Deep Dive · xiaohu's take

Cloudflare OS explained: How it tackles hallucinations, overreach, and errors

An agent wants to merge code, but before you approve, the system tells it the merge is done. The whole platform assumes AI will mess up.
Key Takeaways
  • Cloudflare open-sourced its internal AI office platform, Cloudflare OS, where every document is its own isolated app whose code you can modify on the fly.
  • The most counterintuitive feature is when an agent asks to merge code, the system replies "done" before you approve, then spins up a fake branch for it to continue working on.
  • Jamie Lord read the entire source code and concludes the system's core principle is a total lack of trust in AI.
  • After examining all five mechanisms, there's a trade-off: the leash that keeps it safe is the same one that limits how much it can do.
⚑ The main analysis comes from Jamie Lord's third-party review. All source code references in this article were checked by us against the cloudflare/cloudflare-os repository. Performance figures and statements like "AI cannot introduce major security vulnerabilities" are Cloudflare's official claims, and are flagged where they appear.
Overview

What is Cloudflare OS, and why does it assume AI will fail?

On August 5, Cloudflare open-sourced its internal AI office platform, Cloudflare OS, which has been used company-wide for three months. You can deploy it on your own servers.

What is Cloudflare OS?

Every employee gets their own agent workspace pre-loaded with company knowledge and internal skills, ready to research, write documents, build spreadsheets and slide decks, or simply take on assigned tasks.
Connects to and works with your company's systems GitHub, Google Drive, Slack, Notion, Linear, and internal databases—the repo includes 16 connectors for reading and writing.
Every document is its own mini-app Behind each slide deck or spreadsheet is its own codebase and database, which you can ask the agent to extend at any time.
Non-technical staff can build apps safely Apps are isolated from each other. If one person breaks their app, it doesn't affect anyone else, and the security team doesn't have to babysit.
Models are swappable, and costs are transparent Works with Anthropic, OpenAI, Google, and Workers AI, all tracked through a single gateway for cost monitoring.
Fully open-source, not locked to Cloudflare Released under the Apache 2.0 license, it runs on the open-source workerd runtime and can be moved entirely to your own servers.

Cloudflare employees have been using it internally for three months, creating over 4,000 of these mini-apps in the last 30 days alone. The sales team estimates it has saved them over 10,000 hours.

Related Article
Cloudflare Open-Sources Its Internal AI Office Platform: An 'AI Operating System' for Every Employee
That article covers the full feature set and steps for self-deployment.

Jamie Lord, author of Architecting on Cloudflare and a solutions architect at UK-based CDS, has done a deep, source-level analysis of Cloudflare OS. His key insight:

Core Finding

Cloudflare OS is, at its heart, a system built on a total distrust of AI. It treats AI errors—hallucinations, overreach, mistakes—as inevitable facts of life and then works the architecture to make it impossible for AI to break the system.

Traditional Thinking

Try to make AI smarter and less error-prone: write better prompts, give it more permissions.

The Cloudflare OS Approach

Acknowledge that AI can confidently spout nonsense and break things. Since 100% correctness is impossible, build the platform as a "canary cage." Let AI think it has unlimited power and work efficiently, but keep real control (the ability to commit) firmly in human hands.

In one sentence: It demonstrates how, in an era where LLMs are still unreliable, you can use capabilities, isolates, and simulations to build a next-gen agent operating system architecture that lets AI automate workflows but can never cause a corporate security disaster.

The core philosophy behind this design can be broken down into these five key mechanisms.

Premise: AI will fail 01 Simulate success Before you approve, the system tells the agent it's done 02 Sandbox isolation Each doc gets its own room; bad code breaks only its room 03 Withhold keys Keys stay with the gatekeeper; agent gets a few methods 04 Track data lineage Tracks what it read; checks permissions before sharing 05 Distrust humans too External PRs over a few lines are closed Five mechanisms, five safety features—together they form a single coherent philosophy.
Illustration created for this article. One section below covers each mechanism.
Mechanism 1

Simulate Success: The System Tells the AI It's Done Before You Approve