Cloudflare Launches Open-Source OS to Secure AI Agents’ Access to Internal Data

Cloudflare has open-sourced Cloudflare OS, a platform designed to provide enterprise AI agents with controlled access to internal systems, company context, and workflows without exposing long-lived credentials or bypassing access controls.

This release addresses a significant security challenge for enterprises: while agents need access to business data and tools to be effective, conventional API keys often grant overly broad and persistent permissions that are challenging to restrict, audit, or revoke.

Cloudflare OS integrates an agent workspace, security and governance controls, and a platform for building collaborative applications.

The company previously deployed an internal version for its workforce, enabling employees to use agents to generate documents, automate repetitive processes, analyze data, and create lightweight applications.

Cloudflare Launches Open-Source OS

At the heart of the security model is a default-deny approach. Every agent and generated application starts with no access to organizational resources. Access is granted only to specific resources and is governed by policy, exposed as typed capability bindings rather than raw credentials.

For example, generated code can be granted permission to list open issues for a defined engineering team without receiving a GitHub token or broad account-level access. Credentials are kept isolated from the agent runtime and its generated code.

Cloudflare OS server-side code runs in Dynamic Workers, with outbound Internet access disabled by default. Browser-side client code operates in a sandboxed frame. Both environments can only interact with external systems through explicitly provided capabilities.

Cloudflare has introduced “Gatekeepers,” which are service-specific Cloudflare Workers that act as intermediaries between the OS and external services. G

atekeepers are designed to understand a service’s APIs, resources, and available operations, allowing organizations to apply granular controls beyond merely allowing or blocking tool calls.

For instance, a Gatekeeper could permit an agent to read issues from one GitHub repository while blocking access to source code, masking sensitive fields, applying rate limits, or requiring human approval before a pull request is merged.

The Gatekeeper manages OAuth credentials, enforces policy, logs accessed resources, and mediates actions that could have an external impact. This model aims to minimize the risks associated with providing agent systems with unrestricted API keys.

Cloudflare OS also tracks resources accessed by an agent and links those observations to the agent’s work, generated applications, and outputs. This feature helps prevent indirect exposure of restricted data through dashboards, shared workspaces, exports, or agent-generated applications.

For example, if an agent reads a sensitive data warehouse table and creates a live dashboard, users attempting to access that dashboard can be checked against permissions for the underlying resource. This observation record can also restrict outbound requests, collaboration invitations, handoffs to other agents, or writes to lower-trust destinations.

Cloudflare OS supports existing Model Context Protocol servers through MCP Server Portals while routing model inference through the Cloudflare AI Gateway for model selection, budget controls, attribution, and rate limiting.

The project includes the Cloudflare OS core repository and a starter deployment repository. Organizations can customize interfaces, create internal Gatekeepers, connect enterprise systems, and deploy the platform using their own Cloudflare Access policies and AI Gateway configuration.

Cloudflare has indicated plans to add a fully managed dashboard offering, container support for development workflows, and integrations with Slack and other chat platforms.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world