Notes ·
Cloudflare Built an Operating System for AI Work
Cloudflare OS is Cloudflare’s internal AI agent workspace, built on the company’s own developer platform and made available across its workforce.
Despite the name, it is not a conventional operating system. It is a browser-based environment where employees can create persistent AI workspaces containing conversations, files, tasks, permissions, tools and completed work.
That distinction is important.
Most AI products still behave like chat applications. You ask a question, receive an answer and eventually lose the useful work inside a long conversation. Cloudflare’s model treats documents, presentations, spreadsheets, research, workflows, source code and applications as durable outputs that can be reviewed, shared, exported or continued later.
Each workspace is backed by its own Durable Object, which maintains the agent’s conversation history, event queue, schedules and consent decisions. Work can continue after the browser closes or the underlying Worker restarts. Different workspaces remain independently stateful rather than sharing one giant agent process.
The architecture combines a large portion of Cloudflare’s platform:
- Workers provide the interface, APIs and routing.
- Durable Objects preserve workspace state.
- AI Gateway governs model access, usage and cost.
- MCP portals provide controlled access to company tools.
- Dynamic Workers run bounded generated code.
- Sandbox containers provide complete development environments.
- Browser Run gives agents isolated web access.
- R2 stores shared context, backups and larger files.
Cloudflare keeps model credentials and enterprise-tool credentials outside the agent’s context. Generated code, model responses and tool output are treated as untrusted and executed behind platform controls rather than being trusted merely because an AI produced them.
That security model may be the most notable part of the project. Companies are rushing to connect general-purpose models to email, documents, source code and internal systems, often through a collection of unrelated products. Cloudflare is attempting to provide one controlled environment where identity, permissions, model access, execution and auditing are part of the architecture from the beginning.
Cloudflare says AI and agents have already become core parts of its workforce and have fundamentally changed how the company operates. Cloudflare OS appears to be the internal system holding those capabilities together.
The public reference architecture is not a complete open source release of Cloudflare’s internal system, but it provides enough detail for other organizations to understand and reproduce the approach using Cloudflare services.
I find this much more interesting than another company placing a chatbot beside its existing software.
Cloudflare is asking what an organization would look like if AI agents were treated as an operating layer for work: persistent, asynchronous, connected to real tools and governed like the rest of the company’s infrastructure.
That may be a better description of where workplace AI is headed than the current collection of chat boxes and browser extensions.
Read Cloudflare’s enterprise AI agent workspace architecture.