alt Hacker NewsI liked Kenton's take on this: https://x.com/KentonVarda/status/2084990137180590572?s=20
Text from tweet:
Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing.
Except actually, it's different. This is a remake of Sandstorm[.]io, my startup from 10 years ago, except this time built on Cloudflare Workers (the platform I've spent the last 9 years building) and deeply leveraging AI. This is more or less the culmination of my secret 10-year master plan.
This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug. We believe a company's security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.
How is that possible? It's the Sandstorm security model, revisited. A "Gadget" is the same thing as a Sandstorm "Grain": a fine-grained app instance. For example, if you have a document editor app, each document runs as a separate instance of the app, in a separate sandbox (one "Gadget").
This means two things, both of which I think are Big Deals: 1. The platform can manage all access control, by controlling who can access the Gadget at all. There is no way the Gadget can accidentally leak itself to an attacker -- even an attacker who has access to other Gadgets based on the same app. 2. Since everyone is running their own copy of the code, everyone can freely modify their copy of the code.
Think about #2 a bit more.
What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.
Sandstorm tried to change that 10 years ago, but the world wasn't ready, because not enough people had the skills or patience to actually modify their software. AI has changed that. Now you just ask the agent -- the same agent that you are using to help you interact with the Gadget can also modify the code of the Gadget.
And it is so fun.
Replies
That should have been the announcement.
The article posted buries the lead. Cloudflare OS reads like almost any other AI knowledge base until midway when apps are introduced and then becomes overly technical with a code snippet.
Sandstorm without self hosting has no interest though. (Edit: see below, where the creator states it _can_ be run locally)
Buzz looks like a more reasonable direction than this does.
> the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug.
This can only be correct when the application can’t affect anything outside the sandbox. Which would significantly restrict useful applications.
Thank you. The tweet values the readers time. The blog post. Dear lord. So much noise.
This was a great summation.
>This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.
Let me introduce you to scrapling+MCP--the closest I've come.
Stealthed, controllable browser gives you an API to arbitrary web things
You can't modify it, but you can extend it which imo is the next best thing
adb (Android) is close albeit a bit more tedious. It's fun watching an LLM take screenshots, read them, then send input events back to the phone.
If you have a rooted Android, you _can_ modify the apps. Xposed, ReVanced, et al subject to Play Integrity's ever growing pervasiveness
Oh, wow! This is a lot clearer to me. I've long had a soft spot in my heart about Sandstorm. Here's a comment[0] I made 11 years ago about what Sandstorm was, to me:
> I'm a web developer, but I can't really use my skills to provide an open source web app the way I'd like to. I'd like to build a small server-side budgeting app that people can use from their computers or phones to record expenses, but there's no way I can ask people to find a web host that lets them run rails, or set up a heroku account or whatever.
> So my only alternative would be to run the service myself, but then I'm storing other people's data, I have to worry about scaling if lots of people use it, and user accounts, and all this stuff.
> The idea of sandstorm is folks run this platform on their personal servers, and then it lets you browse an app store like interface and one-click install these server side apps. So I'd bundle up my budgeting rails app as a sandstorm package, and if someone wants to track their expenses from a variety of devices, they install the app. Now they're running it so the data is theirs, there's no scaling issues, and user authentication is provided by sandstorm.
It was a beautiful thing that tried to thread the needle between personal, self-hosted software and cloud-based "software as a service". I've long thought that "federated" software is the sweetspot, since it allows people to control software in more natural organizational units like families or communities, without being centrally controlled or devolving into the craziness that is "decentralized".
However, while the functionality of Cloudflare OS may be Sandstorm-inspired, I feel like it doesn't really have its soul. What a difference a decade makes! Here's another comment[1] from me 10 years ago about why I loved sandstorm, which begins:
> Oh no! I really believe sandstorm (or something like it) is what we need the future to be. Rather than having everything get sucked up into Google, Facebook, Apple, or these other few centralized services, imagine where everyone has a personal (or family, or church group or whatever) server, and they can one-click install their email apps, their document apps, etc.
These days Cloudflare has become one of the "Google, Facebook, Apple" that I mentioned. I'm still a fan of Cloudflare generally, and with kentonv behind this I absolutely have to try it out, but it doesn't have the open source, community-oriented charm that I think Sandstorm had.
edit: Oh, I didn't read far enough down the tweet chain:
> I am so proud to say, we are making this whole thing open source, Apache 2.0 license, no catch.
Hooray! Sandstorm's back on the menu, boys! This really does make me happy. I never should have doubted, ha.
You should probably add a disclaimer you work at Cloudflare yourself?
> I liked Kenton's take on this: https://x.com/KentonVarda/status/2084990137180590572
> What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
Yep, that's precisely the vision I formulated some months ago: https://manuel.kiessling.net/2025/11/04/what-if-software-shi...
I don't get it
How is this different than the capabilities which cowork by claude / chat gpt desktop apps now a days give in terms of core capabilities.
The fact that you can maybe fetch bugs from jira and present in the way you want is true for any of the agentic orchestrators, so is it really the USP ?
One difference I found against other orchestrators was that they work on a per seat billing model. Example if you have 10 team members who want access to a shared agent infrastructure, you would end up paying 10 * 20$ = 200$ per month while in this case it is probably just the AI and infrastructure bill that you have to spend, which probably might cross 200 dollars as well.
This is really interesting. I built a similar product (not released yet), but it uses Kubernetes as the infrastructure layer instead of Cloudflare OS. I guess all these years later I am left with the same existential question that plagued Sandstorm. What is its relevance in the context of Linux containers? This is not a rhetorical question, is there a real benefit for a Sandstorm grain over a docker style Linux container? Does a containerized process not have all the same benefits of a Sandstorm grain, with the added benefit of not requiring any modifications of the containerized software?
One argument I could bring is that despite all its claims, OpenAI still had to switch from containers to MicroVMs because its agents under test still managed to break out from their containers. Is the security model of a Sandstorm grain so much better that agents wouldn't figure out how to break out of it?