A startup that was lost 10 years ago, saved by AI!

  It's the first time in the history of the world.

I have a collection of long texts, all of which I put on my reader.

Every week I browse arXiv and leave papers alongside me with labels.

The site I often see is always decoded and assigned a separate analyzer.

This is Jeremy Morrell, Chief Engineer of Cloudflare's "Exclusive Requirements", and he can't read the app on his hands.

What he wanted was that after he had said these words, a robot would squeeze out the corresponding bits of code and hang them on a good extension point that the software had reserved, and then run away on its own.

When you have finished, you can share it freely, and whoever wants to take it can take it away.

This is the ideal software in his mind: Extensible Software.

Morrell believes that the vast majority of web software we use today is static.

This static isn't about web technology, it's about changing its logic.

The functionality is written on the day of release and can only be used and cannot be changed.

AI has changed everything.

Everyone can change their app, it's no longer a dream.

The user says "add the functionality I want" and the computer adds it and the user says "nice". Morrell says this is the software he wants.

Because there's only one person in the world who wants you.

Developers have limited time and attention, so they only serve the largest user base.

Sometimes, even if they want to do it all, they can't.

The complexity of the interface is limited, and each addition of a function adds to it for people who don't need it.

If the audience for this feature is only a few hundred people, it makes it difficult to use the products of millions of others.

These two treaties are the dead ends that product managers have struggled to unravel over the past two decades.

The distribution of user needs for the map software. The left side is the navigation problem that everyone is asking, and the right side is the long tail is the different needs of everyone.

The little functionality you want in an app isn't impossible, it's inexpensive.

Over the past year, everything has changed since users gained the ability to code via vibe.

The cost of making a tool that only serves one person is so low that it is not worth mentioning.

Y Combinator's Pete Koomen pipeline is called Small Software.

Y Combinator talks about small software: These tools often serve only one person or a small group of people.

Accountants, doctors, lawyers, and thousands of other professions all have their own "small software".

Clearly, if you want more people to be smart, don't expect to turn them into engineers.

It's the software.

The code is well written, and the question arises: where to put it?

Nowadays, many web products are left to users by the word webhook, and the threshold is incredibly high: you have to run an entire set of independent services yourself, and you have to cope with all the disruptions that come with delivery.

It's hard to get the code to run on your system, but Morell thinks there are five ways to do it.

First round, the money.

Let's say you have a million users, and everyone has their own lines of code. If you give everyone a container, the bill won't even go down.

Morrell's criteria are: when the code is not called, the cost is about zero; once called, the price is squeezed to a few quarters of a cent.

In addition to compiling, storing files, keeping logs, how many users a single machine can fill, the entire memory costs an indicator.

The second switch, cold start.

On the critical path of the user code card to respond to a request, wait less than a minute for the container to start and the ideal value is one-digit milliseconds.

The third round, the limit.

You never know what users will write. Morrell tells the truth about what he heard on Heroku.

There was a very hot introductory lesson that hand-taught newcomers to deploy their first program online. The lesson consisted of two lines: a dead cycle, continuously printing hello world.

An app popped up in a vacuum, spitting out millions of lines of logs every second after it was born, never stopping.

The newcomer who follows the lesson, unaware of it, is still working on a real-time log, expecting something normal to roll up on the screen.

So how much CPU is used, how much memory is stored, how many network requests can be sent out, how large each request is, how much content can be returned, how many logs can be written in a second, each of which has a deadline.

The fourth lock, separated, has two floors.

Crashes, dead cycles, insane requests for memory that can't affect any other user. Malicious code can't escape, can't be traced to other tenants, and must be prevented from speculating and carrying out attacks like Spectrum.

Fifth, the code has to do something. The code that nothing can touch is useless.

How do you get the incredible code to work and not give it away?

Morrell has broken down three generations of solutions in the industry.

The first generation, directly to the API keys.

Morrell believes this flexibility is dangerous. Getting the key code, you can hand over the POST to a third party; even if it doesn't steal, your infrastructure can be taken to another DoS person at any time.

The second generation added a middle layer proxy.

The user receives an opaque token that is only valid for the agent; when the agent is validated, the authentic credentials are re-transmitted, followed by a whitelist and a limited stream.

It's actually more powerful than running barefoot, but it's costly to maintain. If you want to narrow down the permissions to allow only a portion of the operation, you have to filter the logic in the proxy, and you have to keep changing as the upstream API evolves.

Morrell puts an example in the text that is simply "reading an approved email" and the code is long and difficult to measure.

And this kind of logic is almost inconceivable. You never know what the user will do.

The third generation is the key: capability.

Without giving a key or an address, passing an existing function directly past, such as "take back the email that has already been approved", is the only thing that can be done.

The user's code has only these functions in its hands. The credentials have not entered its domain from start to finish, and even after receiving the data, there is no way to send it out.

The first two lines are the platform's own code, and the key is held here. The function below is the user-written code, which is not even the same as the key length.

There's also a side benefit: Giving a large model a definition of the ability to write a TypeScript is more accurate than storing JSON tokens in a bunch of OpenAPI formats.

So, the real threshold isn't for AI to write code, it's deciding what the code can hit.

If you can't write extensions, the answer was 20 years ago. The big model changes who can write.

Morrell lists four paths:

One of the simplest is an embedded interpreter: Lua, QuickJS, or just create one yourself.

It's called V8 Isolates.

Google has invested a lot of money and people in the security reinforcements of the V8, saving itself the use of its own wheels.

There are Dynamic Workers for Cloudflare, Isolated-vm for Node, Secure-exec for Rivet.

The third class is MicroVM.

It cuts off all the USB, graphics card and disk simulations in the whole virtual machine, leaving only the skeleton, isolating the hardest, running binary mode, full POSIX, and the cost is significantly higher.

Firecracker, libkrun are all in this one.

The fourth class is WASM plus WASI.

WebAssembly started out as a blank piece of paper, with no modules for sending HTTP requests, reading environment variables, and permission explicitly granted by the host.

From a security standpoint, this is the most beautiful starting point, and the cost is much more complicated than the tool chain.

These four are not interchangeable.

WASM can be run in V8 Isolates or in MicroVM. Even if you use V8 Isolates or WASM as an isolation boundary, MicroVM is equally useful in compiling packaging, testing and extending these links.

When Morrell first tried it out, he turned his static blog into a demo, mocking the "world's smallest vibe coding platform".

Essentially, it's a customizable crawler: give a URL that crawls the content back to the user code, along with several pre-allocated tools, and you can directly change the source code and run it.

Ten years ago, Kenton Varda, who is now the Chief Technology Officer of Cloudflare Workers, started a startup project called Sandstorm.io.

Its claims sounded a bit strange that year: every document you open runs in its own case of sandbox; the program doesn't get anything you didn't hand over in the past.

This project didn't work.

Varda later recalled the reason for the failure: no one had the patience to pack the software one by one manually into that sort of thing.

Ten years have passed. On August 5, 2026, Cloudflare reopened the suite with the Apache 2.0 protocol, called Cloudflare OS.

Cloudflare OS was released on August 5, 2026, under the Apache 2.0 protocol.

Varda wrote on X that day: "This is almost the culmination of my secret decade".

He added the patience he lacked that year.

OpenAI provides the codex's smart body framework in the Codex as a Platform box, saying almost the same thing:

Instead of letting each team move their child into a common coding assistant, it's better to embed the smartphone into the software they're already using.

It's all about engineering processes, operating discs, security investigations, customer controllers, and everything else.

The division of tasks is also clear: interface, business context, application boundaries for tools and approvals, intelligent body cycles and sandbox execution frameworks.

The example they did was using Relay, where they put a smartphone next to a freight dashboard and attached their own MCP tool, which had to be manually approved before being re-signed.

Many companies are now encouraging employees to make their own vibe coding a tool, the right direction and the trouble behind it.

How do you ensure that it only gets the part of the data that it needs? Who determines the scope of access to tokens, who turns around? Do you write customer information into third-party logs? What about the GDPR?

Morrell's answer was: Give them a place where no tokens can be leaked at all, and give the data access to the platform team to stick to compliance.

This is going to happen, and the product manager's life will change.

You don't have to cover all the long-tail needs, but you have to design stable extensions, capability interfaces, and a long-term commitment to compatibility.

Morrell has been in the platform business for almost a decade, and he hasn't said it lightly: the platform is difficult to design, difficult to operate, difficult to moderate. Exposure to the API means a lot of forward thinking and long-term support.

But he's still saying the two words: worth it.

Because you'll be shocked by the creativity of the users, and what they do is something you never imagined, even thought impossible.

After judging an app as bad, you might ask one more question: How much does it allow you to change?