Cloudflare OS Agent Workspaces, Explained

Published September 19, 2026 · by the AQ team

Cloudflare OS is an open-source agent workspace built on Cloudflare Workers, open-sourced by Cloudflare on August 5, 2026 under the Apache 2.0 license. In its model, a workspace is a persistent, isolated environment that combines agent sessions, durable state, files, and a sandboxed runtime in which the agent writes and executes code to get work done, all grounded in context and integrations your company curates. It was built for every employee in a browser, not just engineers in a terminal: the agent drafts documents, builds small internal apps, and automates workflows, while a capability-based security layer called Gatekeepers decides exactly what it can touch. It is also a different kind of workspace than the one a coding agent needs: there is no git worktree, no dev server, and no Claude Code or Codex CLI inside it. This guide explains what a persistent agent workspace means in Cloudflare's model, what it deliberately is not, and where a coding-agent workspace for a team fits alongside it.

What Cloudflare OS actually is

Cloudflare describes Cloudflare OS as an "operating system for AI productivity" that it originally built for its own employees and has used internally across engineering, sales, IT, and other functions. As of September 2026 the repository at github.com/cloudflare/cloudflare-os carries roughly 10,000 stars, is licensed Apache 2.0, and is explicitly labeled an early access release with rough edges; Cloudflare is limiting outside contributions to small, easily verified changes while the codebase settles.

The pitch is not "use Cloudflare OS as a product." It is "fork this and make it Your Company OS": every employee gets an agent that already knows the company's context, skills, and systems, and everything the agent produces lives inside governed infrastructure rather than scattered across personal accounts.

What "workspace" means in Cloudflare's model

The architecture explains what a workspace is here. Cloudflare OS leans on three Workers primitives, per the project's own documentation as of September 2026:

• Every workspace is its own Durable Object. A Durable Object is Cloudflare's stateful serverless primitive: a single-threaded object with its own storage that persists across requests. Sessions, state, and files survive because they live in the object, not in a browser tab or a laptop process.
• Agents work in Code Mode. Instead of calling tools one JSON invocation at a time, the agent writes snippets of JavaScript or TypeScript and immediately executes them in the workspace's sandboxed runtime. The code runs with access only to resources that have been explicitly introduced to the workspace.
• Apps ("Gadgets") run as Dynamic Worker Facets. When the agent builds you a small app, that app is loaded as a Dynamic Worker inside the workspace's Durable Object, with its own isolated SQLite database. Every user gets a private instance of each app rather than a seat in shared SaaS, which is why Cloudflare says it is safe to let people (and agents) modify the code.

So a Cloudflare OS workspace is a long-lived, server-side container for one person's agent activity: the conversation, the state it has accumulated, the files it has produced, and the code it is allowed to run. That maps to about half of what the industry means by an agentic development environment: the persistent, isolated place where agent work happens, without the software-delivery half (repositories, branches, tests, deploys).

Gatekeepers: capabilities instead of API keys

The security model is the part most worth stealing regardless of what you run. In Cloudflare OS, agents start with access to nothing. Every internal system an agent could touch is fronted by a Gatekeeper: a service-specific Worker that holds the actual credentials and hands the agent a scoped capability object instead. No raw API key, OAuth token, or database credential ever reaches agent-generated code.

A Gatekeeper can grant access to a single repository but not others, allow reading issues but not source, mask specific fields, rate-limit calls, and require a human sign-off before a consequential action goes through. Approvals are deferred rather than blocking: the agent queues the action and keeps working while a human reviews it. Cloudflare also logs every source an agent reads, and that record travels with the output so downstream readers are permission-checked against what went in.

Can you self-host it?

Mostly, with one honest caveat. Cloudflare OS is built entirely on the Workers platform, and Cloudflare states it can run on workerd, the open-source Workers runtime, on your own servers with no dependency on Cloudflare's cloud. But as of September 2026 the repository marks the workerd deployment tooling and documentation as coming soon: the paved paths are a one-click deploy into your Cloudflare account or local development via wrangler. If your requirement is "runs in our network today," you are early. The broader menu of ways to keep agent execution on infrastructure you control is covered in our guide to self-hosted AI coding agents.

On models, the project says it works with many major AI model providers and self-hosted models, so the workspace layer does not lock you to one inference vendor.

What a Cloudflare OS workspace is not

Here is the distinction that matters if you came to this page thinking about coding agents. A Cloudflare OS workspace holds an agent, its state, and a V8 isolate runtime. A coding-agent workspace holds your repository. Concretely, a team shipping code with agents needs things a Workers isolate is not designed to provide:

Neither column is the "real" agent workspace; they answer different questions. Cloudflare OS asks how a whole company works alongside agents safely. A coding-agent workspace asks how a team ships software with agents it can watch, steer, and review. The distinction is close to the one between background agents and cloud agents: what makes an environment right for coding is not just persistence, it is having the repository, the toolchain, and the agent CLI in one place with a human able to step in.

Where a team coding workspace fits

If Cloudflare OS (or a fork of it) becomes your company's document-and-app layer, your engineers still need the other kind of workspace: a persistent machine where real agent CLIs run against real checkouts, sessions outlive laptops, and the team can see what every agent is doing. You can assemble that from a VM, tmux, and per-task worktrees (the self-hosted guide above walks through it); the remaining work is the team layer: shared live sessions, isolation between parallel tasks, and tracking the PRs agents open.

Where AQ fits

AQ is the multiplayer coding harness where engineering teams run AI coding agents like Claude Code and Codex together: shared live terminals, a code editor, and app previews, in your own cloud. In this guide's terms, AQ is the coding-side counterpart to what Cloudflare OS does for documents and internal apps: the persistent workspace is a real machine, and what persists is the working session itself. Agents run as the real CLIs (Claude Code, Codex, Cursor Agent, Kimi, Grok, or plain shells) in persistent tmux sessions on your team's VM, streamed live to the browser, so a session survives a closed laptop, resumes from any device, and teammates open the same workspace and watch the same live session. Each workspace gets its own isolated git worktree with automatic dependency install, agents commit and open PRs with per-user GitHub auth, and every workspace serves a live dev-server preview with shareable links. Custody stays simple: engineers log into the CLIs with their own Claude and OpenAI accounts (that usage is never marked up), there is no shared multi-tenant execution tier, and the execution machines are VMs you connect from your own cloud or a dedicated always-on AQ-managed VM in its own isolated network; runners and infrastructure covers how that works, including in-product runner health, installer preflight, and an aq-runner doctor command. The Free plan is a personal sandbox for one person on a private machine AQ creates, with no time limit; the Team plan is $50 per user per month in early access (standard $200, billed monthly), with the rate locked for your first 12 months.

Plainly: Cloudflare OS and a coding harness are complements, not competitors. One governs how everyone at the company uses agents on documents, apps, and internal systems; the other is where your engineers and their agents actually ship code, together.