users did not already hold. An editor's note on the release commentary marks the limit of that: other risk vectors still apply, misconfigured Gatekeeper grants among them.