Cloudflare freed up 10,000+ hours a month with internal AI adoption! The story behind Cloudflare OS

Hey, it's me! Today I found a post that's less of a product announcement and more of a behind-the-scenes story: how Cloudflare has been using AI internally, and I got really excited reading it!

Cloudflare Blog blog.cloudflare.com

What was announced?

This is a post on the Cloudflare Blog, written by CIO Sam Rhea. It walks through how Cloudflare built its internal AI platform, Cloudflare OS, and what the company learned along the way.

It all started in early 2025, when a member of the sales team asked for multiple API keys and production access to about 12 systems. They wanted to build an AI-powered "SuperApp" to reinvent how they did go-to-market work. At the time, Cloudflare had decided AI wasn't yet advanced enough to change how work gets done, but by the turn of the year, models and AI tools had improved fast enough that AI agents could actually do real work, so the company changed course.

The story so far

The post also describes what was frustrating before AI adoption took off.

• Employees kept asking individually for API keys and access, which was becoming unmanageable
• Opening up engineer-grade tools to everyone risked a proliferation of "vibe-coded" applications
• The IT helpdesk dashboard, for example, meant manually downloading CSVs, importing them into Google Sheets, building charts, and reviewing tickets one by one

Given this, Cloudflare's CIO and CTO set five guiding principles:

• Don't use AI for its own sake — define the outcome you want first, then pick the tool
• Every employee should benefit, not just technical staff
• AI is a tool, not a teammate — humans remain accountable for quality and the overall workflow
• Invest in organizing Cloudflare's own institutional knowledge, not just chasing model performance
• AI sessions shouldn't have more access than a person's normal permissions

What changes

With these principles in place, Cloudflare rolled out AI adoption in stages.

For engineers, the company built the "Cloudflare Engineering Codex," an opinionated guide covering the preferred way to implement things across each part of the codebase. AI agents built on top of the Codex now review merge requests, check technical designs before implementation, and analyze incident reports. Over the past four months, this flagged around 250,000 potential issues, blocked 16,000 merges, and caught about 600 architectural problems at the design stage.

For non-engineers, Cloudflare started with a pilot called the "magic email alias": send work you don't want to do to a dedicated AI-powered email address, and get the finished output back. Across hundreds to thousands of sessions, this surfaced the repetitive, tedious tasks that were common across the whole organization, and that data became the foundation for skill files and context files later on.

In the most recent month, the sales team saved over 10,000 hours of manual work on things like territory planning and proposal writing, more than 4,000 custom applications and tools were built internally, and daily active users kept growing.

Dive Deep

Let's get into how the platform itself works.

Cloudflare OS v1 is a simple harness running in a container on Cloudflare's own infrastructure, authenticated through Zero Trust (Cloudflare Access) and usable entirely in the browser with no local setup. The post mentions new hires automating weeks of work within just a few days.

On the security side, a Model Context Protocol (MCP) portal standardizes how data flows between systems. Instead of hitting each system's native API directly, Cloudflare built its own MCP servers, which let it add extra controls like rate limits by region or job role. All AI inference is routed through AI Gateway, reusing existing Secure Web Gateway DLP (Data Loss Prevention) rules for filtering, along with logging, auditing, and role-based model access control.

v2 takes this further: users describe a workflow in natural language, and an AI agent generates the implementation code, which can then run on demand, on a schedule, or via event triggers. Going back to the IT helpdesk example, in v1 a skill file regenerated the same report every morning, burning tokens each time. In v2, once the workflow is coded, a Cloudflare Workers-based service called "Gatekeeper" runs the queries deterministically going forward, with AI inference only kicked in when actually needed, like drafting a reply to a ticket. Gatekeeper provides secure access to systems without managing API keys, and it automatically scopes down permissions to match each user.

The rollout approach is worth noting too: instead of a dedicated AI team, Cloudflare designated early-adopter "champions" across offices, including a sales leader in London, a solutions engineer in Texas, an Investor Relations lead in Portugal, and a business development team member in Japan. On top of that, 1,111 interns were placed across teams with the goal of making every team AI-powered.

Wrap-up

• It all began with a sales rep's request for API keys and access in early 2025
• Rollout followed five principles, including "don't use AI just for the sake of it"
• For engineers, Codex-powered AI agents automate review and design checks, flagging ~250,000 issues in four months
• For everyone else, the "magic email alias" pilot surfaced common repetitive tasks
• v1 was a browser-based harness with an MCP portal and AI Gateway; v2 evolved into natural-language-driven, deterministic workflow generation
• The most recent month alone saved over 10,000 hours and produced 4,000+ custom apps

If you work in IT or platform teams and are wrestling with how to design and roll out AI adoption inside your own company, this one's especially for you!