From human clicks to agentic velocity: What OpenAI’s 1.2 billion scale means for your auth
The New Stack Damon Tepe
OpenAI says ChatGPT hit 1.2 billion weekly users, and the hidden problem is auth at insane scale. Every click can become many checks, so old identity systems can turn into the bottleneck.
Based on reporting by The New Stack, Damon Tepe — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
OpenAI’s DevDay headline was the user count: ChatGPT has passed 1.2 billion weekly active users. That’s the number everyone notices. The less glamorous part is what has to happen before the model says a single word: request authentication, token validation, permission checks, and session handling, all without slowing the system down.
The New Stack’s angle is blunt: at this size, identity stops being a back-office concern and becomes infrastructure. OpenAI reportedly uses Ory for its authentication stack, leaning on a decoupled setup built around OAuth2 and OIDC. The appeal is obvious. Instead of dragging every request through central identity lookups, the system can verify sessions at the edge with lightweight cryptographic checks and local caching.
That matters even more once software shifts from human clicks to autonomous agents. A single user action can fan out into dozens of sub-tasks, API calls, and database queries. Each one can demand another validation step. The article argues that this is where legacy identity platforms start to bend: centralized round-trips add latency, and database contention starts to pile up.
The comparison is not subtle. Traditional identity SaaS is described as multi-tenant, rate-limited, and tied to vendor-controlled data stores. The composable model pushed here is the opposite: self-hosted, edge-native, and built to run in a customer’s own infrastructure. Ory’s stack is presented as a set of separate pieces — identity storage, OAuth2 token issuance, and fine-grained access control — rather than one monolithic system.
The other shift is security posture. For autonomous agents, the article says the safer move is to observe first, then lock things down. That means fingerprinting machine credentials, tracing what agents actually do, and using scoped token exchange so an agent only gets the permissions it needs. OpenAI’s scale may be the headline, but the real message is simpler: if auth can’t keep up, the rest of the AI system doesn’t matter much.
My take — AI-written commentary, not fact-checked reporting
This is the part of AI infrastructure people keep pretending is boring until it breaks. Agent systems don’t just need smarter models; they need identity stacks that don’t fall over the moment the workload stops looking like a normal web app. The old “security as a checkbox” habit is dying, and good riddance.
Read more about this at: The New Stack