From Chatbots to Secure Enterprise AI Agents
Cloudflare OS is a self-hostable, browser-based AI productivity platform designed to run enterprise AI agents, internal applications, and automated workflows inside isolated sandboxes so organizations can safely use their data for everyday business work without exposing it to the open internet or generic consumer chat tools.
Cloudflare has released Cloudflare OS as open source after using it internally with thousands of employees across departments. This matters because it shifts AI in the workplace from one-off chat sessions to repeatable, governed systems of secure AI automation. These are not consumer chatbots bolted onto a browser; they are purpose-built enterprise AI agents running on a sandboxed AI platform. Cloudflare OS is designed to give organizations a shared workspace where agents, internal apps, company knowledge, and business workflow automation live together, instead of scattering AI experiments across disconnected tools.
An Open-Source OS for Business Workflow Automation
Cloudflare OS was first created for the company’s own staff and is now open-sourced in its second version, after months of internal deployment to thousands of workers. Those employees use it daily to produce documents and presentations, automate repetitive tasks, and build small applications around company data. That track record is important: this is enterprise AI agents proven in day-to-day work, not a lab demo.
The platform gives organizations a shared browser-based workspace for AI agents, internal apps, knowledge, and automated workflows, running as agent workspaces across Cloudflare Workers. Because Cloudflare OS is open source and self-hostable, enterprises can build custom internal applications rather than wait for a vendor to ship the “right” feature. In practice, that means AI agents that are tuned to your CRM, your policies, your approval flows. This is business workflow automation under your control, not another opaque SaaS black box.
Sandboxed by Design: Why Security-First AI Matters
The real opinionated move in Cloudflare OS is security by default. Server code runs as Dynamic Workers with dedicated Durable Object SQLite databases, so every app and agent operates in its own isolated runtime rather than sharing a giant pool of memory. Outbound networking is disabled so sensitive data cannot be exfiltrated, even if an AI agent behaves badly or a prompt goes wrong.
Cloudflare adds a second line of defense with Gatekeepers: service-specific Workers that sit between Cloudflare OS and external systems, holding OAuth credentials, hiding fields, enforcing rate limits, logging data access, and mediating any change visible outside the organization. In other words, they do what Model Context Protocol does not: track what agents do with the data they read and stop them from sharing internal information with unauthorized users or external entities. This is the difference between experimental AI and a sandboxed AI platform you can trust with production data.
From AI Tools to Tailored Internal Apps
Cloudflare OS treats AI agents less like chat partners and more like builders of custom business apps. Rather than locking users into a fixed set of productivity tools, the platform allows agents to create applications tailored to an individual, project, or team, combining client-side and server-side code. On the backend, each app runs as a Dynamic Worker instantiated as a Durable Object Facet, with its own SQLite database separated from the runtime.
Dynamic Workers use lightweight V8 isolates, giving each app an isolated runtime without a dedicated server or container. Sharing is also opinionated: teams can either share the live app (with shared state) or share a blueprint that others copy into independent instances. That makes enterprise AI agents into reusable internal products, not throwaway prompts. Because inference calls go through Cloudflare’s AI Gateway and admins choose which models are allowed, organizations can align specific workloads with specific models instead of sending everything to the same LLM.
Why This Redefines Enterprise AI—and What Comes Next
Cloudflare OS is designed for everyday business work: documents, presentations, repetitive task automation, and data-heavy internal apps, all run by enterprise AI agents inside a controlled environment. It is a deliberate move away from consumer chat interfaces toward secure AI automation that respects internal boundaries. The platform is tightly coupled to Cloudflare’s infrastructure, relying on Workers, KV, R2, Browser Rendering, Dynamic Worker Loaders, and AI Gateway billing for LLM tokens. That lock-in is a trade-off, but one many enterprises will accept to gain a cohesive, sandboxed AI platform.
Right now, the source code and deployment templates are available on GitHub, along with a starter deployment for organizations to run Cloudflare OS in their own environments. Cloudflare plans future releases with a fully managed dashboard, Slack integration, and support options. The larger story is clear: enterprise AI is moving from ungoverned chatbots to opinionated, security-first operating environments. Organizations that want AI agents in production—and not in the penalty box of “shadow AI”—will need this kind of sandboxed discipline.
