July 2026 Summaries

Kong Konnect's Metering & Billing system introduces prepaid credits as a strategic financial tool, offering businesses the advantage of collecting payments before consumption to safeguard margins against token-cost spikes and mitigate collections risks. The system's architecture is built on an immutable ledger that logs every financial transaction, ensuring transparency and preventing issues like double-charging or untraceable edits. By separating fiat payment from live consumption, it provides an audit trail crucial for revenue recognition, allowing businesses to choose between a 'Credits only' model or an 'Invoice overage' approach, depending on their financial strategy. The flexible credit system accommodates various settlement modes, prioritization of credit usage, and currency-specific balances, providing businesses with the ability to manage financial risk effectively and enhance customer engagement through promotional credits or negotiated rates. Konnect's implementation details, including the roles required for managing credits and the ability to handle multiple grants, underscore the system's robust design, aimed at ensuring financial integrity and strategic decision-making in credit management.

Shadow AI detection involves identifying and managing unsanctioned AI tools, models, and API integrations that employees deploy without security approval, posing significant risks to enterprise data security and compliance. Unlike shadow IT, which remains within a known perimeter, shadow AI routes live data such as customer records and source code to external models, leading to potential data exfiltration, compliance violations, and supply-chain vulnerabilities as illustrated by the Cordyceps disclosure. This detection requires visibility at the traffic layer, where AI calls happen, and is often implemented via an AI gateway, which serves as a control plane ensuring that every AI API request is visible, logged, and subject to policy enforcement, thereby transforming shadow AI from an invisible risk into a governed flow. The urgency of addressing shadow AI is highlighted by IBM's research indicating that 20% of breaches involve shadow AI, with such incidents adding significant costs to data breaches, and a large majority of AI-related breaches lacking proper access controls. Federated AI governance provides a framework where a central team sets baseline policies, and individual teams operate within these, ensuring consistent governance across multi-cloud and hybrid environments, which is crucial as AI adoption spreads across organizations.

Kong's AI Gateway addresses the challenges of integrating Enterprise-Managed Authorization (EMA) across Model Context Protocol (MCP) environments by acting as a bridge between clients and servers that are not yet EMA-ready. The introduction of the id-jag-relay plugin enables Kong to handle Identity Assertion JWT Authorization Grant (ID-JAG) exchanges, upgrading existing credentials and ensuring seamless connectivity without altering client or server architectures. This setup allows enterprises to centralize access policies at the Identity Provider (IdP) level, enhancing security and governance by maintaining an unbroken delegation chain and providing a comprehensive audit trail. By positioning itself at the network layer, Kong facilitates real-time visibility, reduces vulnerabilities, and accelerates the adoption of EMA, supporting a gradual transition for organizations with diverse technological infrastructures.

Enterprise AI adoption is rapidly increasing, with a significant number of organizations planning to boost their AI-related budgets. However, scaling AI from pilot projects to full production reveals challenges, particularly with direct LLM API integration, which creates fragility and complexity. A crucial decision for organizations is choosing between direct integration and using an AI gateway, the latter of which serves as a dedicated infrastructure layer that offers centralized management of routing, failover, rate limiting, authentication, observability, and policy enforcement. This approach minimizes the need for bespoke infrastructure for each provider and reduces migration efforts by up to 80%, making it more suitable for production environments that require security, compliance, and cost control. The AI gateway, distinct from a regular API gateway, addresses specific AI capabilities like semantic caching and prompt filtering, enabling companies to switch providers through configuration updates rather than code rewrites. As enterprise AI budgets are expected to rise significantly, centralized AI traffic management is becoming essential to avoid vendor lock-in, manage costs effectively, and ensure system resilience and observability.

In June 2026, two major AI agent platforms, Langflow and Dify, experienced significant security breaches, highlighting a critical gap between rapid deployment and security maturity in AI infrastructure. Langflow faced multiple vulnerabilities, including a severe unauthenticated remote code execution flaw, while Dify's issues involved cross-tenant data exposure and unauthorized API access, undermining its multi-tenant architecture's isolation guarantees. These incidents reflect a broader pattern seen in the early days of web applications, where initial fast-paced developments lacked robust security measures. The proposed solution mirrors the evolution of web application security, advocating for a gateway-level security layer, similar to Web Application Firewalls (WAFs), to enforce authentication, input validation, and rate limiting across AI agent interactions. Kong AI Gateway has been introduced to address these challenges, providing traffic-layer security controls to protect AI agents by enforcing identity verification, input filtering, and zero-trust principles, aiming to contain potential threats before they reach application logic. With AI agent traffic expanding rapidly, the importance of integrating such governance into AI infrastructure is underscored, echoing the historical shift in web application security practices.

In June 2026, the shutdown of Anthropic's Claude Fable 5 and Mythos 5 models highlighted the critical issue of AI vendor lock-in, as enterprises relying on these models faced immediate operational disruptions. This unexpected event underscored the broader risks associated with vendor concentration, where reliance on a single provider can lead to cascading failures across AI-powered systems. Organizations have traditionally underestimated the complexities of switching AI providers, which often require significant code and infrastructure changes. The solution lies in adopting an AI gateway architecture, exemplified by Kong AI Gateway, which facilitates multi-provider routing, automatic failover, and provider abstraction without altering application code. This approach ensures resilience and continuity by decoupling applications from specific model dependencies, allowing enterprises to manage AI resources with a single control plane for authentication, observability, and cost control. As AI vendor lock-in poses a real business continuity threat, enterprises are encouraged to implement robust infrastructure configurations to absorb provider changes seamlessly.

Kong Insomnia 13 introduces native integration with the Kong Konnect Gateway, enabling developers to query live gateway configurations directly from their terminals, thus ensuring tests align with the current deployed state without manual spec imports or outdated collections. This integration bridges a gap between API governance and development workflows, ensuring that testing aligns with live production configurations and extends governance coverage across the entire API lifecycle. By eliminating the need for separate exports and manual syncing, Insomnia 13 enhances testing fidelity, ensuring that routes, policies, and security rules are always up-to-date, reducing the risk of deployment failures caused by configuration drift. The Enterprise version of Insomnia 13 further bolsters governance and security features by including RBAC, SSO, data residency, and Git Sync at no extra cost, unlike its competitor Postman, which charges per user for similar capabilities. This integration not only improves testing accuracy but also maximizes the value of investments in the Kong Konnect platform by maintaining a single source of truth throughout the API development process.

Kong Konnect's prepaid credits system offers a strategic approach to managing AI-related costs and financial risks associated with usage-based products. By allowing customers to purchase credits upfront, businesses can stabilize their revenue streams and avoid the unpredictability of post-pay billing, especially when AI consumption can fluctuate dramatically. This system decouples the cost of tokens from the value customers spend, providing a buffer against sudden usage spikes and frequent model updates. Prepaid credits are stored in customer wallets and can be consumed via promotional, invoiced, or externally settled credits, each tied to a specific fiat currency to ensure consistency. This approach not only protects financial interests but also enhances customer flexibility, enabling them to adapt quickly to new AI capabilities without constant price adjustments. With promotional credits functioning as onboarding incentives or loyalty rewards, businesses can transform growth strategies into configurable tasks rather than complex engineering challenges, making prepaid credits an attractive option for AI companies seeking a robust metering and billing foundation.