What happened
Cloudflare announced (Aug 4, 2026) and open-sourced (Aug 5, 2026) Cloudflare OS, an enterprise AI-agent platform built on a default-deny access model: agents get typed capability bindings via service-specific 'Gatekeeper' Workers instead of raw credentials/API keys, with sandboxed execution, resource-access tracking, and MCP Server Portal support.
Why it matters
Addresses the widely-flagged MCP/agent credential-overexposure problem (tokens mimicking normal API traffic, broad standing access) with a concrete, open-source, production-tested (Cloudflare's own internal deployment) architecture rather than a policy statement.
Applicability
Platform/security engineering teams building internal agent platforms or MCP-connected tooling should evaluate the Gatekeeper pattern now; open-source availability lowers adoption barrier for immediate piloting.