An employee asks an AI agent to pull sales numbers and build a dashboard from them. The agent does the job well. Then a coworker who was never cleared to see those sales numbers opens that same dashboard, and now they can. No one broke a rule on purpose. The permission system checked whether the agent could touch the sales data. Nothing checked where that data went once the agent had it. That gap is why most companies still keep AI agents away from real business data even while pushing employees to use AI everywhere else, and it is the problem Cloudflare built Cloudflare OS to close.

The next day, a different team at the company shipped a browser with no Chromium in it. The two releases landed a day apart during Cloudflare's second Agents Week of 2026, solving different problems. Both refuse the easy option: take a tool built for humans and hand it to an agent anyway. Cloudflare rebuilt the tool instead, twice in one week.

The Argument Both Releases Are Evidence For

Cloudflare has been making a version of this case since April, when it renamed its annual event from Developer Week to Agents Week and reached back into its own history to justify the switch. Workers launched in 2017 as a bet on V8 isolates instead of containers, built for speed rather than for agents that did not yet exist. Containers give every task a full commercial kitchen, appliances and walk-in fridges included, whether the job needs them or not. Isolates give a personal chef exactly the counter space and the knife the meal requires, provisioned in milliseconds and cleared the moment the dish is served, in Cloudflare's own framing (Cloudflare, 2026). Agent workloads, the company argues, look nothing like the human traffic containers were built for. A browser session serves one person for minutes. An agent workload is billions of short, disposable tasks, and a cloud built around containers runs out of CPU to hand out long before a cloud built on isolates does.

Kitesurf and Cloudflare OS are that argument showing up as shipped product instead of as a slide. A Kitesurf session that uses roughly a third of Chromium's CPU and a seventh of its memory on HTML extraction applies the isolates bet to browsing. A Cloudflare OS app that spins up as a Dynamic Worker inside a Durable Object Facet, instead of as a persistent server, applies the same bet to internal software. Kitesurf and Cloudflare OS make sense only against that April argument, and each functions as fresh evidence for it.

Access Control Was Never the Hard Part

Cloudflare ran the first version of Cloudflare OS internally starting in May, giving every employee an agent workspace built on its own Workers and Access products. Within three months, thousands of people outside engineering were using it daily, according to the company's own account. The tool worked. Then people started sharing what they built with each other, and Cloudflare found the gap that Model Context Protocol does not close on its own.

An MCP server can tell you which tools an agent is allowed to call. It cannot tell you which resources that agent already looked at, or where that information went next. An agent that reads a sensitive customer table and turns it into a chart has not violated any tool permission. The chart is new. But the chart carries the table's contents, and if a colleague without table access opens that chart, the permission system that gated the read did nothing to gate the exposure.

Cloudflare's fix is a service-level proxy it calls a Gatekeeper, a Worker that sits between the workspace and each external system. A Gatekeeper might restrict an agent to a single GitHub repository, let it read issues without touching source code, or require human approval before it merges a pull request. It translates that narrow set of allowed operations into a typed binding the agent calls in code. The approach resembles what other zero trust vendors already do with brokered access.

The credential itself never reaches the agent or any code the agent writes.

The addition is an observation ledger. Every resource an agent touches gets logged and stays attached to whatever it produces. A second person opening that dashboard triggers a check against what the agent saw, not against the dashboard's own sharing settings. Sharing the dashboard cannot quietly hand over the sales data behind it too.

Merges and Comments Get the Same Treatment

Cloudflare paired the open source release with a second, narrower piece: WriteGuard, now in private beta for MCP server portals. WriteGuard picks up where Gatekeepers leave off, on the write side, classifying every MCP tool call by what it does to a downstream system, read-only, a reversible write, or a destructive one, and sending anything past read-only through policy before it runs.

Cloudflare built it for its own rollout first, and the reason is almost mundane: before letting internal agents merge GitLab pull requests or post GitLab comments unsupervised, someone had to decide, at the tool level and not the individual engineer's discretion, that "leave a comment" is not the same action as "merge to main." Async audit logging means the classification adds no latency the agent is waiting on.

An agent that reads a spreadsheet and turns it into a dashboard has not broken any rule a tool permission would catch. The rule Cloudflare wrote follows the data, not the door it walked through.

Every app built inside Cloudflare OS runs as its own Worker, isolated in a Durable Object with its own database, separate from whatever else the workspace is running. Inference itself routes through AI Gateway, which is how spend and model choice get attributed to a person, team, or workspace rather than disappearing into a shared API key. Adopting Cloudflare OS means adopting Cloudflare's infrastructure underneath it, whether or not a company ever touches the built-in chat interface.

Why Build a Browser With No Chromium In It

The next day, Cloudflare released Kitesurf, a browser engine written in Rust and compiled to WebAssembly, with no Chromium anywhere in the stack. It runs inside V8 isolates on Workers instead of spinning up a full browser process per session, and it is free during beta through Browser Run.

The case for building it starts with what agents do not need. Tabs, extensions, cross-device sync, and pixel-perfect 60fps rendering serve a human sitting in front of a screen. An agent taking a screenshot or pulling content off a page does not care whether the CSS parsing is exact. It cares about cost, speed at scale, and staying isolated from a page that might try to prompt-inject it. Those are not requirements Chromium was built to satisfy.

Cloudflare's own benchmarks, run across a 14-URL corpus comparing Kitesurf against a warm Chromium pool, show the tradeoff plainly. Kitesurf uses 3.1 times less CPU and 4.7 times less memory than Chromium for a screenshot, and 3.8 times less CPU and 7 times less memory for HTML extraction. Wall time runs the other way: Kitesurf is 1.7 to 1.8 times slower per request, because a warmed-up Chromium JIT still beats a cold software renderer on raw speed.

That is a real trade. A company running one agent browsing task will not notice the difference. A company running thousands of concurrent scraping and research sessions pays for CPU and memory, not wall clock, and that is the bill Kitesurf is built to cut.

Twelve Weeks, Not a Fork

Kitesurf is twelve weeks old, built from a Rust port of an existing open source engine plus Blitz for rendering and Firefox's Stylo for CSS parsing, and it already passes more than 215,000 Web Platform Tests. It speaks the same Chrome DevTools Protocol that Puppeteer and Playwright expect, so existing agent tooling connects without a rewrite, though it cannot yet play video, render WebGL, or negotiate the TLS fingerprints some bot-challenge systems check for, gaps Cloudflare is upfront about; Browser Run still defaults to Chromium for anything that needs them. Cloudflare plans to open source the code once it is ready, the same move it made with Cloudflare OS days earlier. Build the narrow version, prove it internally, then hand over the code while keeping the runtime underneath it. That is the playbook twice in one week.

Most of an Agent's Work Is Not Reasoning

Line up what shipped this week and a cost lesson falls out of it. A screenshot, an HTML extraction, a table read, a tool call: none of that needs a frontier model. It needs somewhere cheap to run. Kitesurf cuts CPU and memory 3 to 7 times specifically on that mechanical layer, and AI Gateway exists inside Cloudflare OS to route each request to the model the task warrants rather than the model the workspace defaults to. Cloudflare's own framing in the OS launch makes the point directly: nobody needs the most expensive model running to summarize an unread inbox every morning.

Most teams wire every step of an agent workflow through the same model because it is the path with the fewest decisions to make, and the resulting bill gets blamed on model costs. Route browsing, extraction, and lookups to disposable compute instead, and save the frontier call for the step where reasoning is the real bottleneck.

About Shashi Bellamkonda

Loading bio…

LinkedIn Profile

Get new posts by email:

Subscribe

Powered by