Cloudflare has released its internal AI-powered app-building workspace, called Cloudflare OS, as an open-source project. The platform was originally created for employees to build applications using AI agents, even if they have no software development or engineering background. The company also highlights a security framework aimed at reducing the chance that casual AI-assisted coding sessions introduce serious vulnerabilities or lead to data leaks.

After several months of internal development and testing, Cloudflare OS lets users describe workflows in plain language, which an AI agent then turns into working applications. In an August 5 blog post announcing the GitHub release, the company says thousands of its employees use the platform daily to create documents and slides, automate repetitive tasks, and build small data-visualization apps.

Kenton Varda, a principal engineer at Cloudflare, wrote on X that the platform is a full-on personal app vibe-coding environment where the sandbox is so secure that users can go wild, and the AI cannot introduce a significant security bug. He added that security teams should feel comfortable letting non-technical users build apps this way without losing sleep.

The security model works by running each app instance in its own isolated sandbox. For example, a document editor would launch each document as a separate instance, with permissions managed individually, and each user runs their own copy of the code they can modify. This uses Cloudflare's pre-existing Dynamic Workers feature, but instead of standard containers, it creates lightweight V8 JavaScript engine isolates that start in milliseconds and use only a few megabytes of memory—making them 100 times faster and 10 to 100 times more memory-efficient than typical containers.

Source: Ars Technica