Cloudflare OS 2 Launches as Open-Source AI Agent Platform

Cloudflare has released version 2 of Cloudflare OS as open-source software on GitHub. This platform allows enterprises to run AI agents and user tools in isolated environments without exposing sensitive data. This release offers a practical solution for teams integrating AI into workflows while maintaining strict security boundaries. The release gives developers immediate access to the code and deployment templates needed to start building.

Cloudflare releases version 2 of its AI productivity platform with isolated V8 sandboxes

The system is an AI productivity platform rather than a traditional computer operating system. It runs enterprise AI agents and user-generated tools on isolated V8 compute sandboxes. Server code executes as Dynamic Workers, which connect to dedicated Durable Object SQLite databases. This architecture ensures that each agent operates in a contained environment separate from other processes.

Security serves as a core design principle for this release. Outbound networking is disabled by default so that no sensitive data can be exfiltrated from the sandbox. The platform uses Gatekeepers to proxy workers that hold OAuth credentials. These Gatekeepers also log data observations to provide an audit trail for all agent activities.

Cloudflare OS still relies on existing Cloudflare infrastructure including Workers, KV, R2, Browser Rendering, and Dynamic Worker Loaders. Internal deployment to Cloudflare employees began in May, providing a testing ground before the public release. The source code and deployment templates are now available on GitHub repos named cloudflare-os and cloudflare-os-starter. Future releases will include a managed dashboard, Slack integration, and support channels.

Analysis of earlier AI agent platforms provides context for this launch. Cloudflare has open-sourced Cloudflare OS, its self-hostable AI productivity platform (it is not a computer operating system) which is designed to run enterprise AI agents and user-generated tools on isolated V8 compute sandboxes. The immediate availability of the source code enables organizations to evaluate the security model prior to full deployment.