▲ 668 points
back
330 comments
I liked Kenton's take on this: https://x.com/KentonVarda/status/2084990137180590572?s=20
Text from tweet:
Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing.
Except actually, it's different. This is a remake of Sandstorm[.]io, my startup from 10 years ago, except this time built on Cloudflare Workers (the platform I've spent the last 9 years building) and deeply leveraging AI. This is more or less the culmination of my secret 10-year master plan.
This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug. We believe a company's security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.
How is that possible? It's the Sandstorm security model, revisited. A "Gadget" is the same thing as a Sandstorm "Grain": a fine-grained app instance. For example, if you have a document editor app, each document runs as a separate instance of the app, in a separate sandbox (one "Gadget").
This means two things, both of which I think are Big Deals: 1. The platform can manage all access control, by controlling who can access the Gadget at all. There is no way the Gadget can accidentally leak itself to an attacker -- even an attacker who has access to other Gadgets based on the same app. 2. Since everyone is running their own copy of the code, everyone can freely modify their copy of the code.
Think about #2 a bit more.
What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.
Sandstorm tried to change that 10 years ago, but the world wasn't ready, because not enough people had the skills or patience to actually modify their software. AI has changed that. Now you just ask the agent -- the same agent that you are using to help you interact with the Gadget can also modify the code of the Gadget.
And it is so fun.
That should have been the announcement.
The article posted buries the lead. Cloudflare OS reads like almost any other AI knowledge base until midway when apps are introduced and then becomes overly technical with a code snippet.
This is really interesting. I built a similar product (not released yet), but it uses Kubernetes as the infrastructure layer instead of Cloudflare OS. I guess all these years later I am left with the same existential question that plagued Sandstorm. What is its relevance in the context of Linux containers? This is not a rhetorical question, is there a real benefit for a Sandstorm grain over a docker style Linux container? Does a containerized process not have all the same benefits of a Sandstorm grain, with the added benefit of not requiring any modifications of the containerized software?
One argument I could bring is that despite all its claims, OpenAI still had to switch from containers to MicroVMs because its agents under test still managed to break out from their containers. Is the security model of a Sandstorm grain so much better that agents wouldn't figure out how to break out of it?
> the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug.
This can only be correct when the application can’t affect anything outside the sandbox. Which would significantly restrict useful applications.
Sandstorm without self hosting has no interest though. (Edit: see below, where the creator states it _can_ be run locally)
Buzz looks like a more reasonable direction than this does.
You should probably add a disclaimer you work at Cloudflare yourself?
> I liked Kenton's take on this: https://x.com/KentonVarda/status/2084990137180590572
Thank you. The tweet values the readers time. The blog post. Dear lord. So much noise.
This was a great summation.
Great! I'm really excited.
So, I want to make an RSS feed Gadget. And you will run an RSS Aggregator Gadget, and then some Presentation Gadget. Do I have that roughly right?
How does my Gadget talk to yours? Cloudflare Tunnels for CGNAT, NAT traversal? CapnProto for the schema? Fire and forget? Online only? Queuing? Store and forward?
How do I keep track of my Contacts? Who is allowed to read my feed? Are controls built in?
So so so many questions. Do you have office hours? :D
It is quite foolish to believe that now that we have AI generated code that people will suddenly choose the more secure option rather than the cheapest. My evidence in exhibit A: The success of Wordpress.
Everytime I read about new things from Cloudflare they look really cool but I cannot shake the feeling of not wanting to use them for fear of lock-in, am I too paranoid?
"OS for work" - like, what does it mean? OS is operating system, it runs on a hardware and provides you to operate the system. I hate when companies destroy the English language with vibe invented terms.
Why are companies slapping "OS" in their product naming? it's stupid
I'm mostly going off the tweet, it could be I just don't understand, but how do you managed shared data if everyone has their own copy of the code and they can add whatever features they want? I mean, I'm assuming that any sort of significant feature requires some sort of change to the data model, and even with a schema-less database you could have conflicts if two things use the same field name, for instance? Also what happens with updates? Like, part of IT is keeping people up to date, but if everyone has their own bespoke customizations how do you not clobber those?
Also the security story doesn't completely add up to me. Like, if I'm a user and I can just add features that I want, what's to stop me from placing data in there that's maybe covered under HIPPA or some other sensitive data (protected class, or even just stuff like authentication information)? Right now a small number of people need to think about data security, but this seems like it'd extend it to anyone? That kind of data, it's not just about "keeping it internal by default", there are a lot of rules around storing it at all.
I dunno, it kind of makes me think of when people suggest forking an open source project if the maintainers won't accept a suggestion. Sure, you can do that, and it does happen, but you're also basically signing up to maintain it for decades. I'm not sure if anyone wants to maintain Alice in accounting's very weird spreadsheet app 10 years after she's left the company?
(Again I'm not throwing shade, just trying to understand better)
This represents a small part of what IT is worried about. Offer a beer and say the word "SharePoint" if you want the long version of where this could wind up.
The issue isn't letting end-users add features. The issue is twelve end-users customizing something that produces output, saving it, and now nobody can read it.
This can get solved. If it even gets a chance to gain traction (it should, though IT will of course push back). But let's not pretend we're there yet.
Why do people add "OS" to their product/project name when it is not an OS at all?
So, a security-oriented cloud agent framework? Better call it an OS.
This is effectively a Codex/Claude app competitor. Good move from Cloudflare since it helps them sell their core infra offerings. I like the direction they’re going with access control.
I know the CloudFlare CEO reads HN.
Every day I see so much cool shit from that org, that as a one man band I just can't trust because there's no billing cap/prepaid billing.
Cool. The gadgets/blueprints paradigm reminds me of Smalltalk or Lisp environments in a way -- you're shipping a messy thing, a packaged version of your own personal, always-evolving environment.
Natural language wrapper around programming. Sandboxing and controlling external interactions to minimize the cost of mistakes. As I see it, the core idea here is facilitating habitability (in the Richard P Gabriel sense) via abstracting software development and distribution in a way that allows non-programmers to engage.
I'm not sure LLMs are quite there with results/$ to fully support a personal computing revolution here. I suspect useful blueprints will largely be wrappers or reimplementations of software that is still primarily created and distributed outside of this environment. But there's promise here, and it's cool.
When did junk like this start being called an operating system?
Probably better if they make it obvious that you need Workers paid plan:
"Your Cloudflare account is on the Free plan, but the Cloudflare OS backend needs Dynamic Workers, which requires the Workers Paid plan."
If Cloudflare's been using this internally, could that explain why their dashboards are so confused, disjointed and broken?
Interesting bit from the repo: there is an agent's plan (presumably unintentionally) checked in two days ago as part of a rewrite from the Vercel AI SDK to pi-agent-core (https://github.com/cloudflare/cloudflare-os/blob/main/plans/...). That plan states "The project is in early alpha — minor behavioral regressions are acceptable and will be fixed as discovered.".
I am confused... it's not an OS, is it?
It looks like this product uses pi-agent directly (https://github.com/cloudflare/cloudflare-os/blob/main/plans/...). How come Cloudflare is not using their homegrown Agents SDK / Think / Flue harness for this? I am asking genuinely as I am evaluating a harness to build my agent platform.
The only way this is true secure is that this OS prevents ANYTHING from going out. It cannot make any arbitrary outgoing internet connection. It only has a downstream copy of your data that you are free to manipulate or search from within the system. The only output it has is the desktop GUI.
Other than that, it is not secure for an LLM to use because I could be given a document that talks about how to break the system and it would follow the instruction in there dutifully.
> Every organization has a mission, a reason for being. Organizations pass that mission — along with their terminology, procedures, systems, standards, and ways of working — to their people.
Every organization has a mission, a purpose, a raison d’être, a calling, a charter, a mandate, an objective, a North Star, a foundational premise, an animating principle, an existential justification, a reason for being, and if the strategy consultants are billing by the hour, a transformational vision.
Organizations pass that mission - along with their terminology, vocabulary, nomenclature, jargon, acronyms, initialisms, buzzwords, euphemisms, procedures, processes, workflows, playbooks, checklists, methodologies, frameworks, systems, platforms, tools, standards, policies, conventions, guidelines, best practices, governance models, compliance requirements, quality gates, templates, forms, rituals, ceremonies, traditions, customs, cultural norms, tribal knowledge, institutional memory, unwritten rules, ways of working, ways of thinking, ways of collaborating, ways of communicating, and ways of filling out expense reports - to their people.
Seemingly Cloudflare’s strategy nowadays is shipping “open-source” projects that are coupled with their own infastructure. First EmDash CMS, now this.
Really not a fan of calling things an OS that are not an OS. This seems interesting, but it is also tied to CloudFlare workers, so beware.
I really don't know how folks accept such vendor lock-in. Imagine using Cloudflare Workers as your main tech stack. This is crazy.
> Thousands of people across every function, many of them outside of engineering, use it every day to create documents and slides, automate repeatable tasks, and build small apps to visualize data and help them do their work.
In other words we have convinced them to build their own replacements.
Well everyone is trying to create an environment where they can safely delegate tasks to agents.
I am no different, but my approach is a dedicated powerful computer on your desk rather than something in the cloud. I am calling it Tarvis AI (derived from TARS from Interstellar and Jarvis from Iron Man), more details here: https://tarvisai.com
I have tried many of the VM/cloud-based agent setups, and they either tend to be only novelties since you can’t do much with 2-4 vCPUs + limited RAM or they start racking up expensive cloud bills.
I realized that the underlying operating systems for AI have to be built from the ground up for agents instead of taking current OSes and taming them for agents. Not sure how much of that philosophy is followed by Cloudflare. Excited to see growth in this area.
Does this beat self-stewarding my data, and placing relevant protections around my data instead.
Then the UI's, the "Apps", are just ephemeral instances over my live data whose permission I am consistently setting or reviewing.
I feel like that more accurately represents a "person" behind the data: when I am producing, creating and expressing in real life, I do not ask some intermediary 3rd-party for permission to access my voice and my output. I just produce and let whatever gets created be made there in the physical environment or in someone's head. Today's apps (edit: & cloudflare's direction here) feel more like "The moment I express or generate something, I lease it's output from someone else and ask for their permission to access my output".
> Cloudflare OS is available today and is open source. Check out the cloudflare-os GitHub repository. You can deploy it into your own Cloudflare account and use your own Access policies, AI Gateway configuration, data, and integrations.
In case anybody missed it.
I have a feeling we're all working towards the same thing, but with different frameworks and infra. The Cloudflare OS experience looks, to me, very much like what I created for myself with https://rcarmo.github.io/projects/piclaw (except that I rely on focusing different instances on different sets of skills and tooling, so only two have "Office" skills, for instance).
I just deployed it on my cloudflare workers, it went live in a minute, worked through my CF Access SSO. Wasn't able to configure providers easily. But reading the blog this is wild! I have been driving a hermes agent off a VM in a proxmox from my slack and wondering how to handle security.
If this takes off, this is really how enterprise agents should end up looking like. The dynamic workers hosting applications is the AI Appsmith/Retool that I need for internal dashboards.
I can't help but wonder if these things that are now emerging have a sort of "borrowed time" component tied to them.
I see the examples, and they clearly tackle both organizational inefficiencies and human connection/communication as the core problems.
Sounds like things are converging to "my AI will talk to your AI" and the role of humans will just be a human "router" in the loop switching up nodes in a graph, like the return of Switchboard Operators from the 1950s.
this is a cool idea, but i suspect will be limited in use cases. the vast majority of people don't want or can't modify their software competently and will rely on others to do that. once you're relying on someone else, they do not want to maintain different copies for every user, that sounds like a maintenance nightmare for admins or else such a new paradigm that it takes a new generation of admins 20 years to get comfortable.
They had a demo https://news.ycombinator.com/item?id=49101234
Also worth reading is the blog post by the Cloudflare CIO Sam Rhea on how they are actually using it internally, with some examples.
https://blog.cloudflare.com/how-we-use-ai-with-cloudflare-os...
From: https://os.cloudflare.app/
> "Give every person an agent and workspace built around how your company works, what it knows, and the systems it relies on."
Hundreds of thousands of so called "AI startups" have been eliminated.
This "OS" label reminds me of ms with ".NET", a choice they definitely seemed to regret
Huh, fascinating. Been working on this same architecture on a personal project, and tbh it’s really powerful. This and much else shows that everyone is kinda working on the same thing, just from different locations.
A question to the other builders in this space: how are you positioning yourself and differentiating against incumbents like this or even Claude Cowork? Are you finding many clients looking at your system and telling you they could prompt Claude directly?
In case anyone else is curious, local Gemma4 12B Q6 XL really struggles to make use of this for simple goals like a daily briefing after an MCP tool call. I don't think there's a simple artifact concept? Still early but confused.
Has anyone experienced using Buzz or YC's qm? How does this compare with those?