The web’s next workload doesn’t fit the old cloud model
Cloudflare has always built for the Internet as it exists, and as it is about to become. This week marks Agents Week, a push to prepare infrastructure for a fundamental shift in how software is used.
The cloud as we know it was shaped by the smartphone era. When billions of users came online, applications were scaled by adding more copies of a finite set of services. Kubernetes and containers became the default way to manage those copies, and the model worked: one instance could serve many users, and the total number of instances remained manageable.
Agents break that model. Unlike traditional applications, agents are one-to-one. Each agent is a unique instance serving one user and running one task. An agent needs its own execution environment where the LLM dictates the code path, calls tools dynamically, and persists until the task completes. A traditional app follows the same execution path for every user—like a restaurant with a fixed menu. An agent is a personal chef who needs different ingredients and techniques for each request. You cannot run a personal-chef service out of a restaurant kitchen.
Coding agents were the first to take off, typically spinning up full containers to give the LLM a filesystem, git, bash, and the ability to run arbitrary binaries. But as tools like Claude Cowork bring agents to less technical users, the scale math becomes sobering. If 100 million US knowledge workers each ran an agentic assistant at 15% concurrency, that is roughly 24 million simultaneous sessions. At 25–50 users per CPU, that demands 500K to 1M server CPUs—for the US alone, with one agent per person. Multiplying by several agents per person and over a billion knowledge workers worldwide puts the compute gap at orders of magnitude.
Isolates as the right primitive for billions of ephemeral tasks
Eight years ago, Cloudflare launched Workers, built on V8 isolates rather than containers. The motivation was practical: lightweight compute without cold starts. Isolates turned out to be an order of magnitude more efficient—faster to start, cheaper to run, and natively suited to the "spin up, execute, tear down" pattern.
Where containers give every agent a full commercial kitchen regardless of needs, isolates give each agent exactly the counter, burner, and knife required for a particular task. They start in milliseconds, are securely sandboxed, and you can run orders of magnitude more of them on the same hardware versus containers.
The Dynamic Workers open beta pushed this further: execution environments spun up at runtime, on demand. An isolate takes a few milliseconds to start and uses a few megabytes of memory—roughly 100x faster and up to 100x more memory-efficient than a container. You can start one for every request, run a snippet, and discard it, at millions per second.
Running each agent in its own container is expensive enough that agentic tools today are mostly limited to coding assistants. Isolates, by running orders of magnitude more efficiently, make per-unit economics viable at the scale agents require.
Transitional friction is normal
We are in the "horseless carriage" phase of agents. The first websites were digital brochures; the first mobile apps were shrunken desktop UIs. The same pattern is visible now: giving agents headless browsers to navigate human-facing websites when they need structured protocols like MCP to discover and invoke services directly. Many early MCP servers are thin wrappers around existing REST APIs when LLMs are better at writing code than making sequential tool calls. CAPTCHAs and behavioral fingerprinting ask "are you human?" when the right question is "which agent are you, who authorized you, and what are you allowed to do?" And full containers are being spun up for agents that just need to make a few API calls.
None of this is surprising. Paradigm shifts always carry old-model baggage while new infrastructure matures.
Bridging today and tomorrow
The Internet is always between two eras. IPv6 and IPv4 coexist; so do HTTP/2, HTTP/3, and TLS 1.2. The better technology exists while the old persists, and infrastructure must bridge both. Cloudflare has always been in that bridging business.
This week, container-based sandbox environments are going GA because coding agents genuinely need filesystems, git, bash, and arbitrary binary execution. Cloudflare is also going deeper on browser rendering for agents, since there will be a long tail of services that do not yet speak MCP. These are not stopgaps—they are part of a complete platform. Alongside them, Cloudflare is building the isolates, protocols, and identity models agents actually need.
Security built into the model
If agents will read email, operate on code, and interact with financial services, security has to be built into the execution model, not layered on after the fact. CISOs have confronted this first. Most agent deployments today are fraught with prompt injection, data exfiltration, unauthorized API access, and opaque tool usage. Securing the environment currently means stitching together credentials, network policies, and access controls never designed for autonomous software.
Cloudflare has built two platforms in parallel: a developer platform for building applications and a zero trust platform for securing access. Those audiences are converging. "How do I build this agent?" and "How do I make sure it's safe?" are increasingly the same question. The platforms are coming together so security is native to how agents run rather than a separate bolt-on layer.
New economics and governance for agent traffic
When agents consume content and APIs on behalf of users, the web's current economic model breaks down. That model is built on human attention—ads, paywalls, subscriptions. Agents have no attention. They do not see ads or click through cookie banners. If agents are to operate freely while publishers and creators are fairly compensated, new infrastructure is required. Cloudflare is building tools that make it easy for content owners to set and enforce policies for how agents interact with their content.
A platform for developers and their agents
The developer platform's job used to be purely about making it easy for humans to build, test, and ship. Increasingly, it is also about helping agents help humans. An agent should find the latest best practices, discover and invoke tools and CLIs, and move from writing code to deploying it seamlessly. This week's release includes improvements across both dimensions—for the humans building on Cloudflare and the agents running on it.
Open standards for the agentic era
Major Internet transitions have always required industry convergence on shared standards. Cloudflare has contributed to the IETF for over a decade on protocols like QUIC, TLS 1.3, and Encrypted Client Hello, and was a founding member of WinterTC for JavaScript runtime interoperability. The Workers runtime itself was open-sourced. The same approach now applies to the agentic era.
Cloudflare is part of the Linux Foundation and AAIF, pushing forward standards like MCP. Since Anthropic introduced MCP, Cloudflare has worked closely with them on infrastructure for remote MCP servers, open-sourced implementations, and made the protocol practical at scale. Alongside Coinbase, Cloudflare co-founded the x402 Foundation, an open standard reviving the dormant HTTP 402 status code to give agents a native way to pay for content and services. Agent identity, authorization, payment, and safety all need open standards that no single company can define alone.
