Cloudflare open-sources vibe-coding platform for non-coders

Cloudflare released its AI-powered app-building platform, Cloudflare OS, to the public on GitHub on August 6, 2026. The workspace lets users describe workflows in natural language, and AI agents turn those descriptions into applications—targeting developers and non-coders alike.

In an August 5 blog post, the company said thousands of employees already use it daily to create documents, automate tasks and build small data-visualization apps.

Principal engineer Kenton Varda said on X that the platform’s sandbox is so secure “the AI cannot introduce a significant security bug,” a design meant to give security teams confidence to allow broad “vibe coding” by non-technical staff. Cloudflare OS achieves this through fine-grained app instances running in separate sandboxes powered by Dynamic Workers.

The sandboxes use V8 JavaScript engine isolates that spin up in milliseconds and consume only a few megabytes of memory—100 times faster and 10 to 100 times more memory-efficient than standard containers, according to the company. AI agents start with no permissions and must request access; server code has outbound networking disabled, and client code runs in a browser sandbox.

The release comes as researchers at Pillar Security published a report on sandbox escapes in popular AI coding tools such as Cursor and Codex.

Organizations can choose from various AI models to manage costs. CIO Sam Rhea noted in a separate blog post that not every user needs “the max thinking mode of the latest frontier lab model,” and the platform lets administrators monitor inference spending, set budgets and enforce rate limits.

Rhea also shared lessons from Cloudflare’s internal rollout. Giving everyone AI coding tools initially produced a “flood of vibe coded apps looking for a problem,” leading the company to shift toward deterministic skill files that call AI inference only when necessary. Separately, the Cloudflare Engineering Codex, an AI code reviewer, flagged nearly 250,000 deviations from engineering standards and blocked 16,000 code merges over the four months through August 2026, systems engineer Timo Reimann said.

Developers can run the full stack on their own machines, but deploying the backend requires a Cloudflare Workers Paid plan. Initially, that requirement was not surfaced early enough, and GitHub user mac2net reported being blocked mid-deployment. Cloudflare quickly updated the process to alert users upfront and a representative responded on GitHub.