Cloudflare OS
Cloudflare OS: Kenton Varda's Sandstorm reborn as open source agent infrastructure
Kenton Varda's 'secret 10-year master plan': a remake of Sandstorm on Workers and Durable Objects, Apache 2.0 with no open-core catch. Every app instance ('Gadget') is a sandboxed Dynamic Worker with zero default internet; 'Gatekeepers' are supercharged MCP servers holding credentials, enforcing per-resource policy, and logging every action, with pending approvals simulated locally so agents keep working while humans review in batch. Thousands of Cloudflare employees have used v1 internally since May. Landing the week of the sandbox-escape disclosures, the timing wrote its own headline.