Securing Cloudflare-hosted agents

In August 2026, Cloudflare's Agents Week gave AI agents a body: sandboxes to compute in, a browser built for them, memory that persists, native email, wallets that spend. It also shipped genuinely good security for all of it. But every one of those controls authorizes reach, and not one of them reads the message an agent is about to send and asks whether the commitment inside it was ever approved. That check is still your job, and memory just raised the stakes on skipping it.

I build in this space, so treat that as disclosure and judge the argument on its own merits.

What Agents Week shipped

Agents Week was a capability drop first. Sandboxes are persistent, isolated computers an agent can work in, with a shell, a filesystem, and background processes. Kitesurf is a browser engine built only for agents, no Chromium underneath. Agent Memory lets an agent remember users and past work across sessions. Email Service lets it send and receive mail natively from a Worker. The Agentic Internet work from the same push gives it a wallet and a receipt for everything it buys. An agent hosted on Cloudflare can now compute, browse, remember, speak, and spend.

What the new stack genuinely covers

Credit first, because it is deserved: Cloudflare did not ship capability without shipping security, and if you run agents on Workers you should use all of it. Sandboxes contain the blast radius of agent-run code; an agent that goes wrong inside one cannot reach your production filesystem. Outbound Workers put a programmable proxy on the sandbox's egress, so you decide which hosts an agent can reach, and credential injection means the agent never holds your API keys at all: the proxy adds them in transit. Managed OAuth for Access gives each agent a real identity when it signs into internal apps, replacing shared service accounts. Mesh and Workers VPC scope which private systems it can see. This is good security engineering. Ten years of the-intern-has-the-root-password problems, solved for agents at the platform layer.

What every layer has in common

They authorize reach. Which machine, which host, which app, which network, which spend. Not one of them reads the message the agent is about to send and asks whether the business commitment inside it was approved.

Walk through a fully locked-down support agent. It runs in a Sandbox. Its egress is scoped by an Outbound Worker. It holds no credentials. It signs into the helpdesk with Managed OAuth. Every control passes, because none was violated. It then emails a frustrated customer a full refund, thirty percent off the next order, and a guaranteed Thursday delivery. No system in that stack knew those numbers existed. The refund cap, the discount authority, the promises the business is willing to stand behind: that policy lives in your commercial world, not in the network layer, and nothing on the wire path checks it.

Memory makes this sharper, not softer

Agent Memory is the announcement to think hardest about. It is genuinely useful: an agent that remembers a returning customer is a better agent. But memory has no concept of whether what it stores was authorized. If your agent offers an unapproved discount on Tuesday, memory faithfully records it. When the same customer returns in March, the agent recalls its own overreach as established precedent and repeats it, politely, with confidence, and now with history on its side.

Unauthorized commitments used to be one-off incidents. A remembering agent turns them into standing policy. The control that prevents this is not memory hygiene. It is checking the commitment before it ships, every time, so nothing unauthorized ever becomes a memory.

The practical checklist

First, the platform layer, using what Agents Week shipped:

• Run agent code in Sandboxes, and scope every sandbox's egress through an Outbound Worker.
• Inject credentials at the proxy rather than granting them to the agent.
• Give each agent its own OAuth identity via Managed OAuth for Access.
• Set per-agent budgets on models and spend.
• Treat Agent Memory as a data surface with retention and per-tenant isolation questions attached.

Second, the commercial layer, which no platform ships because it cannot know your business:

• Write down what the agent may commit to, in numbers: discount ceilings, refund authority, promises it may and may not make.
• Check each outbound action against that policy before it sends, not after.
• Route the edge cases to a named human for approval.
• Keep a record of every decision that does not live inside the system being judged.

Why the record has to live outside

That last item matters most after something goes wrong. When a customer holds up a promise your agent made, the question is not whether the agent had network access. It is whether anyone, outside the system that acted, can show what was authorized at the moment it acted. An assurance layer that is part of the platform running the agent is the platform grading its own homework. Independence is not a feature preference. It is what makes the record credible, the same way a prompt that says "do not overpromise" is not evidence and a signed decision record is.

Cloudflare now decides what your agent can reach, hold, remember, and spend. Someone still has to decide whether the thirty percent discount in the email it is about to send was ever approved. That is a different job, it is the job that determines who pays when the promise comes due, and it is the one to add before your agent's new body starts making commitments its business never made. If you want to see what that check looks like, the live demo runs a violating message against an editable policy and returns the decision in a couple of seconds, no signup.