Cloudflare OS Revives Sandstorm’s Safe App Vision With AI

Cloudflare open-sourced Cloudflare OS on August 5, 2026, the same AI agent workspace thousands of its own employees already use daily for research, live documents, automated workflows, and small internal apps. The release runs on Cloudflare Workers, ships under Apache 2.0, and starts every agent with zero permissions.

Most coverage treats it as another enterprise chatbot with connectors. The longer thread is a security model first sketched a decade ago that AI agents have finally made practical.

What Employees Get in the Browser

Cloudflare OS opens as a browser conversation grounded in company-curated skills and context. No terminal required. An agent can research with internal data, produce documents or slides that stay linked to live sources, spin up a full-stack app with its own isolated database, or turn a repetitive job into a mostly deterministic workflow that runs on a schedule.

Three pieces sit underneath:

• Agent workspace with persistent state, file outputs, and an isolated runtime where the agent writes and executes code.
• Gatekeepers, service-specific Workers that hold credentials, enforce narrow policy, log every observation, and insert human approval for side effects.
• Gadgets, personal modifiable apps that any employee can build, share like a document, and later change with another prompt.

The workspace keeps state across turns so a research thread can become a document, then a scheduled workflow, without starting over. Live source links mean the slide deck or report updates when the underlying data changes, rather than freezing a snapshot that goes stale.

Outputs export to familiar formats. Collaboration is real-time. Model choice routes through Cloudflare AI Gateway so teams can mix providers, set budgets, and push routine work to cheaper models. The full technical write-up lives in the open platform for agents apps and work post by Phillip Jones and Dan Carter.

The Ten-Year Thread From Sandstorm

Kenton Varda, tech lead for Cloudflare Workers and the original creator of Sandstorm.io, framed the launch bluntly on X. His thread drew more than 778,000 views.

This is a remake of Sandstorm.io, my startup from 10 years ago, except this time built on Cloudflare Workers and deeply leveraging AI. This is more or less the culmination of my secret 10-year master plan.

Varda said the sandbox is tight enough that “the AI cannot introduce a significant security bug.” Security teams can let non-technical staff vibe-code and still sleep.

In Sandstorm a “Grain” was a fine-grained app instance. Cloudflare OS calls the same idea a Gadget. Each document, dashboard, or custom tool runs as its own isolated copy with its own Durable Object facet and SQLite store. The platform controls who can reach that instance. Because every user runs a private copy, anyone can ask the agent to add a feature without waiting for a central product team or risking a multi-tenant breach.

The path from that earlier design to the open release is short when laid out as milestones:

1. About a decade before launch: Sandstorm.io ships the Grain model of fine-grained, isolated app instances.
2. May 2026: Cloudflare gives company-wide access to Cloudflare OS version 1.
3. Four months of internal hardening: review agents and standards work shape what will become the public kernel.
4. August 5, 2026: version 2, the rewrite that merges company-context work with the Gadgets kernel, ships as open source.

Sandstorm arrived too early. Most people lacked the skill or patience to modify software. AI removed that barrier. The same agent that helps you use a Gadget can also rewrite its code. SaaS lock-in for internal tools starts to look optional.

How Gatekeepers Change the Permission Game

Handing API keys to agents does not scale. Plain MCP servers improve the situation by exposing tools instead of raw credentials, yet they still leave gaps around what data the agent has already seen and where that data can travel next.

Gatekeepers sit between the workspace and each external system. They understand the target API, hold the OAuth token, present a clean Cap’n Web RPC surface, mask fields, apply rate limits, and require approval before anything with an external side effect leaves the sandbox. Critically, they can simulate outcomes so the agent keeps working while a human later batch-approves or rejects the queued actions.

Simulation matters for pace. The agent can draft the outbound action, see a realistic result, and continue the workflow while the human reviews a batch later. That avoids freezing every step on a synchronous approval without giving the agent a live credential.

Server code runs in a Dynamic Worker with outbound networking disabled except through granted capabilities. Client code runs in a sandboxed browser frame. Policy follows the data: if an agent read a sensitive warehouse table to build a dashboard, sharing that dashboard re-checks the viewer’s rights to the original resources. The model matches the capability security Cloudflare already ships in Access and related Zero Trust products, including recent Cloudflare browser PACT security work.

What Cloudflare Learned Running It First

Internal rollout began in May 2026. CIO Sam Rhea’s post details the path. Early AI experiments flooded the company with vibe-coded prototypes looking for problems. Engineering got a Codex of standards and review agents. In four months those agents flagged nearly a quarter-million potential issues and blocked 16,000 merges while catching architectural problems in roughly 600 designs before code was written.

For everyone else, Rhea’s team ran a “magic email” alias that staffed people with AI tools behind the scenes. The goal was to capture real jobs people hated doing, not the demos they thought sounded cool. Patterns became skills and context files. Those materials seeded the first Cloudflare OS.

• Thousands of employees across every function use the workspace daily.
• ~250,000 potential problems flagged by engineering review agents in four months.
• 16,000 merges blocked for standards violations.
• May 2026 company-wide access to version 1; version 2 (the open-source release) is the rewrite now rolling out.

Principles stayed simple and now read as operating rules rather than slogans:

• AI should free time for customers.
• Every employee deserves the tools.
• Humans own the output.
• Company context beats model size.
• No one gets more permission through an agent than they already hold.

The full Cloudflare CIO internal rollout story is worth reading for any team wrestling with shadow AI.

Apps Anyone Can Build and Still Control

Most office suites lock users into fixed file types. In Cloudflare OS every “file” can become its own application. The agent writes client UI code and server code. The server loads as a Dynamic Worker Durable Object facet with its own SQLite. Cap’n Web RPC lets the browser call server methods like ordinary functions. Apps start private and share like documents.

Because isolation is the default, a non-engineer can prompt a custom issue dashboard or approval tracker, hand it to a colleague, and later ask the agent to add a field or change the logic. The colleague authenticates with their own permissions through the same Gatekeepers. That inverts the usual SaaS pattern where only the vendor ships features and multi-tenant bugs are catastrophic.

Secondary reports claim thousands of internal apps appeared in a single month once the tools matured. Exact public tallies remain sparse, yet the direction matches the engineering review numbers and the daily-use claim.

Open Source Today, Managed Path Coming

The code sits in the Apache 2.0 repository on GitHub. Anyone can clone it, run a local demo with pnpm and workerd, or deploy into their own Cloudflare account. Self-hosting on the open-source Workers runtime is supported. Companies own the skills, context, and connectors they add. There is no vendor lock on the processes themselves.

A managed dashboard option is listed as coming soon. Implementation partners including Presidio and Happy Cog are already lined up for complex environments. Interested teams can use the deploy path and partner interest form. CEO Matthew Prince said the company built it because nothing else did what Cloudflare needed; now others can start from that point.

Varda is frank about maturity. Version 2 is a full rewrite that merged the company-context work (Cloudflare OS v1) with the Gadgets kernel. Internally he compared the state to Windows NT 4: capable, still rough, heading toward something more polished. Early-access warnings appear in the README for a reason.

What Zero Permissions Means in Practice

Every agent session begins with nothing. Capabilities arrive only as typed bindings through Gatekeepers, not as ambient keys sitting in the prompt or environment. That default flips the usual agent setup, where a broad token is granted first and limited later if anyone remembers.

Observation tracking closes the other common hole. When an agent reads a resource, that fact stays attached to the agent and to whatever documents, Gadgets, or workflows it produces. Sharing an output is not a free pass; the platform re-checks the viewer against the original resources. A dashboard built from a sensitive warehouse table cannot quietly widen the audience beyond who may see that table.

Side effects follow the same pattern. Outbound actions can run as simulations inside the sandbox so the agent keeps moving. Humans batch-approve or reject later. Server code still cannot open arbitrary network connections; only granted capabilities leave the Dynamic Worker. Client code stays in a sandboxed browser frame. The result is vibe-coding that security teams can tolerate because the blast radius is designed in, not hoped for in audit logs.

How Private Instances Change Internal Tooling

The Grain-to-Gadget line is more than naming. Each document, dashboard, or custom tool is its own isolated copy with its own Durable Object facet and SQLite store. There is no shared multi-tenant app process that every employee hits with slightly different row-level filters.

That design has direct consequences for who ships features:

• A non-engineer can prompt a change to their own instance without a central product backlog.
• A colleague who receives a shared Gadget still authenticates through Gatekeepers with their own rights.
• A bug or over-broad query stays inside one instance instead of becoming a tenant-wide incident.
• Skills and context files the company curates apply across instances without forcing a single shared codebase for every internal tool.

SaaS lock-in for internal tools weakens when the same agent that uses a Gadget can rewrite it. Teams still need discipline around skills, review, and Gatekeeper policy. They no longer need to wait for a vendor roadmap to add a field to an approval tracker. Cloudflare’s own secondary reports of thousands of internal apps in a month once the tools matured show how fast that loop can run when isolation is the default.

Where This Sits Against Other Enterprise AI Moves

Enterprise AI tools keep multiplying. OpenAI’s ChatGPT Work enterprise rival push and similar agent products from other labs focus on model access and connectors. Gallup data already shows more than half of US employees using AI at work, often through unsanctioned channels. Cloudflare OS bets that the harder unsolved layer is company-specific context plus a security boundary tight enough for security teams to green-light real automation.

Crowd reaction on Hacker News and X split between excitement over the capability model and eye-rolls at yet another product labeled “OS.” Some readers found the marketing blog vague and preferred Varda’s technical thread and the GitHub README. Others immediately started local installs. The name itself generated free attention; Varda joked it was chosen to harvest angry retweets.

The durable difference is ownership and isolation. Context lives with the company. Every app is a private instance. Agents begin with nothing and receive only typed capabilities. That combination is what Sandstorm promised and what AI finally lets ordinary staff operate. Companies that already run on Cloudflare can adopt it with less friction; others can still fork and self-host. Either way the experiment is no longer theoretical. It is the platform Cloudflare uses to run itself, now available for anyone else to try.