Cloudflare gave every employee an agent workbench. 4 in 5 companies cannot govern the agents they already run.

Cloudflare OS is a browser workspace that runs on Cloudflare's network. Inside it, an employee with no technical background can research a topic with company context attached, produce documents and spreadsheets tied to live data, chain deterministic workflow steps with AI judgment in the middle, and build small shared apps for their team. No terminal, no repo, no waiting on IT. The announcement is worth reading in full, because the details are where the launch earns its claims.

The security model is the interesting part. Agents start with zero access. Every connection to an external system goes through a service-specific gatekeeper, outbound networking is off unless a capability explicitly grants it, and the whole thing sits behind Cloudflare Access, so every request gets verified before it lands. You can point it at any model provider through Cloudflare's AI Gateway. The code is in two public repositories today, deployable to your own Cloudflare account, with a managed dashboard version promised later.

Cloudflare's CEO Matthew Prince put the pitch in one line: for AI to transform a company, it cannot live in a silo or behind a developer bottleneck. And this was not a one-off release. It landed in the middle of the company's Agents Week, alongside Kitesurf, a browser built for AI agents. Cloudflare has decided the place agents live is a market worth owning, and it is giving away the workbench to get there.

No-code agent builders are not new. There are a dozen platforms selling drag-and-drop agents right now, and we have watched most of them stall at the same place: a demo that impresses on Tuesday and an integration wall on Thursday. Three things separate this launch from that pile. It is free and open source rather than a per-seat subscription. It ships an enterprise security posture by default instead of bolting one on at the top pricing tier. And it is model-agnostic, so you are not marrying a lab to use it. The industry moved further in that direction the next day, when the big agent vendors agreed on a portable plugin format that cuts the lock-in on custom agent tooling.

The honest upside for a non-technical team is real: the bottom rung of agent work just became self-serve. The research memo assembled from your own systems, the weekly report that collates itself, the lookup tool your ops person keeps wishing existed. That class of work needed a developer last month and does not need one now. The productivity numbers behind agents support taking that seriously. DigitalOcean's Currents survey of more than 1,100 developers, CTOs and founders found 67% of organizations using agents report productivity gains.

The same survey carries the number that should slow you down, though. Only 10% of those organizations are scaling agents in production. Gains are easy to start and hard to keep, and the gap between those two figures is where the rest of this post lives.

While Cloudflare was launching a workbench for everyone, the people who audit agent deployments were publishing what everyone has done with the agents they already had. Gravitee's State of AI Agent Security report, a survey of 750 senior technology leaders across the UK and US run in April, found agent counts inside enterprises roughly doubled in a single quarter. Then the control numbers: 54% of organizations had or suspected an agent security or data privacy incident in the past 12 months. 48% of production agents run unsecured. Only 19.7% of organizations fully secure and govern every agent before it goes live, and 7.2% have a named person accountable for agent behavior. Read that last one again. In 13 out of 14 companies, when an agent does something wrong, it is nobody's job.

The cost side is already measured too. IBM's 2025 Cost of a Data Breach report found shadow AI, the tools employees adopt without security sign-off, involved in 20% of breaches, adding an average $670,000 per incident. Of the organizations breached through an AI incident, 97% lacked proper AI access controls, and 63% had no AI governance policy at all.

None of this is an argument against Cloudflare OS. Its zero-access default is a better posture than most of what those surveys describe, and an agent built inside a sanctioned workspace beats one built on a personal account with a scraped API key every day of the week. We walked through what happens when agent controls fail at the top of the market in our post on the OpenAI and Hugging Face breach, and what happens when the same tooling is turned against a government from outside, and the lesson is the same here: the platform's security model is the floor, not the guarantee. The workspace can refuse an agent access. It cannot tell you whether the agent your marketing lead built on Tuesday should have it.

The search phrase for this corner of the market is custom AI agent model development for non-developers, and until this week every honest answer to it routed through somebody technical. Cloudflare OS changes the answer for a real slice of the work. It does not change it for all of the work, and the incident numbers above are what happens when companies pretend otherwise. So here is the sorting logic we use on our own intake, applied to the launch.

Ask three questions about the agent you want. Does it touch customer data, money, or contracts? Does it write to a system of record, meaning your CRM, your books, your inventory, anything other teams treat as truth? Does it run unattended, on a schedule, without a person reviewing what it did? Every yes moves the work out of the DIY lane, because every yes is a way the agent can do damage faster than a non-technical builder can notice. The incident surveys are not describing exotic failures. They are describing agents that were granted broad access because narrow access was fiddly, then left running because they seemed fine.

Three noes, and the workspace lane is genuinely yours. Research, drafting, lookups, personal workflow glue: build it yourself, today, at zero cost, and do not pay us or anyone else for it. This is the same boundary we mapped for Zapier and Make, and the tools keep moving the line without ever removing it.

The trap is the middle case: the DIY agent that works. It quietly picks up users, then dependents, then it is a production system that nobody specced, nobody tested, and nobody owns. We keep a running log of what breaks in production automations, and the most expensive entries are rarely the builds that failed early. They are the ones that worked long enough for a team to build on top of them.

The build was never the expensive part. McKinsey's July research on AI cost management found 93% of enterprises exceed their AI budgets, spend rises nearly fourfold moving from pilots to broad adoption, and token usage on the same task can vary by up to 30 times. A free workbench does not repeal any of that. It moves the spend from a line item you approved to usage nobody is metering, and it multiplies the number of people who can start the meter.

Self-hosting has the same shape. Cloudflare OS being open source means the software costs nothing, and it also means someone has to deploy it, patch it, wire the gatekeepers to your actual systems, and decide who may connect what. That someone is doing agent platform administration, whatever their job title says. For a company with an IT function, fine. For the 20-person firm this launch is implicitly pitched at, the free workspace has a payroll cost hiding in it.

This is the line of work we sell, so weigh our view accordingly. When an agent fails the three questions above, what you are buying from a builder is not typing. It is scoped access instead of broad access, evals that catch drift before your customers do, and a named owner on the other end of the phone, which is precisely the thing 92.8% of organizations in the Gravitee survey cannot point to. A starter build runs $1,500 to $2,500 fixed. Against a free workbench that is a real premium, and it buys the parts of the build the workbench does not do.

First, actually try it. Cloudflare OS is the best free demo of what agent work feels like that anyone has shipped, and an hour inside it will teach a skeptical founder more than ten vendor decks. Point it at disposable work: research, drafts, a lookup tool. Nothing you would miss.

Second, before anyone on your team builds agent number two, write down the inventory. Which agents exist, what each one can touch, who built it, who owns it. The companies in the incident statistics did not plan to lose track of their agents. They just never started the list, and the mean agent count doubled in a quarter.

Third, hold the three questions as policy. Customer data, systems of record, unattended runs: any of those, and the agent gets a real build process, whether that process is internal or hired. The point of the DIY lane is that it stays cheap precisely because it stays low-stakes. The moment a workspace agent starts mattering, promote it deliberately instead of discovering in an incident report that it promoted itself.