Cloudflare now supports running Exo agents natively, leveraging Durable Objects for stateful coordination and Cloudflare Sandboxes for Linux‑based tooling. The change removes the need for the separate Agents SDK and lets teams define agents in Markdown, then launch them via Exo’s CLI or HTTP API.
Integration Model for Exo Agents
When an Exo agent is invoked, Cloudflare Durable Objects act as the conversation hub, persisting context across calls. Any required Linux utilities run inside a Cloudflare Sandbox, providing isolation from the broader platform. The agent definition itself is a simple Markdown file that includes a harness block pointing to an OpenAI model and credential reference.
Deployment Workflow
Adopting the new capability follows three concrete steps:
- Deploy the Cloudflare adapter supplied by the Exo project and configure it as the provider for the Cloudflare environment.
- Create an
openaivault credential in Cloudflare and reference it in the agent’s Markdown definition. - Run the agent with the Exo CLI, for example:
exo --provider cloudflare agent run --agent-file agent.md
The adapter is maintained independently of Cloudflare, so updates to the integration are sourced from the Exo project rather than the Cloudflare release cycle.
Operational and Security Implications
From an operations perspective, teams must now monitor two moving parts: the Cloudflare adapter lifecycle and the durability of the Durable Objects used for conversation state. Recovery behavior and upstream service configuration are documented in the Exo guide, and practitioners should validate that their state‑replication settings meet availability requirements.
Security considerations include handling the OpenAI vault credential securely within Cloudflare’s secret store and relying on the sandbox isolation model for any Linux tool execution. Because the Agents SDK is not required, the attack surface associated with that SDK is avoided, but the sandbox environment must still be treated as a separate execution domain.
Related CloudNinjas coverage: hands-on guides.
What This Means For Practitioners
Engineers can now embed LLM‑driven logic directly into Cloudflare workloads without adding a separate SDK layer, simplifying the stack and reducing latency. However, they must incorporate the adapter deployment into their CI/CD pipelines, ensure vault credentials are rotated according to policy, and verify that Durable Object state handling aligns with their resilience goals. Ongoing evaluation should focus on adapter version updates, sandbox resource limits, and any changes to the Exo recovery model that could affect service continuity.
