Cloudflare open-sources vibe-coding platform with security sandbox that blocks critical flaws

Cloudflare has released its internal Cloudflare OS platform as open-source software, enabling employees without engineering backgrounds to build applications through AI agents. The company says the tool makes "vibe coding" safe by preventing AI from introducing serious security vulnerabilities.

The platform was developed over several months and used internally to streamline routine work. According to a Cloudflare blog post from August 5, thousands of employees use it daily to generate documents and slides, automate repetitive tasks, and assemble small data-visualization apps. The code is now available on GitHub.

Principal engineer Kenton Varda explained that the security architecture relies on fine-grained application instances. For instance, each document in an editor runs as a separate instance within its own sandbox. Access to every instance is managed individually, and each user works with a personal copy of the code they can freely alter.

The mechanism is built on Dynamic Workers, a pre-existing Cloudflare feature that replaces conventional containers with "isolates"—instances of the V8 JavaScript engine. These start in milliseconds and consume only a few megabytes of memory. Cloudflare estimates they are 100 times faster and 10–100 times more memory-efficient than standard containers.

Varda stated that the sandbox is so robust that AI cannot introduce a meaningful security bug, allowing security teams to let non-technical staff engage in vibe coding without losing sleep.