January 2026 Summaries

In 2026, Rails applications face complex authentication challenges that go beyond traditional user passwords and sessions, as they now often serve APIs, power multi-tenant SaaS platforms, and meet strict enterprise security requirements. The article evaluates five authentication solutions for Rails: WorkOS, Devise, Rodauth, Auth0, and Sorcery, each with distinct philosophies ranging from managed platforms to Rails-native libraries. It emphasizes the importance of selecting an authentication solution that handles security primitives, supports multi-tenancy, integrates seamlessly with Rails, and offers robust observability and incident response capabilities. Developers are advised to choose an authentication provider that aligns with their long-term goals, whether building B2B SaaS or maintaining simplicity for smaller applications, as the right choice can significantly reduce maintenance burdens and enhance operational maturity.

WorkOS has introduced an AI-powered installer that simplifies the integration of AuthKit into projects with a single command, generating authentication scaffolding for frameworks like Next.js and React while securely managing credentials. The latest version of the WorkOS Node SDK now includes PKCE support for secure authentication in various applications and features enhanced compatibility with modern JavaScript environments. Additionally, WorkOS Pipes expands its provider integrations with nine new services, simplifying OAuth processes for developers. JWT Templates offer customization capabilities for JWTs in Connect applications, and audit logs now support log streaming to Microsoft Sentinel, facilitating integration with SIEM systems. The platform also hosts events and provides resources for managing API keys and understanding enterprise AI infrastructure.

xmcp, a TypeScript framework for creating and deploying MCP servers, now offers a seamless integration with the WorkOS AuthKit, enabling developers to incorporate robust, enterprise-level authentication swiftly. This integration is crucial for securing MCP servers, which provide AI clients with database access, API integrations, and more, by ensuring that only authorized users can interact with the server's resources. The @xmcp-dev/workos plugin facilitates the addition of comprehensive authentication features such as user management, social login, SSO, and audit logs, enhancing security and scalability for businesses. Developers can access authenticated user details and organizational data directly within MCP tools using functions like getSession() and getUser(), and leverage the full WorkOS SDK for advanced capabilities, including OAuth 2.0 with dynamic client registration and organization management. The setup process involves installing the plugin, configuring WorkOS settings, and integrating middleware, enabling MCP servers to require authentication and access detailed user contexts, thereby supporting organization-specific tools and audit logging functionalities.

Enterprise data residency has evolved from a simplistic model of data storage location to a more complex approach driven by the needs of modern SaaS and AI products, focusing on both data storage and processing. OpenAI exemplifies this shift by offering regional data residency and GPU inference options for Europe, while routing certain control-plane functions like authentication through the US. This trend reflects a broader industry move, as seen with companies like Slack and GitHub, toward a selective residency model that distinguishes between high-volume, sensitive customer content, which stays local, and low-volume control-plane operations that can be processed globally. The selective residency approach helps balance compliance with operational efficiency, addressing the challenges of full localization and global data processing. While this model satisfies most enterprise needs, some organizations with stringent regulatory requirements may still demand fully localized solutions. The evolving understanding of data residency prioritizes risk and volume over a one-size-fits-all strategy, allowing vendors to better meet customer expectations while minimizing operational complexity.

On January 26, 2026, MCP Apps was announced as the first official extension to the Model Context Protocol, significantly enhancing user interaction with AI assistants by allowing third-party applications to integrate interactive UI components directly within AI chat interfaces. This development represents a shift from purely text-based, conversational interactions to more dynamic and interactive experiences, enabling users to manipulate data, design, and other resources without leaving the chat environment. The technical infrastructure relies on UI resources declared by MCP servers and rendered by hosts in sandboxed iframes, facilitating secure interactions through auditable JSON-RPC messages. The initiative, supported by key industry players like Anthropic and OpenAI, aims to streamline workflows across platforms such as Claude, ChatGPT, and VS Code, minimizing context-switching and enhancing productivity. Security measures include iframe sandboxing, pre-declared templates, and user consent protocols to address potential risks of running third-party code. As the ecosystem evolves, enterprise adoption of MCP Apps will depend on the perceived value of integrated interfaces over traditional applications and the robustness of the security framework.

Tailscale is developing an AI gateway that addresses identity and access control challenges for AI agents operating at scale by leveraging the identity features built into its networking solution. Instead of distributing API keys across an organization, Tailscale's AI gateway centralizes this process, allowing only the gateway to require an API key while other components authenticate through their identity on the tailnet. This approach enables granular control and differentiation between human and bot activities, with the ability to apply specific policies based on user identity and roles. Tailscale's architecture introduces TSNet, a Go library allowing programs to connect directly to a tailnet, simplifying access and authorization processes for developers. Additionally, Tailscale is advancing the concept of using networks as sandboxes, offering features like multiple and ephemeral tailnets to provide isolated network environments for customers, effectively bringing single-tenant isolation to the network layer. This approach aims to enhance AI governance by integrating identity management within the network, offering a promising solution for balancing access and security in increasingly autonomous and distributed AI systems.

WorkOS Pipes simplifies the process of integrating third-party services into applications by managing OAuth flows, credential storage, and token refresh logic, allowing developers to focus on API calls with valid access tokens. The platform enables users to connect services like Google Drive, GitHub, and Slack to their apps without handling complex authentication processes. By configuring providers through the WorkOS dashboard and incorporating the Pipes widget into applications, developers can easily manage user accounts and access tokens. This setup provides a seamless way to integrate and retrieve data from external sources, with Pipes handling background token refreshes and authorization flows. As applications grow, Pipes offers scalability by allowing the addition of new providers and expanded access without revisiting OAuth infrastructure, making it a stable integration layer that adapts to evolving product needs.

React applications in 2026 encompass a range of architectures, including server-rendered frameworks, client-heavy SPAs, and hybrid models, making consistent authentication across these environments essential. With authentication impacting routing, server rendering, API access, and security, selecting the right provider is crucial for balancing security, developer experience, and operational needs. The article reviews five authentication solutions for React apps—WorkOS, Auth0, Auth.js, Supabase Auth, and Firebase Authentication—emphasizing their security features, integration quality, and enterprise capabilities. Key considerations for choosing an authentication provider include core authentication features, security compliance, React SDK quality, developer experience, multi-tenancy support, session management, scalability, reliability, and pricing models. Each solution offers distinct benefits depending on the application's specific needs, with WorkOS recommended for B2B SaaS and enterprise applications due to its robust enterprise features and security infrastructure.

WorkOS Pipes offers a streamlined solution for integrating third-party services into applications without the complexity of managing OAuth flows, token refresh logic, or credential storage. By using Pipes, developers can easily connect services like Google Calendar, GitHub, and Slack to their applications, allowing users to manage their accounts through a pre-built UI widget. The backend can request valid access tokens from WorkOS whenever it needs to call a provider API, with Pipes handling token refreshes in the background. This approach enables applications to access data without implementing OAuth redirect flows or storing refresh tokens, allowing developers to focus on API calls and expanding their integration capabilities. Through a simple setup process involving configuring providers in the WorkOS dashboard and adding the Pipes widget to applications, developers can quickly integrate new services and adapt as their application needs grow, making Pipes a flexible and scalable solution for managing third-party integrations.

TanStack Start is a robust full-stack React framework that integrates TanStack Router with server-side rendering, emphasizing server logic without sacrificing React's user-friendly attributes. This framework's architecture necessitates a rethinking of authentication, as it must function smoothly across both server and client lines. The text explores five authentication solutions suitable for TanStack Start applications in 2026: WorkOS, Better Auth, Auth.js, Supabase Auth, and Clerk, each offering distinct features and trade-offs. Key considerations in selecting an authentication provider include balancing security, developer experience, and performance, as well as ensuring compatibility with TanStack Start's flexible framework. WorkOS emerges as a preferred choice for B2B SaaS applications due to its ability to handle complex enterprise requirements such as SSO and SCIM provisioning, while other solutions like Better Auth and Lucia cater to developers seeking more control over their authentication stack. Ultimately, the choice of authentication solution is crucial for shaping an application's security, scalability, and appeal to enterprise customers, making it important to choose a provider that aligns with the application's future trajectory.

WorkOS Pipes offers a streamlined solution for applications needing to connect with third-party services by managing the complexities of OAuth flows, token refresh logic, and credential storage. It allows users to securely connect accounts from services such as Linear, GitHub, Slack, and Google to their applications without the need to build OAuth infrastructure. Developers can use the Pipes widget to enable users to manage their connections, while WorkOS handles the backend processes of obtaining and refreshing access tokens, ensuring applications can easily fetch data from connected services. By integrating with WorkOS Pipes, applications can focus on making API calls using valid access tokens without dealing with the underlying OAuth implementation, allowing for scalable and flexible integration of various data sources as the application grows.

By 2026, deploying Next.js applications is rapid, but establishing a secure session strategy remains complex, highlighting the need for robust authentication solutions. The article examines five top authentication options tailored for Next.js: WorkOS AuthKit, Auth0, NextAuth.js, Supabase Auth, and AWS Cognito, emphasizing the importance of choosing an auth provider that aligns with Next.js's server-driven and distributed nature. It suggests evaluating auth infrastructure based on security, developer experience, enterprise readiness, and future-proofing capabilities like phishing resistance, MFA, and passkeys. WorkOS AuthKit stands out for its Next.js-native approach, focusing on server-validated, cookie-based sessions and seamless integration, while Auth0 offers flexibility with a mature ecosystem, albeit with potential complexity. NextAuth.js provides control but requires handling security details, Supabase Auth integrates well with its stack but may require additional setups for enterprise needs, and AWS Cognito is best for AWS-centric environments, although it can involve substantial policy and permission management. Ultimately, the choice should prioritize minimizing ongoing auth maintenance while maintaining robust security.

WorkOS Pipes simplifies the integration of third-party services into applications by managing OAuth flows, token refresh logic, and credential storage, allowing developers to focus on building features rather than handling complex authentication processes. By using WorkOS Pipes, developers can configure providers like GitHub, Slack, and Google through the WorkOS dashboard, enabling users to connect their accounts via a pre-built UI widget. The backend can then request access tokens from WorkOS as needed to call provider APIs, ensuring seamless data retrieval without manual OAuth implementation. The tutorial demonstrates how to use Pipes to connect a Node app to GitHub, allowing it to list repositories for authenticated users, and highlights the ease of expanding this setup to include additional providers and data types. This approach offers a scalable and maintainable solution for integrating various external data sources, positioning WorkOS Pipes as a versatile tool for developers seeking to streamline their app's third-party integrations.

Integrating automated user provisioning alongside Single Sign-On (SSO) is crucial for enterprise applications, as it eliminates the delays and security risks associated with manual account management. This tutorial guides users through syncing users from Okta into a Laravel application using the System for Cross-domain Identity Management (SCIM) protocol facilitated by WorkOS. Following the setup process, which involves installing the WorkOS Laravel SDK, configuring Okta connections, and syncing users and groups, ensures real-time synchronization of user data between the identity provider and the application. The tutorial also provides options for consuming synchronization events through either the WorkOS Events API or webhooks, ensuring that applications remain updated with the latest directory changes. Additionally, optional steps detail how to stream these events to Datadog for enhanced monitoring and analysis, and provide methods to retrieve specific user or group information. This comprehensive setup allows for seamless user management and integration of enterprise features like SSO within a Laravel app, with recommendations to stay current with evolving product features.

WorkOS operates as a product engineering organization, developing infrastructure for SaaS companies to integrate enterprise features such as SSO, Directory Sync, and RBAC, with engineers being central to both product development and customer interaction. Engineering leadership at WorkOS diverges from traditional models, emphasizing a flat structure where every engineer has direct access to the CEO, with engineering managers owning specific product areas and actively participating in product definition, execution, and quality assurance. This model requires engineering managers to possess a blend of technical expertise, product insight, team-building skills, and adaptability, as they are responsible for the strategy, technical architecture, and team health within their product areas. The organization places a high value on customer proximity, collaboration, and a strong developer experience, adapting processes as the company grows and navigates new domains like AI infrastructure. This approach fosters a dynamic leadership environment focused on impact and judgment, appealing to those who thrive on product ownership and direct involvement in shaping strategy and driving product adoption.

Pipes is a solution designed to simplify the integration process with third-party services by managing the complex OAuth flows and token management on behalf of developers. It offers a straightforward API and widget that allow applications to connect to various data sources without the need for intricate authorization infrastructure, handling tasks such as secure token storage, automatic refreshes, and provider-specific configurations. This is particularly beneficial for applications that require data from multiple sources, like AI applications or project management tools, as it allows developers to focus on features rather than integration logistics. Pipes supports a range of popular services, including GitHub, Google, and Slack, and is equipped with shared credentials for easier development and testing, although developers will need to configure their own OAuth applications for production use. By decoupling authentication from integration, Pipes provides flexibility in how users can authorize specific services, offering a user-friendly experience via its embeddable widget, and ensuring secure and efficient management of access tokens without the need for developers to handle these backend details themselves.

The text outlines a guide for integrating Single Sign-On (SSO) into an existing authentication system using the WorkOS standalone SSO API. It emphasizes the complexity and challenges of implementing SSO, particularly with diverse Identity Providers (IdPs) like Okta, Microsoft Entra ID, and others that require different configurations and maintenance. The guide highlights the pitfalls of custom-building SSO solutions, such as the intricacies of SAML, challenging debugging processes, and security vulnerabilities. Instead, it advocates for using WorkOS to streamline SSO integration, allowing applications to support multiple IdPs with a single integration that abstracts the complexities of different authentication protocols. This approach maintains the existing auth system and simplifies the process, enabling businesses to efficiently support enterprise clients' SSO requirements without becoming entangled in the technical complexities of IdP compatibility.

Laravel, a PHP framework created by Taylor Otwell in 2011, has grown significantly from a side project into a robust ecosystem with a team of 90 people. Initially built as a comprehensive framework for full-stack web applications, Laravel introduced Laravel Forge in 2013, a deployment platform that quickly gained traction and allowed Otwell to focus full-time on Laravel by 2015. Despite PHP's mixed reputation, Laravel has thrived, benefiting from PHP's evolution in speed, type safety, and security. In recent years, the introduction of Laravel Cloud, a fully managed deployment platform, marks a strategic move upmarket to cater to enterprises and existing users with complex infrastructure needs. Additionally, the framework's maturity has enabled the development of an MCP server that leverages large language models (LLMs) to efficiently generate Laravel code, illustrating the framework's adaptability to new technological trends. The interview highlights the challenges new frameworks face in gaining traction without pre-existing training data for LLMs, contrasting with established frameworks like Laravel and Tailwind CSS that naturally fit into the AI-driven development landscape.

Latacora offers a unique approach to security for startups by providing a fractional expert model that integrates deep expertise across various specializations, such as cryptography and cloud security, into a company's security team. This model allows startups access to specialized knowledge that would be financially unfeasible to hire full-time. By embedding themselves for long-term engagements, Latacora can influence architectural decisions that prevent future security issues, as illustrated by their work with WorkOS over several years. The company has harnessed AI advancements, particularly with Claude 3.5 Sonnet, to democratize access to their sophisticated internal tools, enabling team members to query complex data in natural language. Latacora recognizes three fronts in AI security: protecting AI features within products, using AI tools like ChatGPT for company processes, and defending against AI-enhanced phishing and social engineering attacks, which have become more sophisticated over time. This interview took place at AWS re:Invent 2025.

Incident.io is an incident management platform that emphasizes the importance of rapid response to inevitable software failures, drawing inspiration from the adage "Move fast when you break things." The platform is particularly favored by WorkOS and clients like OpenAI due to its seamless integration with Slack, allowing for immediate incident creation and response, which includes paging engineers and coordinating customer communications. This approach marks a departure from traditional quarterly incident management towards a continuous, responsive model, where incidents are seen as indicators of success due to their significance in operations. Incident.io's AI capabilities aim to streamline incident management with features like AI-generated summaries and root cause analysis, though they faced challenges in creating an effective system, highlighting the complexity of developing reliable AI tools. The platform's evolution reflects a broader industry shift towards frequent, manageable deployments and proactive incident handling.

Zack Kanter, who previously sold an auto parts company, founded Stedi to modernize the outdated Electronic Data Interchange (EDI) systems that underpin global supply chains. EDI, an essential but largely invisible system used by major retailers like Walmart and Amazon, facilitates the exchange of structured data such as purchase orders and invoices. Despite its critical role, EDI technology has not evolved significantly from its 1970s origins, leaving a vast market underserved with legacy systems that are slow to adapt. Stedi aims to transform EDI by offering modern, API-based infrastructure that aligns with contemporary developer expectations for clean, easily integrable solutions. Built entirely on AWS, Stedi leverages the cloud platform's capabilities for scalability and simplicity, appealing to developers who have grown accustomed to the seamless experiences offered by modern tech companies like Stripe and Twilio. The interview highlights Zack's enthusiasm for AWS technologies and his vision for making EDI integration as straightforward as any other API process.

Brian Scanlan, Senior Principal Engineer at Intercom, shares how the company transitioned from AI skepticism to embracing AI as a core strategy, particularly in customer support, after experimenting with GPT technology. Initially dismissing GPT as a fad, Intercom found that integrating it with their customer support data led to a dramatic improvement in AI-generated responses. Their AI agent, Fin, now resolves 86% of customer conversations in some deployments without human intervention, showcasing the effectiveness of large language models (LLMs) in retrieving and synthesizing information from help articles. This shift means human agents can focus on complex, relationship-building tasks, enhancing both customer satisfaction and the quality of work for support teams. Intercom has since made a significant investment in AI, reorganizing their engineering and product teams around AI capabilities, and has signed over 40,000 Fin customers, indicating the success of their strategic pivot.

Sam Lambert, with two decades of experience in scaling relational databases, shares insights from his work at GitHub and PlanetScale, a company built on the MySQL sharding solution Vitess. Despite MySQL's technical strengths, Postgres is gaining popularity due to sociological factors like Oracle's poor stewardship and Heroku's user-friendly platform. Postgres's developer-friendly features, though, come with security risks, prompting companies like Amazon and PlanetScale to validate secure extensions. PlanetScale, known for simplifying database operations, recently introduced a $5 tier to accommodate developers' preference for cost-effective, single-node setups over more expensive high-availability options. Lambert also highlights the rapid data growth in AI companies, with PlanetScale supporting these demands by focusing on providing a reliable database service rather than chasing trends. This approach aligns with Lambert's philosophy of building solid infrastructure tools, allowing the market to seek them out naturally.

Ajay Kulkarni, CEO and co-founder of Tiger Data, discusses the significant transformation within his company and the tech industry as a result of AI advancements, particularly through the use of tools like Claude Code. Tiger Data, originally focused on time series data using Postgres, is now adapting to a future where a large portion of code is generated by AI agents, leading to changes in how developer tools are designed and used. Kulkarni emphasizes the importance of designing database systems that can quickly adapt, parallelize, and provide on-demand information retrieval for AI agents. He highlights the success of Tiger Data's internally developed AI Slack bot, Eon, which quickly gained widespread adoption within the company, showcasing the shift towards AI-driven interfaces and the broader impact on productivity across various departments. The interview at AWS re:Invent 2025 reveals how the focus has shifted from big data and cloud computing to AI, suggesting a new era of innovation driven by AI's integration into user interfaces and workflows, echoing Naval Ravikant's statement that "AI is the new UI."

Andrew Qu, a key figure at Vercel with a background in Google's AMP project, highlights the transformative impact of AI on developer productivity and behavior, observing that AI tools significantly enhance development velocity and efficiency, bringing the concept of a "10x developer" closer to reality. Vercel's AI SDK is experiencing rapid growth, and the company emphasizes the importance of high-quality documentation as a competitive advantage, as it enhances AI-generated code quality and promotes a cycle of adoption and investment. In the realm of web development frameworks, Next.js and React are dominating, with AI further solidifying their positions due to the abundance of training data available for them. Looking ahead to 2026, Vercel is focusing on integrating AI features to improve the developer experience, leveraging its position as an intermediary between developers and production to build valuable AI-driven tools for smarter debugging and performance optimization.

AI-driven development is rapidly transforming the tech landscape, as evidenced by the growing reliance on AI agents like Claude Code, which are increasingly responsible for writing significant portions of code and resolving customer interactions autonomously. This shift is not just theoretical; companies are experiencing tangible productivity boosts, with AI tools helping developers achieve unprecedented levels of efficiency. The quality of documentation has emerged as a key competitive advantage, enhancing the effectiveness of AI-generated code, and positioning pre-AI companies like Vercel and Laravel to thrive in the current environment. Open-source AI models are closing the gap with proprietary ones, expanding use cases and driving industry-wide innovation. Enterprises, traditionally slow to adopt new technologies, are now actively seeking AI solutions, accelerating the pace of enterprise-level deployment. Meanwhile, AI security has become a crucial area of focus, with sophisticated phishing campaigns challenging outdated security protocols. Continuous incident management is replacing sporadic crisis responses, reflecting a shift towards more agile and routine operational practices. These insights, drawn from interviews with industry leaders at AWS re:Invent 2025, highlight the profound and ongoing impact of AI on the tech industry.

Kyle Galbraith, CEO and founder of Depot, has been attending AWS re:Invent for six years, witnessing its growth and observing the increasing strain AI places on software delivery pipelines. Depot, initially focused on accelerating Docker image builds in CI environments, expanded post-Y Combinator 2023 into broader build acceleration tools, addressing new bottlenecks in the CI/CD process driven by AI's exponential code production. Galbraith emphasizes the importance of treating CI/CD as a production system requiring optimization and understanding, particularly as the October AWS outage revealed hidden dependencies in build systems. Depot prioritizes correctness over performance, ensuring transparency and trust in build optimizations, and introduces monitoring for outbound network traffic to prevent data exfiltration during builds. With a focus on API-first solutions, Galbraith highlights the flexibility and composability of developer tools, favoring infrastructure talks at re:Invent for insights into AWS's approach to redundancy and reliability, and enjoying company-sponsored happy hours for informal knowledge exchange.

Eric Bernhardsson, formerly of Spotify, identified a gap in traditional infrastructure for AI applications, leading him to create Modal, a platform optimized for compute-intensive workloads with GPU support. Unlike traditional setups, Modal offers a more efficient alternative to Kubernetes and Docker by dynamically scaling GPU capacity and speeding up container deployment. This flexibility is particularly beneficial for the unpredictable demand in AI inference, allowing rapid access to thousands of GPUs. Although early-stage AI startups currently generate the most revenue, Bernhardsson anticipates significant growth from digital-native companies and eventually enterprises like Bank of America. Modal's diverse customer base includes applications from weather forecasting to biotech, highlighting its adaptability across various industries. As an infrastructure provider, Modal's approach allows it to grow alongside emerging AI applications without needing to predict which will succeed.

Cleric, co-founded by William Pienaar, addresses the challenges of incident diagnosis in engineering with an AI Site Reliability Engineer (SRE) designed to handle the initial stages of diagnosing system issues. The development of Cleric was motivated by the increasing cognitive load faced by engineers as systems grow in complexity, contrasted with the sublinear improvements in AI capabilities, which offer larger context windows and faster reasoning. Cleric's AI excels at tasks involving semantic data such as logs and traces but struggles with interpreting raw metrics, requiring visual rendering and human intervention to correct the AI's tendency to jump to conclusions. The company has found that human-AI collaboration within the first five minutes of investigation yields better results than prolonged autonomous operation, as this approach allows engineers to provide real-time course corrections. Cleric's use of sub-agents helps manage context overload, and their system accumulates tribal knowledge to improve future incident responses. The firm advocates for a nuanced approach to AI autonomy, suggesting that while AI can handle straightforward tasks independently, complex problems still require human oversight. The increasing acceptance of AI agents in the software development lifecycle marks a shift from skepticism to integration, with Cleric aiming to expand its AI capabilities beyond incident diagnosis to alleviate the operational burdens on engineering teams.

JSON Web Tokens (JWTs) are compact, URL-safe tokens used for securely transmitting information between systems, making them ideal for distributed environments like APIs and single-page applications. They consist of three parts: a header that specifies the signing algorithm, a payload containing claims about the user or service, and a signature that ensures token integrity. JWTs are widely used to assert user identity and permissions without requiring a centralized database lookup, although they must be handled carefully to avoid security pitfalls. In JavaScript applications, libraries like "jose" are recommended for parsing, validating, and managing JWTs, emphasizing best practices such as verifying signatures, using JSON Web Key Sets (JWKS) for efficient key management, and enforcing strict token validation protocols. While JWTs offer a self-contained mechanism for authentication and authorization, ensuring their secure implementation involves managing cryptographic keys, handling token expiration, and preventing misuse by avoiding sensitive data exposure. Moreover, services like WorkOS provide robust solutions for managing authentication flows, integrating Single Sign-On (SSO), and handling the complexities associated with issuing and verifying JWTs, allowing developers to focus on building scalable applications without delving into the intricacies of authentication stacks.

Philip Kiely from Baseten highlights his company's role in powering AI workloads, emphasizing their expertise in utilizing GPUs to deploy and accelerate AI models efficiently. Baseten supports various companies, including Cursor, Notion, and healthcare AI firms, with a focus on the increasing influence of open source models, which have rapidly closed the gap with closed source counterparts in capability and cost-effectiveness. Kiely draws parallels between the evolution of AI models and operating systems, suggesting that open source models will dominate due to their flexibility and scalability. He notes the significant contribution of Chinese research labs to open source models, despite geopolitical challenges affecting hardware compatibility. As AI companies mature, they shift from relying on foundation models to developing in-house solutions to manage costs and gain competitive edges, with Baseten observing an emerging trend toward voice-based AI applications. The industry is evolving rapidly, with innovative applications like World Labs' text-to-3D world generation showcasing the potential for real-time immersive experiences, illustrating a promising future for AI-driven technologies.

At AWS re:Invent 2025, Paul, the founder of Browserbase, highlighted the transformative potential of AI in automating mundane tasks that consume significant work hours, such as Nancy's gas price research at a dairy company, now managed by an AI using Browserbase. This innovation underscores the value of AI not in flashy demonstrations but in efficiently handling everyday tasks through web browsers, which are often challenging to run securely and reliably in cloud environments. Browserbase's open-source framework, Stagehand, translates natural language intents into browser commands, enabling AI to adapt to changes in web interfaces and perform tasks like automatic form filling and business verification. Despite current limitations, Paul predicts significant advancements in AI-enabled browser automation by 2026, driven by major AI lab investments, with a focus on improving customer support and software engineering. Browserbase's internal metric, measuring years of human browsing time saved, reflects the increasing efficiency brought by these technologies, marking the beginning of a broader shift towards AI-assisted workflows.

Ronak Desai, CEO and founder of Ciroos, has leveraged his experience in building startups and expertise in observability to create a multi-agent AI system designed to reduce the mean time to repair in complex IT environments. Ciroos aims to improve incident response by deploying specialized agents across different domains such as network, security, and application performance, bringing intelligence directly to the data sources rather than relying on a centralized platform. The system provides preemptive insights into incidents, identifying root causes and suggesting remediation steps while maintaining a human in the loop to make final decisions, with a trajectory towards greater autonomy. The rapid development and deployment of Ciroos in enterprise settings have been facilitated by advanced AI tools, Desai's return to coding, and a mature SaaS ecosystem, resulting in significant interest from large enterprises and smaller startups alike. Large companies see AI as a way to bridge staffing gaps and enhance the quality of investigations, while smaller companies benefit from adopting best practices without hiring dedicated specialists. This interview took place at AWS re:Invent 2025, highlighting Ciroos's surprising traction across different business sizes.

Ben Gilbert and David Rosenthal, hosts of the Acquired podcast, discussed the exponential growth of their audience and evolving focus from acquisitions to covering major companies like Nvidia, Costco, and Google, emphasizing the uniqueness of successful companies that define rather than follow markets. They highlighted the significant role of luck and skill in success, comparing it to maxing out attributes in a video game, while also noting Nvidia's strategic positioning as an example of blending preparation with opportunity. The current AI era presents unique opportunities for startups, with enterprises eager to adopt new AI tools, creating a demand shift not seen in previous startup generations. They also explored the leadership paradox in AI giants like Anthropic and OpenAI, questioning whether these companies can institutionalize their founders' DNA, much like Apple and Microsoft did, despite having relatively new leadership teams. This discussion took place at AWS re:Invent 2025.

Forrest Brazeal, co-founder of Freeman & Forrest, discusses the challenges and opportunities in the modern software development landscape, particularly in the realm of AI-driven solutions. While AI has lowered barriers to entry for building software products, the true bottlenecks lie in policy, process, and certifications, which require human expertise and cannot be automated. This creates pressure on developers to deliver quickly, often without adequate time to ensure enterprise readiness, such as authentication and security. Brazeal highlights the benefits of partnering with companies like WorkOS, which provide pre-built infrastructure solutions for complex problems like identity management, allowing businesses to scale confidently without reinventing the wheel. He emphasizes that while AI advancements are significant, foundational elements like authentication and authorization remain critical and demand rigorous attention, aligning with the metaphor of operating systems as essential yet often overlooked components that enable innovation.

The Model Context Protocol (MCP) initially followed a straightforward request-response model where servers expose tools and large language models (LLMs) decide when to use them, but as it entered production, limitations emerged, prompting extensions to enhance collaboration while maintaining explicit control. The protocol introduced collaborative patterns like sampling, URL-mode elicitation, and form-mode elicitation to address issues such as handling sensitive authentication flows, resolving ambiguities, and incorporating server intelligence without compromising user input and oversight. Sampling allows servers to engage LLMs for reasoning and validation, URL-mode elicitation ensures secure interactions outside the protocol for sensitive tasks, and form-mode elicitation clarifies ambiguities with structured user input. An ongoing debate within the MCP community explores the potential for bidirectional tool calls, which would allow servers to proactively initiate interactions, raising questions about trust, consent, and predictability. As MCP evolves, it seeks to enhance structured collaboration without granting full autonomy to servers, gradually shifting towards a model where servers, models, and users collaboratively shape workflows while carefully balancing the risks and benefits of expanded server capabilities.

In the OAuth 2.0 and OpenID Connect ecosystems, private_key_jwt serves as a more secure client authentication method compared to the traditional client_secret approach. This method involves the client proving its identity by signing a JSON Web Token (JWT) with its private key, which the server then verifies using the client's registered public key. This approach enhances security by eliminating the need to send reusable credentials over the network and by making it difficult for attackers to forge valid assertions without access to the private key. The private_key_jwt method is particularly beneficial in environments where the risk of credential leakage is high, as it provides stronger cryptographic assurance and reduces the impact of potential breaches. However, it requires careful management of key lifecycles, synchronization of system clocks, and proper distribution of public keys. While private_key_jwt is advantageous for production systems handling sensitive data, simpler client_secret methods may suffice for low-risk or early-stage projects. Understanding the strengths of private_key_jwt allows organizations to make informed decisions about its implementation based on their specific security needs.

The Model Context Protocol (MCP) utilizes elicitation to request user input during active sessions, allowing workflows to be interactive rather than restricted to single tool calls. Traditional elicitation involves collecting structured data directly through the MCP client, which works well for simple, non-sensitive inputs but is inadequate for interactions involving sensitive information like OAuth authorization or payment details. To address this gap, URL-mode elicitation enables MCP servers to guide users to external URLs for secure and trusted interactions, ensuring that sensitive data remains outside the MCP client and model context. This approach requires explicit client capability declarations to support URL-mode elicitation, which acts as a blocking control-flow step, ensuring critical interactions are completed securely. While form mode and URL mode serve different purposes, both are integral to MCP’s execution model, allowing for secure, real-world workflows that integrate automated reasoning, server-side orchestration, and human interaction, without compromising security. As MCP adoption grows, URL-mode elicitation is expected to become essential in bridging AI workflows with external systems, enhancing security and protocol consistency.

Fireworks.ai positions itself as a leading provider of AI inference infrastructure, emphasizing the shift from training large models to delivering cost-effective, fast, and reliable model serving under real-world conditions. Founded by experienced infrastructure engineers, including former PyTorch team leader Lin Qiao, the company focuses on optimizing inference operations, tackling challenges like latency, traffic unpredictability, and cost constraints. Fireworks offers a comprehensive stack that includes serverless inference, on-demand deployments, and enterprise solutions, catering to diverse needs from quick AI feature deployment to stringent enterprise requirements. The company also highlights its "FireAttention" stack and the f1 compound system for dynamic model routing, showcasing improvements over traditional setups. In a competitive landscape, Fireworks aims to distinguish itself by providing optimized serving stacks for common inference patterns, easing the burden on developers by allowing them to deploy AI features without managing complex GPU operations. Their strategy hinges on the increasing viability of open models for production tasks, with a focus on efficient tuning, evaluation, and system operations to bridge the gap between open-model innovation and deployment.

RAG (Retrieval-Augmented Generation) systems face challenges in scaling authorization for document access due to high-cardinality resources resulting from breaking down documents into numerous components. Traditional fine-grained authorization (FGA) systems, which rely on relationship graphs, become bottlenecks because they require syncing every document with an external authorization system, leading to operational fragility. To address these issues, a scalable approach combines hierarchical authorization with local metadata filtering, whereby access is granted at the level of collections, workspaces, or folders, and documents inherit this access. This method involves registering stable parent resources and assigning roles at this level, while filtering is conducted locally by the vector database optimized for high-cardinality operations. This approach maintains a small and stable authorization graph while enabling the vector store to handle scaling. For applications that require document-level permissions, specific documents can be registered as resources under this framework, with document-level authorization as the exception rather than the norm. The strategy allows for starting with simple role-based access control and integrating resource hierarchies as the application grows, avoiding the need for significant rewrites or migrations.

Onboarding in B2B SaaS is a complex and ongoing process that involves more than just initial setup; it requires a holistic approach that adapts as organizations evolve. The process begins with technical decision-makers who configure enterprise requirements like authentication and access control, often through manual and time-consuming methods. However, platforms like WorkOS offer a self-serve, admin-first experience through their Admin Portal, allowing IT teams to independently manage features such as Single Sign-On and directory sync, which streamlines initial setup and reduces operational overhead. Following this, user adoption focuses on integrating employees into the system, which can be facilitated through methods like email invitations, Just-in-Time provisioning, and domain policies. These approaches ensure a smooth, scalable onboarding experience that aligns with organizational growth and lifecycle changes. By anchoring onboarding to organizations rather than individual users, WorkOS enables efficient lifecycle management, minimizing manual intervention and enhancing security. The integration of an admin-focused portal with an organization-centered user model allows for seamless onboarding that builds trust and scales naturally over time, making the entire process more manageable for both the provider and the customer.

The journey of developing AI applications often begins with a focus on model selection and optimization, but as these apps gain traction and move into enterprise environments, the focus shifts to infrastructure and security concerns. This transition involves addressing complex issues such as authentication, authorization, multi-tenancy, user provisioning, and real-time protection, which are essential for integrating, authenticating, and authorizing within enterprise systems. These components form an invisible infrastructure stack that ensures the AI app can scale, operate securely, and meet enterprise requirements, necessitating features like enterprise SSO, SCIM for user management, and audit logs for accountability. WorkOS offers pre-built infrastructure solutions that help developers quickly achieve enterprise readiness, enabling them to focus on product differentiation without being bogged down by the intricacies of building and maintaining these essential systems in-house. This approach is crucial in a rapidly evolving market where meeting enterprise standards quickly can be a significant competitive advantage.

WorkOS offers a suite of tools designed to streamline third-party integrations and enhance authentication processes for developers. Pipes enables users to securely connect third-party accounts, such as GitHub and Slack, to applications without needing to handle OAuth flows or credential storage. The introduction of multiple roles for Single Sign-On (SSO) and Directory Sync allows users to receive a combination of roles based on identity provider group memberships. AuthKit for Platforms permits developers to embed authentication features within platform apps, reducing friction and facilitating the creation of production-ready applications. The new Feature Flag Management API allows developers to programmatically manage feature flags as part of application workflows. WorkOS has achieved PCI DSS compliance, indicating adherence to relevant security standards. Additionally, the platform offers a variety of resources, including recordings from MCP Night and insights into using Vercel as an authentication provider with AuthKit.

In early implementations, the lack of a standard for authorization in MCP (Managed Cloud Platform) led to insecure practices, such as manually configuring credentials and relying on Dynamic Client Registration (DCR), which introduced vulnerabilities like registration endpoint abuse and Server-Side Request Forgery (SSRF). Enterprise Identity Providers (IdPs) like Okta and Azure AD disabled DCR by default due to its security risks, prompting a shift towards more secure solutions. The June 2025 revision introduced Protected Resource Metadata, allowing MCP servers to specify which authorization server to use, thereby enhancing security and eliminating the need for client registration. By November 2025, the introduction of Client ID Metadata Document (CIMD) further secured the system by requiring clients to host their metadata at controllable URLs, allowing authentication servers to verify identities without exposing registration endpoints. This approach streamlines the security model, where clients assert their identity and authorization servers verify it, while MCP servers focus solely on token validation, representing a significant advancement in securing MCP environments by 2026.

Enterprise customers, often perceived as resistant to change, can adapt quickly when necessary, such as during security incidents or regulatory deadlines. The challenge lies not in customer adaptability but in how changes are communicated and coordinated internally, with factors like enablement materials and launch timing often causing delays. Feature flags emerge as a strategic tool, allowing companies to manage change by controlling feature visibility based on customer segment, thus balancing speed with the stability that enterprise clients require. This approach enables accelerated shipping of features without disrupting existing workflows, as features can be gradually rolled out, tested, and adjusted according to specific customer needs and feedback. By integrating feature flags into their authentication flow, companies can manage feature deployment effectively, ensuring that new features are accessible to the right segments at the right time, mitigating risks associated with rapid iteration. The shift towards using feature flags as a change management strategy separates deployment from availability, allowing features to reach production when ready while aligning customer-facing rollouts with business priorities.