Loading story…
Cloudflare has open sourced Cloudflare OS, an internal platform built to control, isolate, and audit how AI agents access sensitive data and external tools. The system uses capability-based access controls and Gatekeeper services that hold credentials on an agent’s behalf, allowing policies to be enforced without exposing secrets directly to agent code. Cloudflare said the platform was designed to address security gaps in agent frameworks by limiting what agents can reach and by making their actions attributable and reviewable.
A central feature is an observation log that records every resource an agent reads and uses that history to re-check whether downstream actions should still be allowed, extending beyond tool-permission models such as Model Context Protocol. Cloudflare said agent execution is isolated through Dynamic Workers, sandboxed browser frames, Durable Object Facets, and SQLite-backed application state, while model traffic is routed through Cloudflare AI Gateway for attribution, rate limiting, and budget controls. The company said Cloudflare OS is being released as open source before a broader managed product launch, with dashboard, development container, and Slack-integrated workspace features still in development.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Cloudflare announced and open sourced Cloudflare OS, an internal agent platform built around capability-based access controls, Gatekeeper services, and an observation log that records what data agents actually read. Cloudflare also published two GitHub repositories: a core repository and a starter deployment modeled on its internal use.
Cloudflare employees have used the first version of Cloudflare OS internally since May. The platform was used to manage and audit how AI agents access resources and propagate sensitive data inside the company.
After a GitHub user complained that Cloudflare OS deployment failed mid-process for Workers Free plan users without early warning, Cloudflare updated the deployment flow to alert users at the start that the backend requires a Workers Paid plan. A Cloudflare representative also responded on the GitHub issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
11 references tracked. Mallory keeps watching after this page renders.
infoq.com
Open sourcethenewstack.io
Open sourcearstechnica.com
Open sourcehelpnetsecurity.com
Open sourceblog.cloudflare.com
Open sourceblog.cloudflare.com
Open sourceblog.cloudflare.com
Open sourceblog.cloudflare.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cloudflare has introduced **WriteGuard**, a private beta security layer for Model Context Protocol (**MCP**) servers that intercepts agent requests, enforces tool-specific policies, and logs blocked or failed actions for centralized auditing. The service is designed to curb the risk of AI agents using existing OAuth-backed access to perform sensitive write operations across databases, internal APIs, GitHub, GitLab, Jira, Google Workspace, SaaS platforms, and internal wikis. Cloudflare said WriteGuard can apply consistent controls across multiple MCP servers without requiring changes to each server, while preserving attribution by tying MCP client and session context to the human user and scrubbing sensitive values before audit events are stored. The launch comes as MCP-connected tools are gaining direct write access to production workflows. ElevenLabs recently introduced a hosted MCP connector that lets Claude inspect and modify **ElevenAgents** configurations, including changing prompts, voices, languages, retrieving transcripts, generating sample speech, estimating costs, and even deleting agents from a chat interface. ElevenLabs said it uses OAuth plus organization- and session-level controls and urged users to review tool calls before approval, warning that approval alone does not guarantee safe or correct downstream behavior; the company also pointed teams to testing, versioning, and CLI/API-based rollout practices for stronger governance.
Aug 20, 2026
Cloudflare has introduced **agent tracing** as the first component of its new **Cloudflare Agents** platform, giving developers deeper visibility into AI agents running on Workers. The feature extends beyond infrastructure-level telemetry by adding spans for agent invocations, model calls, tool execution, approvals, and subagent activity, and it also supports session replay of recorded conversations, tool calls, and results. Cloudflare said the capability is intended to help teams observe and debug agent behavior, but early coverage highlighted several operational caveats. Reported limitations include inconsistent default payload-recording behavior between **Think** and **Flue**, truncation that can make replay non-lossless, and pricing tied to total observability events rather than only the events surfaced in the Agents dashboard. The company said tracing is free during beta and will transition to **Workers Observability** pricing on **October 1, 2026**.
Aug 15, 2026
Security researchers and vendors warned that autonomous AI agents can be manipulated into leaking secrets and misusing privileged access, turning them into a new pathway for credential theft and system compromise. Reporting from SC Media cited Okta Threat Intelligence research showing agents on the OpenClaw platform could be socially engineered or prompt-injected into exposing passwords, API keys, GitHub tokens, and OAuth refresh tokens, while other analysis described a **confused deputy** problem in which malicious text embedded in files, logs, web pages, or instruction files causes agents to execute higher-trust actions with their legitimate permissions. The risk is amplified when agents can read local files, edit code, run commands, fetch remote content, and access external tools or MCP servers without strong separation between trusted instructions and untrusted data. Defenders are responding with controls aimed at limiting agent authority and reducing secret exposure. Help Net Security reported on **Nono**, an open-source sandbox that constrains AI coding agents at the kernel level using mechanisms such as **Landlock** on Linux and **Seatbelt** on macOS, while introducing scoped tool permissions and proxy-mediated "phantom credentials" so agents do not directly handle live secrets. The broader guidance aligns with established ATT&CK techniques including **`T1552` Unsecured Credentials** and **`T1546` Event Triggered Execution**, emphasizing least privilege, centralized identity governance, short-lived credentials, secure secret storage, logging, rapid revocation, provenance checks, input isolation, and human approval to prevent agents from becoming a bridge to sensitive systems and cloud resources.
Jul 28, 2026