October 2025 Summaries

The 5th Annual Kong Hackathon, held during the API Summit 2025, showcased innovative projects centered around agentic AI, which autonomously takes initiative to solve real-world problems. Participants connected intelligent agents with real-world infrastructure through the Kong AI Gateway, resulting in practical and production-ready solutions. The top three winning projects included a Session History Plugin that enhances context-aware AI sessions, an AgenticAI-MCP-client for integrating Model Context Protocol with Kong, and a Kong auto rollback AI agent for improving DevOps workflows. Special awards were given for Best Agentic Project, Most Creative Project, and Best Solo Project, highlighting the diversity and creativity of the entries. The hackathon celebrated technical excellence and real-world impact, reflecting the innovative spirit of Kong’s developer community, with thanks extended to mentors, judges, and contributors for their support.

H&M has shifted its approach to generative AI by transforming it from a series of isolated experiments into a centralized infrastructure through its Generative AI Gateway. By using Kong Gateway, H&M created a unified control plane that addresses security, operational, and financial challenges associated with AI adoption, ensuring consistent compliance and reducing redundant work across teams. This centralized platform allows for significant reductions in time-to-market for new AI features, improved cost management through rate-limiting and routing, and enhanced security and compliance by providing 100% centralized logging and auditability. By prioritizing the establishment of a robust infrastructure before expanding AI initiatives, H&M has positioned itself to scale AI across the organization while avoiding common pitfalls like technical debt and fragmented security. This "platform-first" strategy not only democratizes access to AI tools but also ensures safe and rapid experimentation, setting a precedence for enterprise AI governance.

Amid the race to innovate with AI, businesses are facing significant financial challenges due to poorly managed AI infrastructure costs, as highlighted in the 2025 State of AI Cost Governance Report by Mavvrik. The report reveals that 84% of companies experience over a 6% reduction in gross margins from AI-related expenses, with many lacking visibility and precision in forecasting these costs. This issue is exacerbated by fragmented AI infrastructures, which span multiple environments and vendors, leading to a lack of unified cost reporting and governance. The report emphasizes the necessity for a unified AI cost governance layer, such as the proposed solution with Konnect Metering and Billing, which offers real-time cost visibility, usage attribution, and limit enforcement. This approach aims to help businesses maintain profitability while continuing to innovate, by ensuring operational excellence and cost efficiency as key differentiators in the competitive AI landscape.

API Summit 2025 has concluded, but AWS re:Invent 2025 is on the horizon, offering numerous opportunities to engage with Kong, a leader in API management and AI connectivity. Scheduled from December 1–5 in Las Vegas, the event will feature Kong's participation in executive meetings and community discussions on modern API and AI strategies. Attendees can look forward to scheduled demos at Kong's Booth #143, exclusive after-hours events, and one-on-one meetings with Kong executives. A notable session, "Building Infra for the Agentic Internet," will be presented by Kong's Alex Drag and Michael Field on December 4, examining the infrastructure required for the emerging agentic era. A Kong study highlights that 90% of organizations are already adopting AI agents, with 80% expecting full-scale adoption within three years, emphasizing the need for robust connectivity, control, and security layers to support AI agents as they transform interactions with information and services.

As companies rush to integrate AI into their operations, a significant challenge emerges in the form of escalating costs that threaten to erode profit margins, as highlighted in the 2025 State of AI Cost Governance Report by Mavvrik. The report reveals that 84% of companies experience more than a 6% reduction in gross margin due to AI costs, with many underestimating these expenses due to a lack of comprehensive visibility and accurate forecasting. The complexity of managing AI-related expenses is exacerbated by the use of multiple vendors and environments, leading to fragmented governance and hidden costs, such as LLM API consumption. To address these issues, businesses are urged to establish a unified AI cost governance framework that ensures real-time visibility and control over AI expenses, enabling them to maintain competitive margins and operational efficiency. Solutions like OpenMeter integrated with the Konnect platform offer potential pathways to achieve unified cost management, providing tools for real-time metering, billing, and usage attribution across diverse AI infrastructures.

In January 2025, the OAuth 2.0 Security Best Current Practice was solidified as RFC 9700, highlighting the evolution of APIs from developer tools to essential infrastructure in regulated industries. A significant gap persists between API adoption and AI readiness, as only 25% of organizations operate fully API-first despite widespread API usage. The API landscape is being reshaped by six key trends: architectural evolution beyond REST, convergence towards machine-readable standards, the shift of security requirements to mandates, increasing regulatory demands, commercialization of network APIs, and the growing integration of AI. Regulations now require healthcare and financial institutions to implement APIs for interoperability and data access, fundamentally altering business approaches to data exchange. Security practices have also evolved, with RFC 9700 mandating secure OAuth 2.0 flows, and the introduction of FAPI 2.0 setting new standards for financial-grade API security. AI agents, which are underused in API design, present unique challenges that necessitate redesigning APIs for machine interaction and introducing new security models. Organizations must adapt rapidly to these shifts or risk obsolescence, as APIs become central to digital infrastructure, requiring comprehensive strategies that integrate multi-protocol support, compliance-first architecture, and AI readiness.

The 2025 Kong Innovator Awards recognized organizations across various industries for their innovative use of APIs and AI to solve significant business challenges. Winners like SeatGeek, Siemens, and Seaco demonstrated how Kong's API infrastructure can enhance security, streamline operations, and modernize legacy systems. SeatGeek focused on AI security at scale; Siemens leveraged event-driven architectures for greater data accessibility; and Seaco modernized shipping communications with real-time APIs. Other winners, including HM Revenue & Customs and Verifone, showcased how API management can improve governance, reduce costs, and unify global operations. BMW's shift to a distributed architecture for connected vehicles highlighted the importance of visionary leadership in driving technical innovation. United Airlines' decade-long digital transformation emphasized the need for reliable, scalable API management in complex industries. These achievements underscore how leveraging Kong's API solutions can drive transformation, efficiency, and innovation across diverse sectors.

API Summit 2025 in New York City was a pivotal event where experts in APIs and AI convened to explore the role of APIs in advancing AI connectivity and the emergence of the "agentic era." With APIs acting as neural pathways in AI systems, the summit highlighted how organizations are increasingly adopting AI agents, with a significant shift toward immediate and intelligent experiences. The event featured key discussions on AI integration, data quality, and infrastructure, emphasizing the necessity for businesses to adapt to this paradigm shift or risk obsolescence. Kong introduced several innovations, including the Kong Konnect platform for unified API and AI management, and highlighted the launch of tools aimed at monetizing AI and improving API governance. Notable speakers, such as Ray Kurzweil and Cassie Kozyrkov, shared insights on AI's future while the event also recognized various companies and partners for their innovative use of Kong’s technologies. The summit underscored the importance of a unified approach to managing digital assets and API traffic to ensure organizations are prepared for the evolving landscape of AI and connectivity.

Kong Gateway has introduced kongctl, a new CLI tool designed for declarative management of Konnect products, inspired by existing infrastructure-as-code tools like Terraform and AWS CLI. While the traditional deck CLI remains a preferred tool for configuring Kong Gateway, kongctl aims to provide a more comprehensive solution by supporting Control Planes, Developer Portals, and eventually all Konnect products. The tool incorporates features such as profile support for configuration management, an imperative command pattern inspired by kubectl, and a GitHub-like api subcommand for API exploration. It also includes an interactive AI assistant, Kai, for managing Konnect infrastructure through conversational interface. While kongctl is set to expand in functionality, deck will continue to be supported, ensuring users have a variety of options for configuration and management.

Kong has introduced a new suite of Konnect MCP support and products, including an enterprise-grade MCP Gateway and additional workflow support in the Konnect Developer Portal, alongside the new MCP Composer. These innovations aim to streamline API access and integration for AI coding tools and agents, enabling seamless interaction with APIs directly from development environments. The Konnect Developer Portal can now be transformed into an MCP server, facilitating API discovery and access through natural language, significantly enhancing developer velocity by reducing the time to generate production-ready client code. Additionally, Kong has launched KAi, an agentic assistant designed to automate tasks like API governance, debugging, and design, further leveraging AI for enterprise automation. Looking ahead, Kong plans to replace traditional integration patterns with MCP-powered solutions, including the upcoming AI Composer and AI Runner, which will allow organizations to design and run AI-powered integrations, positioning Konnect as the future platform for API and AI connectivity.

Kong AI Gateway 3.12 addresses critical challenges in the adoption of the Model Context Protocol (MCP) by introducing solutions for server consistency, authentication, and workflow costs in AI environments. This release aims to standardize MCP server generation, providing organizations with a way to transform existing API infrastructure into MCP-compatible tools without code, thereby reducing governance risks and costs. The new OAuth 2.1 implementation aligns with the recent MCP specification, enhancing security by centralizing authentication at the gateway level. Additionally, the release offers enhanced observability tools to track MCP server performance, usage patterns, and resource consumption, ensuring efficient and secure operations. Beyond MCP, Kong AI Gateway also expands its functionality with features like "LLM as a Judge" for improving AI output quality and Google's Model Armor integration for heightened AI security, catering to both MCP and LLM use cases in enterprise AI deployments.

Kong is introducing a new solution, Konnect Metering and Billing, to address the challenges of monetizing APIs and AI workloads as digital assets transition from cost centers to revenue sources. This new capability, integrated into the Kong Konnect API platform, leverages technology from OpenMeter to offer real-time, reliable usage metering and flexible pricing without the need for extensive coding. The platform facilitates seamless monetization by allowing businesses to productize and effectively charge for APIs, AI models, and data streams, providing comprehensive visibility and control over usage and costs. It supports diverse pricing models, from usage-based pricing to credits, and simplifies billing with automated invoicing, enhancing operational efficiency and enabling rapid market adaptation. The solution aims to empower organizations to optimize revenue realization strategies, reduce engineering effort on custom billing solutions, and capitalize on market potential through advanced metering and billing capabilities.

Volcano SDK, an open-source TypeScript software development kit, streamlines the process of building AI agents by combining large language model (LLM) reasoning with real-world actions through MCP tools, reducing the need for extensive code. It enables developers to create workflows with as few as nine lines of code, automatically managing tool schemas, context flow, provider switching, and error handling. This SDK supports multi-provider setups, allowing different LLMs like GPT-5 and Claude to interact seamlessly within a single workflow, enhancing productivity with its simple, chainable, and production-ready design. Volcano SDK's approach prioritizes the automatic discovery and utilization of MCP tools, offering a type-safe, intuitive, and efficient framework for developing AI agents that can perform tasks such as data analysis and report generation, ultimately fulfilling its goal of simplifying the creation of multi-step workflows that integrate diverse LLMs and tools.

Insomnia v12 introduces AI-powered features aimed at enhancing API development by ensuring reliability and efficiency, particularly in handling commits and testing MCP servers. The AI Commit capability streamlines the process of writing commit messages, allowing developers to focus on coding while maintaining a clear and consistent git history. Additionally, the new MCP Client offers a unified interface for validating MCP servers, preventing potential workflow failures and ensuring APIs are production-ready. Insomnia also addresses dependency bottlenecks with natural language-driven Mock Server generation, enabling developers to simulate APIs instantly and continue building without delays. At the upcoming API Summit 2025, attendees can experience these innovations firsthand, explore workshops on scalable security and governance models, and learn about the competitive edge offered by trustworthy API infrastructure in the agentic economy.

Kong has been recognized as a Leader in the Gartner Magic Quadrant for API Management for the sixth consecutive year and has been positioned furthest on the Completeness of Vision axis for the second year. This recognition underscores Kong's commitment to providing a unified API platform that delivers fast, reliable, and secure digital experiences for its customers. The Gartner Magic Quadrant evaluates vendors based on Completeness of Vision and Ability to Execute, providing insights into a market's direction and maturity. API management solutions support all stages of an API's life cycle, enabling organizations to effectively manage and secure their APIs. Kong aims to empower companies for the agentic era by promoting an "API-first" approach, supporting over 700 organizations globally in enhancing developer productivity through a comprehensive platform for APIs, AI, events, and microservices. While the Gartner report recognizes Kong's leadership, it also clarifies that Gartner does not endorse any specific vendor, and its research reflects the opinions of its research organization.

The 2025 Gartner Magic Quadrant for API Management report highlights Kong's continued leadership in the sector, emphasizing its product innovation and market responsiveness. Kong has maintained its position in the "Leader" quadrant for six consecutive years, showcasing its strengths in areas like LLM, MCP, and event streaming support. The report suggests a convergence of API Management and Integration, driven by AI, which Kong interprets as a transition towards what it terms "AI connectivity." This new approach aims to address integration challenges by enabling seamless connectivity between AI applications and their resource needs, thereby advancing Kong's vision of becoming an AI connectivity platform. As the market evolves, Kong sees AI success as fundamentally linked to integration and connectivity, prompting the company to focus on developing solutions that align with these trends. The organization invites stakeholders to explore these developments further at their upcoming API Summit.

Kong Konnect has introduced the Konnect Flows Editor, an enhanced visual tool powered by Datakit, to streamline API orchestration by providing a graphical interface for designing workflows. This tool caters to teams that prefer visual representations over traditional configuration files, offering an intuitive way to build, understand, and collaborate on API workflows. The Flow Editor represents workflows as diagrams, making it easier for new team members to onboard, facilitating cross-functional collaboration, and allowing rapid prototyping of different orchestration approaches. It complements the existing Datakit plugin by allowing teams to visually design policy flows and data transformations, providing flexibility for organizations to choose the method that best suits their preferences and workflows. The Konnect Flows Editor will be showcased at the upcoming API Summit 2025, highlighting its potential to enhance API management through a visual approach.

APIs play a crucial role in modern enterprises by facilitating innovation, enhancing security, and reducing operational costs, yet they often come with complexities, particularly concerning security. Organizations frequently use fragmented systems for API management and identity management, leading to operational inefficiencies and security risks. Kong Konnect aims to address these challenges by integrating API and identity management into a single platform, offering a streamlined approach to machine-to-machine security. This integration is achieved through Kong Identity, which employs the OAuth 2.0 standard with OpenID Connect to offload authentication and authorization to the API gateway. This approach reduces backend load, maintains a consistent security posture, and simplifies service logic, allowing organizations to manage API access with precision and control. By consolidating these functions, Kong Konnect provides a unified framework that enables faster innovation, improved security, and a better developer experience. The API Summit 2025 will explore these advancements, showcasing how enterprises can modernize their architecture and secure their APIs through a unified platform.

Kong Champion Sachin Ghumbre describes the transformation of a complex Generative AI (GenAI) application from facing operational challenges to achieving streamlined control using Kong AI Gateway. Initially, the GenAI-powered agent, deployed with a Flask API backend, faced issues such as high LLM usage costs, security vulnerabilities, limited observability, and difficulties in maintaining and scaling the infrastructure. By integrating Kong Gateway, which offers features like secure key management, prompt guard plugins, semantic routing, caching, and observability, Ghumbre was able to centralize control and secure LLM APIs, optimize token usage, prevent prompt injection, and simplify orchestration of the Retrieval-Augmented Generation (RAG) pipeline. The architecture, developed on AWS, leverages Kong Gateway to manage interactions with internal services and external LLM providers, demonstrating how Kong's AI Gateway serves as a comprehensive control layer for modern AI workloads by addressing the unique demands of scaling, securing, and monitoring GenAI solutions.

Konnect Service Catalog is addressing the challenges of managing disparate API deployments across multiple gateways by introducing a native AWS integration, which facilitates the discovery and cataloging of APIs within AWS API Gateway. This integration enhances visibility and access for both human and AI consumers, which is crucial as Gartner predicts a significant shift towards non-developer API consumption and API monetization driven by AI agents by 2028 and 2029, respectively. The Service Catalog integrates with platforms like GitHub, GitLab, and SwaggerHub, centralizing API resources for better discoverability and allowing agents to access and utilize them effectively. Additionally, the platform offers scorecards to automate compliance and governance, ensuring that APIs meet organizational standards regarding security, team assignments, and observability. This capability extends to AWS-discovered APIs, offering a comprehensive tool for managing API governance and security. The upcoming API Summit 2025 will further explore these topics, providing insights into API and AI strategy in the evolving digital landscape.

Microservices architectures present unique security challenges due to their distributed nature, increasing the attack surface and complexity in managing endpoints and services. Traditional security tools, designed for monolithic systems, often fail to address the intricacies of microservices, such as API-specific attacks and internal service-to-service communication. The proliferation of APIs leads to shadow APIs and configuration chaos, necessitating modern security solutions like Zero Trust architecture, service mesh, and automated secret management to mitigate risks. Effective strategies include deploying API gateways for centralized control, employing mutual TLS for secure communications, and integrating security into CI/CD pipelines through DevSecOps practices. These approaches ensure that vulnerabilities are addressed early, and consistent security policies are enforced across all services. Organizations that adopt these methods can better manage their security posture in a microservices environment, reducing risks associated with data leakage, resource exhaustion, and human error, ultimately securing their systems and maintaining trust with their customers.

Kong Operator 2.0 is an integrated Kubernetes offering that unifies Kong Ingress Controller and Kong Gateway Operator, simplifying the deployment, management, configuration, and upgrades of Kong Gateway instances on Kubernetes. The update introduces a new ControlPlane resource that streamlines controller configuration by allowing settings to be applied at the Control Plane level, reducing complexity and improving security by embedding Kong Ingress Controller instances directly within the operator's process. This change eliminates the need for cluster-wide privileges for each deployment, thus simplifying role-based configurations and enhancing security. The update also deprecates TCPIngress and UDPIngress custom resources in favor of the Gateway API, aligning with the broader Kubernetes ecosystem and reducing configuration fragmentation. While these changes mark a significant improvement, Kong Operator 2.1 will further expand support for the Kubernetes Gateway API to Konnect control planes, enhancing integration with the Kong API ecosystem.