craig strubhart

@[email protected]

[Kenton Varda @KentonVarda]

Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing.

Except actually, it's different. This is a remake of Sandstorm[.]io, my startup from 10 years ago, except this time built on Cloudflare Workers (the platform I've spent the last 9 years building) and deeply leveraging AI. This is more or less the culmination of my secret 10-year master plan.

This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug. We believe a company's security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.

How is that possible? It's the Sandstorm security model, revisited. A "Gadget" is the same thing as a Sandstorm "Grain": a fine-grained app instance. For example, if you have a document editor app, each document runs as a separate instance of the app, in a separate sandbox (one "Gadget").

This means two things, both of which I think are Big Deals:
1. The platform can manage all access control, by controlling who can access the Gadget at all. There is no way the Gadget can accidentally leak itself to an attacker -- even an attacker who has access to other Gadgets based on the same app.
2. Since everyone is running their own copy of the code, everyone can freely *modify* their copy of the code.

Think about #2 a bit more.

What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?

This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.

Sandstorm tried to change that 10 years ago, but the world wasn't ready, because not enough people had the skills or patience to actually modify their software. AI has changed that. Now you just ask the agent -- the same agent that you are using to help you interact with the Gadget can also modify the code of the Gadget.

And it is so fun.

https://t.co/qzwdrAQhtK

[craig strubhart @CraigStrubhart]

that is some scary stuff

[Midwest vs. The Rest @midwestern_ope]

Tornado near Effingham, IL 😳

[Cloudflare @Cloudflare]

We break down the technical architecture behind our multi-stage vulnerability discovery harness and automated triage loop. Learn how we manage state controls, squash false positives through adversarial review, and route around LLM context limits.
https://t.co/qFWmgEgwXP

[Devon Kerr @_devonkerr_]

Hi, I’m hiring a Director of Detection Engineering and Threat Hunting. It’s my role, so if your work history is like mine you might be a good candidate.

Read more: https://t.co/jICl5bHCq1

[Zeke Sikelianos @zeke]

TLDR on new Cloudflare AI Gateway stuff:

- Spend limits: dollar budgets per model, provider, or team.
- Dynamic routing: over budget falls back to a cheaper model.
- Per-user/per-team budgets (closed beta).

https://t.co/KP1P1y6kch

[rita kozlov 🐀 @ritakozlov]

BIG DAY! @voidzerodev is joining @cloudflare 🚀

before anything else: @vite_js is very much remaining open source, and will always remain that way, with robust ongoing investment

we're also going to keep making cloudflare the best place for building applications!

thrilled to have @evanyou and team join us to help us on that mission.

https://t.co/OndkduVZRc

[Cloudflare @Cloudflare]

Cloudflare's security team spent the last few weeks testing Anthropic's Mythos against fifty of our own repositories. What we learned about offensive AI, why faster patching is the wrong reaction, and what the architecture around vulnerabilities has to look like next. https://t.co/RSrRtIhgaV

[Cloudflare @Cloudflare]

By applying symbolic execution and the Z3 theorem prover to BPF bytecode, we’ve automated the generation of malware trigger packets, cutting analysis time from hours to seconds. Here's how: https://t.co/ZrQ9fTPFYL

[craig strubhart @CraigStrubhart]

@Codeman10 👋

[craig strubhart @CraigStrubhart]

@Codeman10 SLU is looking good 😉

[Cloudflare @Cloudflare]

AI deepfakes. Laptop farms. MFA bypass.

Inside the 2026 Cloudflare Threat Report, we break down how cybercrime is becoming industrialized (and how attackers are using AI).

With Brian Carter and Chris Pacey.

🎧 Full episode + subscribe:
https://t.co/k7dbUqVuPR

[Daniel Cuthbert @dcuthbert]

Super proud to join many friends and colleagues in saying enough is enough: https://t.co/7nS4LYZDmi

We've somehow accepted mediocre as the norm.

Respect to Sergei Epp at @sysdig for doing this

[craig strubhart @CraigStrubhart]

@Codeman10

[dax @thdxr]

we had a pretty bad security vulnerability in OpenCode that we patched on friday

the web frontend supported a ?url= parameter to let it connect to servers you may be running else where

Albert Pedersen (security researcher at cloudflare) reported to us that he could take advantage of it to point to an evil server that served up fake sessions that contained markdown with inline scripts

then you could be sent a link like http://localhost:4096?url=evilserver which if you clicked could then run commands on your computer through the terminal APIs

we were able to remote patch the url parameter out on friday but you should update either way to get the following additional fixes:

- opencode does not run a server without explicitly passing in flags
- it serves frontend with CSP headers that prevent inline scripts
- even when opting into the server you are warned if you don't pass OPENCODE_SERVER_PASSWORD

full advisory:
https://t.co/8LNeXymXTv

[craig strubhart @CraigStrubhart]

Price lock……just kidding @TMobile

[Chris King @raikiasec]

Come join my team! I'm hiring a Senior Red Team Consultant at Mandiant (part of Google CLoud). This role is netsec-focused and must be based in USA.

https://t.co/KMJ044eNsN

[Cougars Girls Golf @Ladycougsgolf]

Cougars Girls golf started their first Tournament of the year! The heat shut the Cougs down early but that didn’t dampen the mood! The cougs lost a 7th place finish by score card playoff and look forward to next week! Roll Cougs!!

[craig strubhart @CraigStrubhart]

@RsThrive @Nike Need more orange

[Cloudflare @Cloudflare]

Cloudflare Containers are now available in public beta. Deploy simple, global, and programmable containers alongside your Workers: https://t.co/L49W1GCVth

[Dane Knecht 🦭 @dok2001]

If you want to be a PM on @Cloudflare Workers platform please DM @ritakozlov @elithrar @williamallen @irvinebroque or anyone else on the team. We have a lot to ship 🚢 this year and need help making the platform delight developers everywhere!