// ARS TECHNICA — INTELLIGENZA ARTIFICIALE
Cloudflare open-sources vibe-coding platform for people who aren't coders
Cloudflare built an AI agent workspace for its employees. Now it’s open source.
Cloudflare has open-sourced its Cloudflare OS platform, which it first developed as an internal workspace for employees to build apps using AI agents—including people who are not software developers or engineers. The company also touts a security framework designed to reduce the risk of employee vibe-coding sessions creating serious security flaws or leading to data breaches.
The tech company spent several months building and internally testing Cloudflare OS, which allows employees to describe workflows in natural language so that an AI agent can code them into applications. In an August 5 blog post announcing the open source version’s availability on GitHub, the company claims thousands of Cloudflare employees use the platform on a daily basis to “create documents and slides, automate repeatable tasks, and build small apps to visualize data and help them do their work.”
“This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild—the AI cannot introduce a significant security bug,” said Kenton Varda, principal engineer at Cloudflare, in a post on the social media platform X. “We believe a company’s security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.”
The security model relies on creating fine-grained app instances so that a document editor app would run each document as a separate instance in a separate sandbox, Varda explained. The Cloudflare OS platform manages who has permission to access each instance, and each individual runs their own copy of the code that they can freely modify.
This sandboxing mechanism, based on a preexisting Cloudflare feature called Dynamic Workers, does not use typical software containers. Instead, it creates “isolates”—instances of the V8 JavaScript execution engine—that take just a few milliseconds to start up and use only a few megabytes of memory. That makes isolates 100 times faster and 10–100 times more memory-efficient than a standard container.
To minimize the exposure of company data, AI agents start out with no permissions to access or share resources and must request them through the Cloudflare OS platform. Server code runs with “global outbound networking disabled” while client code “runs in a sandboxed frame in the browser,” meaning “neither can reach the Internet except through capabilities you explicitly provide,” according to the main company blog post.
That sandboxing and permission process baked into the Cloudflare OS framework could prove helpful in practice, even if no system is foolproof. Researchers at Pillar Security just published a report on sandbox escapes and boundary bypasses in popular AI coding agents such as Cursor, Codex, Gemini CLI, and Antigravity.
Cloudflare OS can work with just about any AI model and allows organizations to select the most suitable model for the job at hand. “Not every user needs access to the max thinking mode of the latest frontier lab model,” said Sam Rhea, chief information officer at Cloudflare, in a separate blog post. “And we do not need team members spending $20 to summarize their email inbox every hour.”
The company has also improved the platform so that running skill files for specific workflows relies more on deterministic steps with AI inference used only when needed rather than requiring a “token-hungry inference session” each time, Rhea said.