Twice in nine days. OpenAI's models chained a zero-day to get out of an eval environment. Anthropic just found three incidents of the same shape. This is what capable models do. Every reachable path is an invitation. Credit to both for publishing. We rebuilt Cloudflare OS, our internal agent platform, assuming exactly this. Sandboxes have no network path out. Agents don't get every MCP tool up front, each workspace gets only what it needs. And instead of stopping for every approval until someone gives up and enables auto-approve, the platform simulates pending actions so the agent keeps working, then queues the real ones for review at the end. The app side goes further. Apps carry no auth code at all, the sandbox provides it, so there is no auth logic to get wrong. Multi-document apps are isolated per document, so a bug can't leak between separately shared items. Anyone viewing an app must have direct permission to each of its data sources, so a dashboard on sensitive data can't overshare. Actions need the user's own permission or an approval from someone who has it, so an app can't escalate its author's privileges. And everything an app does is logged, even when the service it calls doesn't support logging. Most companies are about to point agents at real systems. Build for what the models actually do. We will open source this next week!

Detailed technical write up on us adding PQ authentication to origins. ML-DSA certs now work end to end between Cloudflare and your origin. Authenticated Origin Pulls, free on every plan. Custom Origin Trust Store for the other direction.

Cutting the bill is where every AI gateway starts. It's not where it ends. We launched AI Gateway two years ago. The past year has been about building the controls we needed for Cloudflare ourselves. Spend visibility. Security. Token efficiency. Audit trails. Every model call, every MCP connection, one control point. The exhaust tells you what your AI is actually doing. MCP portals. Code mode. More of the world's inference routes through Cloudflare every day.