Cloudflare open-sources vibe-coding platform for people

What happened

Cloudflare has open-sourced its Cloudflare OS platform, which it first developed as an internal workspace for employees to build apps using AI agents—including people who are not software developers or engineers. The company also touts a security framework designed to reduce the risk of employee vibe-coding sessions creating serious security flaws or leading to data breaches.

The tech company spent several months building and internally testing Cloudflare OS, which allows employees to describe workflows in natural language so that an AI agent can code them into applications.

” “This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild—the AI cannot introduce a significant security bug,” said Kenton Varda, principal engineer at Cloudflare, in a post on the social media platform X.

” The security model relies on creating fine-grained app instances so that a document editor app would run each document as a separate instance in a separate sandbox, Varda explained. The Cloudflare OS platform manages who has permission to access each instance, and each individual runs their own copy of the code that they can freely modify.

This sandboxing mechanism, based on a preexisting Cloudflare feature called Dynamic Workers, does not use typical software containers. Instead, it creates “isolates”—instances of the V8 JavaScript execution engine—that take just a few milliseconds to start up and use only a few megabytes of memory. That makes isolates 100 times faster and 10–100 times more memory-efficient than a standard container.

To minimize the exposure of company data, AI agents start out with no permissions to access or share resources and must request them through the Cloudflare OS platform. Server code runs with “global outbound networking disabled” while client code “runs in a sandboxed frame in the browser,” meaning “neither can reach the Internet except through capabilities you explicitly provide,” according to the main company blog post.

Cloudflare OS can work with just about any AI model and allows organizations to select the most suitable model for the job at hand. “Not every user needs access to the max thinking mode of the latest frontier lab model,” said Sam Rhea, chief information officer at Cloudflare, in a separate blog post.

” The company has also improved the platform so that running skill files for specific workflows relies more on deterministic steps with AI inference used only when needed rather than requiring a “token-hungry inference session” each time, Rhea said.

The platform also enables administrators to monitor employees’ AI inference spending and set budgets and rate limits—a crucial feature at a time when companies and individuals have found it can be all too easy to burn through their budgets for AI model use. But that won’t stop more questionable practices if corporate leaders decide to incentivize AI “tokenmaxxing” to pressure employees to use AI tools.

Cloudflare shared some hard lessons learned along the way as it tried to ensure the efficient use of AI tools through Cloudflare OS.

One early mistake involved simply giving everyone outside the engineering team “the same tools with slightly friendlier user interfaces” because the AI coding harnesses that engineers typically use are less suitable for knowledge work involving “one-off outputs and work on projects that involve dozens of systems of record,” Rhea explained.

“If you give everyone a harness workspace that is great at writing code, you’ll wind up with way more code than you need,” Rhea wrote in his blog post. ” The growing use of AI agents within the organization also meant “anyone at Cloudflare could now write bad code, faster, thanks to AI,” Rhea said.

So the organization created the Cloudflare Engineering Codex, an “authoritative guide” to help both human engineers and AI agents review code and catch potential issues.

Why it matters

That sandboxing and permission process baked into the Cloudflare OS framework could prove helpful in practice, even if no system is foolproof. Researchers at Pillar Security just published a report on sandbox escapes and boundary bypasses in popular AI coding agents such as Cursor, Codex, Gemini CLI, and Antigravity.

What to watch

Over the past four months, the company’s AI code reviewer “flagged nearly a quarter of a million deviations from Cloudflare engineering standards and blocked 16,000 merges,” said Timo Reimann, a systems engineer at Cloudflare, in a blog post about the Engineering Codex and how the company uses AI agents to uphold engineering standards.

Now that the company is open-sourcing Cloudflare OS for others to use, developers can try to run the entire stack on their own machines. A notable caveat is that the Cloudflare OS backend can only be deployed by Cloudflare users who have subscribed to the Workers Paid plan.