Thread

Cloudflare OS: an open platform for agents, apps, and work

641 points · 315 comments · speckx

rozenmd · 1785939425 · focus · HN ↗
I liked Kenton's take on this: <a href="https://x.com/KentonVarda/status/2084990137180590572?s=20" rel="nofollow">https://x.com/KentonVarda/status/2084990137180590572?s=20
Text from tweet:
Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing.
Except actually, it's different. This is a remake of Sandstorm[.]io, my startup from 10 years ago, except this time built on Cloudflare Workers (the platform I've spent the last 9 years building) and deeply leveraging AI. This is more or less the culmination of my secret 10-year master plan.
This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug. We believe a company's security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.
How is that possible? It's the Sandstorm security model, revisited. A "Gadget" is the same thing as a Sandstorm "Grain": a fine-grained app instance. For example, if you have a document editor app, each document runs as a separate instance of the app, in a separate sandbox (one "Gadget").
This means two things, both of which I think are Big Deals: 1. The platform can manage all access control, by controlling who can access the Gadget at all. There is no way the Gadget can accidentally leak itself to an attacker -- even an attacker who has access to other Gadgets based on the same app. 2. Since everyone is running their own copy of the code, everyone can freely modify their copy of the code.
Think about #2 a bit more.
What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.
Sandstorm tried to change that 10 years ago, but the world wasn't ready, because not enough people had the skills or patience to actually modify their software. AI has changed that. Now you just ask the agent -- the same agent that you are using to help you interact with the Gadget can also modify the code of the Gadget.
And it is so fun.
1. layer8 · 1785940510 · focus · HN ↗
  > the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug.
  This can only be correct when the application can’t affect anything outside the sandbox. Which would significantly restrict useful applications.
  1. kentonv · 1785940892 · focus · HN ↗
    See my next tweet in the chain:
    <a href="https://x.com/KentonVarda/status/2084990302784307363" rel="nofollow">https://x.com/KentonVarda/status/2084990302784307363
    -------------
    Of course, personal apps are more useful if they can connect to external services. Cloudflare OS introduces a "connector" system we call Gatekeepers. This is sort of like MCP (and MCP is supported as a kind of Gatekeeper), but with a lot more:
    * Instead of exposing tools, a Gatekeeper exposes a Cap'n Web RPC API. That makes it appropriate for use by both agents (via code mode) and Gadgets.
    * Gatekeepers integrate with the Cloudflare OS UI to provide inline audit logging and human-in-the-loop approvals for all side-effecting actions.
    * When an action requires approval, the agent does not need to stop and wait for it. A Gatekeeper will simulate the outcome, allowing the agent to keep running and queue up more work. You can then approve everything in a batch at the end. Hopefully, this means you no longer feel the need to turn on auto-approve! (But you still can if you want.)
    We have already built Gatekeepers for a huge number of services, from GitHub to Home Assistant. We've found, with the right skills, AI can basically crank these things out for any given API, solving the chicken-and-egg ecosystem problem. We are working on a "software factory" of sorts where you can input the API docs for your favorite service and get a well-written Gatekeeper. That's not quite ready yet -- so for now use the ones we provide or use the write-gatekeeper skill to write your own. You can add your own Gatekeepers to your personal deployment.
    kentonv · 1785941323 · focus · HN ↗
    Or more directly:
    When you share a Gadget, we verify that anyone you share with also has direct permission to access each of the resources it is connected to (via the Gatekeeper system). Hence, no security bug in the Gadget itself could accidentally grant people access to things they don't already have.
    techpression · 1785950608 · focus · HN ↗
    But that is a problem. I have access to something deeply secret, I run a gadget, it reads that and sends it to whoever made it
    kentonv · 1785952346 · focus · HN ↗
    No, a Gadget does not just get automatic access to your data. It only gets access to the things you grant it explicitly.
    techpression · 1785952621 · focus · HN ↗
    Just like phishing websites, which are still a problem. I’m sure I’m being overly cautious, but this sounds like a recipe for data leaks with the low barrier to entry.
    And if you want real life examples, every single LLM provider has gotten insane amounts of data shared to them, even if you have to approve.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.