Blog

AI agents don't need to break in. That's the real problem.

AI agents don't need to break in to cause damage. When an agent is handed broad credentials for a narrow task, the identity layer can't tell the difference, and that's a structural problem with how access control was built.

I asked Claude to add auth to a Next.js app. Here's the exact prompt, and exactly what happened.

Next Zitadel preview: Control your login from code, starting in a minute

Authentication that starts locally in about a minute, then moves login flows, user schemas, and identity configuration closer to the application workflow, where developers and coding agents can inspect, review, and change them.

Theory, Practice, and AI: Our highlights from HackingLab Day 2026

ZITADEL joined HSG and Gobugfree at HackingLab Day 2026 to bridge the gap between academic theory and real-world security. From the ethics of hacking and AI vulnerabilities to high-stakes CTF challenges, we explored the evolving threat landscape. Read our highlights on why transparency, proactive incident response, and creative thinking are the keys to a resilient future.

Streamlining Our Terminology for a Sharper Developer Experience

No more naming inconsistencies. Explore ZITADEL’s comprehensive terminology update designed to reduce cognitive load and streamline your integration process without breaking existing APIs.

IMO: Open Source in the AI Era, why Risk Transfer Became the Product

AI is commoditizing code and collapsing the open source funnel. Discover how Zitadel uses AGPL 3.0 and "risk transfer" to build a sustainable model for infrastructure software in 2026.

Scaling Cloud-Native Identity: Optimizing Performance with Caching

Discover how Zitadel's Go-based architecture and flexible caching (Redis, Postgres, In-Memory) deliver low latency and reliability at scale for B2B SaaS

Relational Core, Event-Driven Soul: Evolving Zitadel for Scale

Why Zitadel is Moving Beyond Pure Event Sourcing. To solve the "Performance Wall" and operational complexity, Zitadel is refactoring its storage layer using the Repository Pattern and PostgreSQL. Learn how writing to relational tables first enables fast indexed queries and atomic API responses without losing time-travel forensics.

Breaking the Sandbox: Why ZITADEL Actions v2 Shifts to Cloud-Native Orchestration

ZITADEL is breaking the embedded extension sandbox. Learn about the shift to Actions v2, a cloud-native orchestration of programmable, event-driven webhooks that delivers polyglot support, production-grade reliability, and decoupled scaling for your identity system.

The Broken Promise of OIDC

OpenID Connect is supposed to be universal. So why does your auth integration keep crashing? We dive into the annoying reality of spec violations from major providers like Entra ID, Auth0, and Cognito, and how Zitadel solves them.

Building Trust with Transparency – Zitadel Achieves SOC 2 Type II

We are proud to share a big milestone in our mission to provide the most secure and developer-friendly identity infrastructure for modern B2B SaaS companies. Zitadel has officially achieved SOC 2 Type II certification! As an open-source solution built to solve complex multi-tenancy and authentication and authorization challenges, we know that security is the bedrock of your product. This attestation provides independent validation that our internal controls - protecting everything from secure logins to audit trails - are operating effectively.