*AI spending will reach $2.59 trillion in 2026.*

I regularly like to share what we're seeing in production at Kong. Not projections or analyst forecasts, but actual traffic flowing through [_Kong AI Gateway_](https://konghq.com/products/kong-ai-gateway)_Kong AI Gateway_ from the largest enterprises in the world.

In the last nine months, **enterprise AI traffic as a share of total Kong platform traffic has grown 7x**. And that acceleration isn't slowing down. We see consistent week-over-week growth. We've processed trillions of tokens, going into quadrillions. 

The average API request per customer brings 7,087 tokens in the payload. These aren't all experiments. They're also production workloads. Real mission-critical systems.

*Organizations running AI grew nearly 30x in a year.*

But here's the thing that keeps coming up in customer conversations: **AI governance is almost nowhere to be seen.** While AI consumption and tokenmaxxing are exploding, AI governance is a ticking time bomb.

Many teams adopting AI the fastest are building up the biggest blind spots. Enterprises are building on infrastructure they can't see. Sound familiar? The pattern rhymes with cloud, and the window to avoid a painful rerun is open, but it's closing fast.

When looking at Kong AI Gateway request volume this year across several trillions of tokens, we can see concrete data to support something those in the weeds have known from day one: model share can shift with astonishing speed.

As of July 2026, the enterprise AI provider race is effectively a two-horse competition across Kong-connected organizations. **Anthropic's Claude family holds 49.9% of attributed AI request volume through Kong. OpenAI's GPT family holds 46.4%. **It was a different story in June 2026: Anthropic's Claude family held 56% of attributed AI request volume while OpenAI's GPT family held only 39%.

Seven months ago, GPT-4o was the standard. Then Claude 4 arrived and rewrote the leaderboard — overtaking GPT in March 2026 and widening the gap every month after — until July. Whether that's a blip or the beginning of a rebalancing, the data isn't settled.

Which providers and models are leading? It depends on how you measure it — and it can change quickly from month to month.

Claude dominates on output — nearly 69% of response tokens — reflecting the complex, long-context workloads enterprises are routing to it.

By raw request count, the picture is closer. Anthropic leads at 40%, with Azure at 39% and OpenAI direct at 13.8%. Azure's share is predominantly GPT traffic routed through Microsoft's enterprise infrastructure, meaning OpenAI's true footprint is considerably larger than its direct number implies.

Request tokens tell a different story again. Azure accounts for 71% of input token volume — a dramatic contrast to its 39% request share — suggesting a concentrated set of enterprise workloads are sending exceptionally large context windows through GPT on Azure. These could be RAG pipelines, agentic workflows, or document-intensive applications where the prompt itself is doing the heavy lifting.

The routing picture that emerges is this: enterprises are sending large inputs through Azure/GPT infrastructure and generating deep outputs through Claude, often via Bedrock. They're not choosing one provider — they're threading workloads across several simultaneously, through multiple infrastructure layers. Which is exactly the complexity that makes governance hard, and exactly what a control plane exists to make visible.

Enterprises aren't betting on one provider. 

**62% of organizations on Kong AI Gateway are running two or more models** in production simultaneously. 20% are running six or more. And, in an extreme example, one organization has proxied *602* distinct model identifiers, in what looks like a systematic model evaluation program running at production scale.

*Most enterprises run several models.*

Cost-sensitive tasks get routed to smaller, faster models. Complex reasoning goes to frontier models. Different business units pick different providers. And every time a new model generation arrives, the portfolio shifts again.

The org running 602 models is an extreme version of a universal enterprise problem. The practical consequence is that **without a control plane, every new model added multiplies the complexity of metering, monitoring, and governing usage.**

Of course, model adoption (and the number of models adopted) isn't uniform across industries.

*The number of models run varies by industry.*

In finance, Claude holds 97% of the top-5 token share in the vertical. The reason isn't an arbitrary preference. Finance workloads are long-context, complex, and high-governance. Claude's profile fits that. 

Then there are software companies. They lean heavily on GPT-5 Mini and the broader GPT family, optimizing for cost and speed. 

Industry shapes model choice. And model choice creates the governance surface that nobody's fully managing yet.

*Different verticals favor different models and providers.*

Discovery call after discovery call, enterprise after enterprise, the ask is the same. Organizations want for AI what they already have for APIs: token cost management, performance, reliability, observability, and security. These aren't exotic requests. They're the basics of running infrastructure responsibly.

And yet almost none of the AI traffic today has any of that attached.

Across organizations actively running AI through Kong, **less than 1% have any AI-specific governance controls in place**. No prompt guards. No request or response controls. No route-level policy. 

And **97.8% of those requests are going to third-party proprietary APIs** — every call carrying prompts, context, and sensitive data outside the company's own perimeter.

This is the "adopt-first-govern-later" posture of cloud from a decade ago all over again. What happened when teams spun up infrastructure faster than finance and IT could track it? Shadow IT became a problem. This wasn't the result of people being carelessl; it was because the tooling to govern it wasn't in place when adoption took off. Enterprises spent years catching up. 

The window to get ahead of this is open. It won't stay open.

The organizations in our data that are governing AI run the same three-part control stack — prompt-injection guards, request transformers, and response transformers — attached at the route level, on the path production traffic actually takes. Guardrails on inputs and outputs, enforced where the traffic flows. It's not complicated. It's just rare.

Everything we've covered above is the human-traffic version of this problem. Agents will make it exponentially harder.

**Agent API calls are currently growing at a 43–46% compound annual growth rate.** Human-initiated API traffic is growing at 3.1%. As agents go mainstream — when they're not just assisting humans but calling other agents to get work done — the governance surface doesn't grow linearly. It compounds.

Agents acting on a person's behalf need scoped authorization, not a single shared key. Enterprises are already asking us for visibility into agent activity before the solutions fully exist. That's not unusual — it's the same instinct that drove early API gateway adoption. They know what's coming. They want the control plane in place before the volume makes it impossible to retrofit.

Kong sits at the traffic layer. We always have. In the cloud-native era, the API gateway became the place where security, rate limiting, observability, and access control lived — not because that was the obvious architectural choice at the start, but because it was the only place where you could apply those controls consistently across every call or request without rebuilding them in every backend.

The same logic applies to AI. **The gateway acts as the control tower.** Observe and govern. It's the one place where token budgets, model routing, access policies, and cost visibility can be attached to every AI call — regardless of which model, which provider, or which team made the request.

The mountain pass is shifting from API calls to tokens and agents. The governance logic needs to shift with it.

*The AI gateway is becoming the AI control tower.*

AI is still a minority of enterprise activity — even among the most AI-forward industries on our platform. The highest vertical penetration we see is 17%. Software sits at 8%. That's not a reason to wait. It's the same early, governable moment cloud had and that so many enterprises squandered. 

Governance is much easier to implement now, while the complexity is relatively low. With each passing month, the level of complexity will increase, along with the challenge (and risk of exposure). 

For intelligence to move freely, it first has to be governed, secured, and made economically efficient. By leveraging Kong's decade of API expertise, the largest companies in the world are choosing our proven technology and API know-how to help them unleash agentic AI.

But the only way to do it is at the traffic layer. Where models, APIs, and agents connect.

Connectivity is the best place because you can see and govern all the dependencies at once. It acts as a unified “AI control tower.” 

Time to govern and unlock AI.