New capabilities include a DNS filtering service from partner Control D, and Tailscale PAM, a privileged access management product.
Tailscale got its start back in 2019 as a VPN provider based on the open-source WireGuard technology. As it turns out, enabling private connectivity in the AI era has a lot of practical utility.
Tailscale raised $160 million last year to expand its WireGuard-based VPN platform and is now pushing well beyond that original VPN pitch with a series of announcements at its Tailscale Up conference last week. Tailscale ties access to a device or user identity rather than to an IP address, the way a traditional VPN tunnel does, and applies policy based on that identity to decide what it can reach. That capability is now a foundation for a series of new services that expand Tailscale’s reach.
New services include:
- DNS Filtering by Control D. A DNS filtering service from partner Control D, now sold and managed through existing Tailscale policy to block malicious and unapproved destinations.
- Tailscale PAM. A privileged access management product, now in beta, that adds credential injection and just-in-time access for sensitive infrastructure.
- Aperture. Tailscale’s AI gateway, reaching general availability, giving AI agents an identity and a set of guardrails.
- Aperture Plus. A browser-based access tool that works without installing Tailscale as a system-level VPN.
- Tailcat. An open source mesh network with no centralized control plane.
- Developer APIs and SDKs. New tools for building software directly on Tailscale’s identity layer.
In the opening keynote, Avery Pennarun, co-founder and CEO of Tailscale, framed the challenge that his company is now solving in the language of Greek myth. For him, there are a handful of large companies that control AI infrastructure, packaging it in expensive, vertically integrated systems that only they can control.
“Maybe it’s like Zeus, maybe they stole the fire from us in the first place,” Pennarun said. “So, together, we’re going to steal it back.”
Locking down privileged access and DNS
Connecting a device to a network is only half the problem. Something also has to decide what it can reach once it is connected. Two of this week’s announcements address that, one for DNS destinations and one for privileged infrastructure access on a tailnet, Tailscale’s term for a customer’s private network of connected devices and identities.
DNS Filtering by Control D packages an existing integration into a single purchase. Control D is a DNS filtering service that blocks malicious, phishing, and unapproved domains before a device connects to them. The new add-on lets customers apply Control D’s filtering profiles directly through Tailscale’s own policy engine, by user, group, tag, or device, rather than managing two separate consoles.
Tailscale PAM addresses a different piece of that problem: privileged access to specific infrastructure rather than DNS destinations. Tailscale acquired Border0 in March 2026, the technology behind Tailscale PAM. Tailscale PAM lets teams grant one-click access to specific servers, databases, Kubernetes clusters, and web applications, without handing out standing passwords or API keys. Every session, human or AI agent, gets logged and can be scoped to a specific time window for audits and compliance.
Aperture turns VPN identity into an AI gateway
Aperture is Tailscale’s AI gateway. It gives an AI agent an identity on a tailnet, the same way a device or a person already gets one, then routes that agent’s model calls and tool use through Tailscale’s private network instead of the open internet. That extends the same core idea behind Tailscale’s original VPN, identity-based access instead of network-based access, to AI agents specifically.
Aperture started ten months ago as a proxy that removed the need to distribute API keys to engineers and agents on a tailnet. It has since grown into a full AI gateway, with cost controls, guardrails, and a Model Context Protocol (MCP) proxy, logging every agent action for audit. At Tailscale Up, it reached general availability, adding token purchasing for open-weight and closed models and two new MCP endpoints that let Aperture and coding agents provision tailnet nodes and reach them over SSH.
“Tailscale access control rules are very much at play here, and Aperture, as well as any other agents, have to respect them,” Remy Guercio, product manager for Aperture at Tailscale explained. “So you can control exactly which machines can talk to Aperture and which Aperture can talk to.”.
A separate product, Aperture Plus, extends the same access model into a browser. It works without installing Tailscale as a system-level VPN, isolates each session, and lets a user run multiple workspaces connected to different tailnets at once.
Opening the platform with new APIs
The promise that Pennarun has for Tailscale vs the large industry titans is to open up access. That same promise extends into Tailscale, opening direct access to the tools that power its own products, rather than keeping them locked inside the company.
To that end, Tailscale introduced software development kits for Rust, Python, C, C++ and Elixir. A new Tailnet Creation API lets software spin up isolated tailnets automatically, for a continuous integration job or a temporary AI agent workspace. A companion feature, declarative tailnet sharing, lets administrators define sharing rules once, in policy, rather than approving each connection manually.
“So, today is about stealing fire from the gods and spreading it around equally for everyone,” Pennarun said.
