Cloudflare OS Opens Its Ecosystem, Betting the AI Workspace Beats Shadow AI
The connectivity company is adding integrations with Asana, Box, Notion and others, plus deployment partners. The Cloudflare OS pitch is governance for employees already using AI without it.
Cloudflare has expanded the partner ecosystem around Cloudflare OS, the AI workspace it launched in August, adding one-click integrations with enterprise applications including Asana, Box, Canva, ClickHouse, GitHub, Gong, Notion and ZoomInfo, and bringing in managed service and deployment partners including EPAM, HappyCog and Towards AI. The pitch, in the company’s words, is to let teams describe the automation they need and have Cloudflare OS build and deploy it, connecting to the systems of record it requires without granting access to more data than necessary.
The launch addresses a specific and increasingly common problem. Employees are using AI tools on their own because the tools help them work faster, and that speed is creating governance gaps: sensitive files land in systems nobody approved, AI-written code ships without review, and token costs climb untracked. IT and security leaders must choose between blocking AI and slowing the business or allowing its use and risking a loss of control. Cloudflare’s bet is that a governed workspace, deployed on infrastructure the company already trusts, is the middle path.
What Cloudflare announced
The expansion has two parts. The first is integrations: Cloudflare OS can now connect to a list of widely used enterprise applications, among them Asana, Box, Canva, ClickHouse, GitHub, Gong, Notion and ZoomInfo, so that administrators can connect those resources in minutes rather than through custom work. The second is a set of deployment partnerships with professional services firms, EPAM, HappyCog and Towards AI among them, to help enterprises translate how their organisation works into agents running inside Cloudflare OS. Cloudflare says its teams already use the platform internally and rely on AI Gateway to select the right model for each task and manage token costs.
What Cloudflare OS actually is
Cloudflare OS is not an operating system in the conventional sense. It is a browser-based agent workspace that runs inside an organisation’s Cloudflare account, and Cloudflare uses the term in two ways: an operating system for a company to be productive with AI safely, and an operating system for AI workloads, in the sense that a conventional operating system manages compute. The platform gives each employee a workspace preloaded with the company’s curated context and skills, where they can ask an agent to do work, or build small applications, which Cloudflare calls gadgets, and share them.
Cloudflare builds the platform using its existing components: Workers and the Agents SDK for orchestration, Durable Objects for state management, AI Gateway for model governance, and MCP server portals for enterprise tools. Cloudflare launched the project as open source in August 2026, and opened a waitlist for a fully managed version in October.
Cloudflare’s framing of the product’s origin is worth noting, because it is the company’s central credibility claim. Cloudflare built Cloudflare OS for its own staff before bringing it to market. The company says employees across engineering, sales and other functions use it daily. Cloudflare has followed the same approach with several other products, giving the platform a foundation that newly assembled competitors lack: a large security team helped shape its governance model and put it to the test in its own operations. It also means the product reflects one company’s way of working, which is the limitation of any internally born platform.
The problem: shadow AI
The release frames the problem in terms most IT leaders recognise. Employees adopt AI tools individually, and those tools were not built for the enterprise: they hand agents broad access to systems of record, blur the line between what a person can see and what an agent can do on their behalf, and leave IT without a consistent way to govern data, cost or outcomes. Businesses now widely recognize this phenomenon as shadow AI, and it has become a board-level concern as companies adopt more AI agents. The analyst and vendor consensus is that the answer is not to ban the tools but to provide a governed alternative good enough that employees choose it, which is precisely the position Cloudflare is claiming.
The governance model is the interesting part
The most consequential design choice is how access is limiting. Cloudflare OS applies a security framework it calls Gatekeepers, which constrains what agents and applications can reach, and the platform is designed so that a tool receives access only to the data it needs rather than to everything the requesting employee can see. Because the workspace runs on Cloudflare’s infrastructure rather than on employee laptops, the security team gets visibility and control it would not have with a locally installed AI tool. For an enterprise, that combination, least privilege at the agent level plus centralised execution, is the substantive claim, and it is the one to test. The release does not describe how Gatekeepers are configured in practice, how policy conflicts are resolved, or what happens when an agent needs broader access to complete a legitimate task.
The open-source-plus-managed model
Cloudflare is running a hybrid go-to-market. The core is open source and free to self-host, which suits developers and gives the company a distribution advantage, while a fully managed deployment is available through the dashboard, and professional services partners handle the harder integrations. That is a sensible structure for a platform that must sit inside a customer’s own Cloudflare account, but it also means the value depends heavily on the partner network, which is what this announcement expands. The deployment partners are not incidental: translating an organisation’s workflows into agents is the part most enterprises cannot do alone, and Cloudflare is buying that capability rather than building it.
The market it enters
Cloudflare is not alone in pursuing this layer. Glean has spent years building the connective tissue between models and enterprise systems, and is explicit that the interface matters less than the intelligence layer beneath it. Microsoft is bundling Copilot into Office and shipping Agent 365 as a control plane for managing AI agents. Google is pushing Gemini into Workspace and publishing guidance on governing shadow agents. OpenAI and Anthropic sell directly to enterprises, and every large SaaS vendor now ships an assistant.
Cloudflare’s differentiation is its network and security heritage: it already sits in front of much enterprise traffic, and Zero Trust is a familiar purchase for the buyer it is targeting. The question is whether an infrastructure company can win a workspace category otherwise fought over by application vendors.
The category has a clear shape. Application vendors argue that the assistant belongs inside the tools people already use, and they bundle it there; data and search vendors argue that the value is the layer that connects those tools, which is Glean’s position; and infrastructure vendors argue that the workspace should run where the data and the controls already sit, which is Cloudflare‘s. Each answer favours the vendor’s existing strengths, and the buyer’s real question is which layer will own the context. Cloudflare’s answer, that the workspace should be where the company’s systems and identity already are, is coherent, but it asks the customer to run a workspace rather than adopt a feature.
What buyers should ask
For an IT or security leader weighing it, the questions are practical. How are Gatekeepers configured, and who owns the policy that decides what an agent can reach? What is the audit trail for agent actions, and can it be exported to our SIEM? How does the platform handle a request that needs access beyond least privilege? Which models does AI Gateway route to, and where is the data processed and retained? What does the managed offering cost, and what does self-hosting require in engineering time? And how do the integrations actually scope access, so that connecting Box or GitHub does not silently widen the data an agent can read?
What it signals
Cloudflare OS is a credible answer to a real problem, and this expansion addresses its weakest point, which is the practical work of connecting to the systems a company already uses. The open-source core and the partner network together give it a plausible route into enterprises that would not adopt an ungoverned tool. What remains unproven is the same thing every vendor in this category faces: whether a governed workspace can be good enough that employees prefer it to the unapproved tools they already use.
The release reports thousands of organisations using the open-source project since August, but no adoption figures, no outcomes and no pricing. The evidence will be whether enterprises move from trying it to standardising on it, and whether the governance holds up when an agent is asked to do something difficult.
That is the tension the launch has to resolve. A governed workspace is only a solution to shadow AI if employees choose it, and employees choose tools that are immediately useful. Cloudflare’s integrations reduce the friction of connecting systems, and the partner network reduces the friction of deploying, but neither guarantees that the workspace is as pleasant to use as the unapproved assistant on an employee’s phone.
The company’s internal experience is evidence that it can be, for one organisation with a strong engineering culture. Whether that generalises is the open question, and it is the one that will decide whether Cloudflare OS becomes infrastructure or remains an interesting experiment.