Cloudflare and Anthropic announced Cloudflare Environments for Claude Managed Agents—a Workers-based control plane that spins up a fresh, secure sandbox for every Claude agent session, runs custom tools as ordinary Worker functions, and applies enterprise security and compliance controls before the agent touches anything sensitive. The collaboration plugs Cloudflare's global network into the agent runtime Anthropic shipped at its May Dev Conference, and answers a question Claude Managed Agents has been hand-waving since launch: where exactly do these things run?
One Sandbox Per Session
The architecture is the part developers should read carefully. The Claude platform handles the core agent loop—planning, tool selection, reasoning—and Cloudflare's Workers platform handles execution. Every agent session gets its own ephemeral sandbox spun up by a Workers-based control plane, with isolation enforced by the same V8 isolate model that runs Cloudflare's existing edge compute. When the session ends, the sandbox is gone.
That's a meaningfully tighter trust boundary than "throw the agent at a long-lived container and hope nothing leaks." It also collapses cold-start time from container-startup territory to isolate-startup territory, which matters when agents spin up and tear down dozens of parallel runs across a session.
Custom Tools as Worker Functions
The capability that most directly affects developers is the customization surface. Teams can extend agent capabilities by writing simple JavaScript functions directly on the Cloudflare developer platform—the same Workers, Durable Objects, KV, R2, and D1 primitives they already use—and Claude agents pick them up as tools at runtime. There's no separate "agent SDK" to learn; the tool surface is the Workers surface.
Cloudflare positions this as "agents can create and execute their own tools on the fly within a secure, high-performance environment." In practice the more interesting pattern is the opposite direction: teams already running a Workers backend can expose existing endpoints as agent-callable tools with little more than a wrapper function. The tool layer is now mostly a packaging problem, not an integration project.
Security and Compliance, Globally
The enterprise framing is where the partnership earns its keep. Cloudflare's control plane applies security and compliance policies before the agent reaches a tool or a private network—WAF rules, Zero Trust access policies, geofencing, audit logging, and the existing Cloudflare One stack a security team has already approved. Private connections to internal systems route through the same identity and networking layer Cloudflare customers use for their non-AI traffic, with no new perimeter to defend.
Cloudflare's framing on the joint launch: agents need to be "more than just smart—they need to be secure and scalable." Anthropic's: "now, businesses can use Claude to execute code and reach private data securely." The combined posture lands one of the harder enterprise objections to deploying agents at scale—that the runtime is a fresh, opaque dependency outside the existing security review.
Where This Sits in the Market
This is the third major agent-runtime move in a month. OpenAI workspace agents run inside the OpenAI cloud. Gemini Managed Agents run in Google's own Linux sandboxes. Claude Managed Agents now have Cloudflare's edge network as their first-class execution surface—a different bet that leans on Cloudflare's existing developer footprint instead of building a new cloud from scratch.
It's also the latest beat in a Cloudflare-as-AI-runtime story that's been building since Workers AI added frontier-scale models in March, Dynamic Workflows shipped in May, and EmDash demonstrated a CMS built natively on the same primitives. The thesis is increasingly clear: every layer of the agent stack runs on Cloudflare, end to end.
Why It Matters for Web Developers
If you're already on Cloudflare, the integration story is small enough to ship this week. Existing Workers become agent tools by adding a description and registering them with Claude; existing Zero Trust policies cover the agent's reach the same way they cover your service traffic; the bill goes through your existing account. The procurement friction that has slowed agent rollouts at most enterprises is largely already done.
If you're not on Cloudflare, the more interesting takeaway is what this does to the agent runtime market. Anthropic just outsourced execution to a vendor with the largest edge footprint in the business rather than building its own. That decision pushes the differentiation in agent platforms further away from "whose runtime is fastest" and toward "whose model harness is smartest"—which is the competition Anthropic actually wants to fight.