What's New in Laravel 13: AI SDK, Vector Search & Beautiful UI

Laravel 13 dropped on March 17, 2026 — and this is not an incremental update. Taylor Otwell announced it at Laracon EU with a tagline that says it all: "The clean stack for Artisans and agents."

The headline is the first-party AI SDK going stable, but there's a lot more here. Native vector search in the query builder. First-party JSON:API resources. 36 new PHP attributes that let you configure models, jobs, and commands declaratively. Redesigned starter kits with shadcn. And a CSRF overhaul that most developers won't even notice (in a good way).

We've been running Laravel in production for over 11 years at Treesha Infotech — it powers the majority of our backend systems and projects. Here's everything that matters, what we think about each feature, and what it means for your projects.

In This Article

• Laravel AI SDK — Agents, Embeddings & Multi-Agent Workflows
• Native Vector Search in the Query Builder
• Beautiful Starter Kits with shadcn
• First-Party JSON:API Resources
• 36 New PHP Attributes
• Modern CSRF Protection (PreventRequestForgery)
• Other Notable Features
• Upgrade Guide
• Our Take — What This Means for Laravel Projects

Laravel AI SDK — The Headline Feature

The AI SDK (laravel/ai) was in beta during Laravel 12, but it shipped as stable and production-ready with Laravel 13. This is the biggest addition to the framework in years.

It's a unified, provider-agnostic API for everything AI: text generation, image generation, audio synthesis and transcription, embeddings, vector stores, and reranking. One interface, swap providers by changing a config value.

Supported Providers

Agents

This is the core concept. An Agent is a dedicated PHP class that encapsulates instructions, tools, and output schema. Think of it as a specialized assistant that lives in your codebase.

1php artisan make:agent SalesCoach

1use Laravel\Ai\Agent;
2
3class SalesCoach extends Agent
4{
5    protected string $model = 'claude-sonnet-4-5-20250514';
6
7    protected string $instructions = 'You are an expert sales coach...';
8
9    public function tools(): array
10    {
11        return [new FetchCRMData, new AnalyzeCallRecording];
12    }
13}
14
15// Usage
16$response = SalesCoach::make()->prompt('Analyze this sales call transcript...');

Agents can return structured output (typed arrays), remember conversations across requests, stream responses in real-time, and even broadcast to WebSocket channels.

One-Line AI Calls

For quick tasks, you don't need a full Agent class:

1// Text
2$response = Ai::prompt('Summarize this article', system: 'Be concise.');
3
4// Image
5$image = Ai::image()->prompt('A minimalist logo for a tech company')->generate();
6
7// Audio
8$audio = Ai::audio()->text('Welcome to our platform.')->generate();
9
10// Embeddings
11$embeddings = Str::of('Laravel is a PHP framework.')->toEmbeddings();

Multi-Agent Workflows

Laravel 13 ships with five multi-agent patterns straight from Anthropic's research: Prompt Chaining, Routing, Parallelization, Orchestrator-Workers, and Evaluator-Optimizer. All work natively with Laravel's Concurrency::run() and Pipeline::send().

1// Parallel agents
2[$analysis, $sentiment, $summary] = Concurrency::run([
3    fn () => AnalysisAgent::make()->prompt($text),
4    fn () => SentimentAgent::make()->prompt($text),
5    fn () => SummaryAgent::make()->prompt($text),
6]);

Testing

Full testing support with FakeAi::shouldFake() — no real API calls during tests:

1FakeAi::shouldFake();
2
3// Run your code...
4
5FakeAi::assertAgentPrompted(SalesCoach::class);
6FakeAi::assertImageGenerated();

Native Vector Search in the Query Builder

This is the feature that makes Laravel a legitimate choice for AI-powered applications. Native vector queries, right in the query builder, using PostgreSQL with pgvector.

Schema Setup

1Schema::ensureVectorExtensionExists();
2
3Schema::create('documents', function (Blueprint $table) {
4    $table->id();
5    $table->string('title');
6    $table->text('content');
7    $table->vector('embedding', dimensions: 1536)->index();
8    $table->timestamps();
9});

Querying with Plain Text

The magic: you pass a string, and Laravel generates the embedding automatically before comparing:

1$results = Document::query()
2    ->whereVectorSimilarTo('embedding', 'best practices for Moodle multi-tenancy')
3    ->limit(10)
4    ->get();

Hybrid Search

Combine traditional full-text search with AI reranking for the best results:

1$articles = Article::query()
2    ->whereFullText('body', $request->input('query'))
3    ->limit(50)
4    ->get()
5    ->rerank('body', $request->input('query'), limit: 10);

This retrieves 50 candidates using PostgreSQL full-text search, then uses an AI reranker (Cohere or Jina) to return the 10 most relevant results.

Beautiful Starter Kits with shadcn

Laravel 13's starter kits are a complete redesign. Four options, all production-quality:

Every kit includes:

• Dark/light/system modes out of the box
• Sidebar and header layout variants
• Two-factor authentication built in
• GitHub Actions CI/CD workflows
• WorkOS AuthKit integration option — passkeys, social login, enterprise SSO, free up to 1M MAU
• Team multi-tenancy — users can operate different team contexts in separate browser tabs (URL-based, not session-based)

The old Jetstream-era starter kits were functional but basic. These look like production SaaS dashboards from day one. If you're building a SaaS MVP, the scaffolding you get out of the box saves weeks of frontend work.

First-Party JSON:API Resources

If you build APIs (and who doesn't), this is a welcome addition. Laravel now has built-in support for the JSON:API specification.

1php artisan make:resource UserResource --jsonapi

1class UserResource extends JsonApiResource
2{
3    public function type(): string
4    {
5        return 'users';
6    }
7
8    public function attributes(Request $request): array
9    {
10        return [
11            'name' => $this->name,
12            'email' => $this->email,
13            'created_at' => $this->created_at,
14        ];
15    }
16
17    public function relationships(Request $request): array
18    {
19        return [
20            'posts' => PostResource::collection($this->posts),
21        ];
22    }
23}

Handles relationship inclusion (?include=posts,comments), sparse fieldsets (?fields[users]=name,email), links, meta, and sets the correct Content-Type: application/vnd.api+json header automatically.

No more pulling in spatie/laravel-json-api or cloudcreativity/laravel-json-api for standard API responses.

36 New PHP Attributes

Laravel 13 adds 36 new PHP attributes (50+ total). These let you configure models, jobs, commands, and more using native PHP 8 attributes instead of properties.

Eloquent Models

Before:

1class User extends Model
2{
3    protected $table = 'users';
4    protected $fillable = ['name', 'email'];
5    protected $hidden = ['password'];
6    protected $appends = ['full_name'];
7}

After:

1#[Table('users')]
2#[Fillable(['name', 'email'])]
3#[Hidden(['password'])]
4#[Appends(['full_name'])]
5class User extends Model
6{
7    // Clean model body — only relationships and methods
8}

Queue Jobs

1#[Tries(5)]
2#[Timeout(120)]
3#[Backoff([10, 30, 60])]
4#[Queue('podcasts')]
5#[Connection('redis')]
6class ProcessPodcast implements ShouldQueue
7{
8    public function handle(): void
9    {
10        // Job logic only — no configuration clutter
11    }
12}

Controllers

1#[Middleware('auth')]
2class PostController extends Controller
3{
4    #[Authorize('create', [Post::class])]
5    public function store(Request $request)
6    {
7        // ...
8    }
9}

Console Commands

1#[Signature('users:prune {--days=30}')]
2#[Description('Remove inactive user accounts')]
3class PruneUsers extends Command
4{
5    public function handle(): void
6    {
7        // ...
8    }
9}

All attributes are completely optional. Existing property-based configuration still works. You can mix and match — use attributes where they feel cleaner, keep properties where they don't.

Modern CSRF Protection

The VerifyCsrfToken middleware is now PreventRequestForgery, and it's smarter. It uses a two-layer approach:

1. Layer 1 (Origin check): Modern browsers send a Sec-Fetch-Site header. If the request is same-origin, it passes immediately — no token verification needed. 2. Layer 2 (Token fallback): For older browsers or non-HTTPS environments, traditional CSRF token validation kicks in.

1// bootstrap/app.php
2$middleware->preventRequestForgery(
3    originOnly: true,        // Disable token fallback entirely
4    allowSameSite: true,     // Allow subdomain requests
5    except: ['stripe/*'],    // Exclude webhook endpoints
6);

For most developers, this is invisible — forms still work, AJAX still works. But it's faster (no database/session lookup for the token) and more secure (origin verification is harder to bypass than token validation).

Other Notable Features

Queue Routing

Centralize job routing in a service provider instead of scattering it across individual job classes:

1Queue::route(ProcessPodcast::class, connection: 'redis', queue: 'podcasts');
2Queue::route(SendNotification::class, connection: 'sqs', queue: 'notifications');

Cache::touch()

Extend a cached item's TTL without reading or rewriting the value:

1Cache::touch('user_session:123', 3600);
2Cache::touch('analytics_data', now()->addHours(6));

Uses native store commands (Redis EXPIRE, Memcached TOUCH) — no deserialization overhead.

Reverb Database Driver

Laravel Reverb (WebSockets) now works with your existing MySQL or PostgreSQL database for horizontal scaling. Previously, this required a dedicated Redis instance. Great for small-to-medium apps that want real-time features without extra infrastructure.

Passkey Authentication

WebAuthn passkey auth is integrated into starter kits and Fortify. Users authenticate with Face ID, fingerprint, Windows Hello, or hardware security keys. The private key never leaves the device — zero phishing risk.

Laravel Boost (MCP Server)

A first-party MCP server for AI-assisted development. It provides 15 specialized tools for codebase inspection, 17,000+ pieces of Laravel-specific knowledge, and an /upgrade-laravel-v13 command that automates the upgrade process. Works with Claude Code, Cursor, VS Code, and other MCP-compatible editors.

Upgrade Guide

The upgrade from Laravel 12 to 13 is straightforward — about 10 minutes for most applications.

High Impact

Update composer.json:

1{
2    "laravel/framework": "^13.0",
3    "laravel/boost": "^2.0",
4    "laravel/tinker": "^3.0",
5    "phpunit/phpunit": "^12.0",
6    "pestphp/pest": "^4.0"
7}

PHP 8.3 minimum — if you're still on 8.2, upgrade PHP first.

Medium Impact

• Cache serializable_classes — new security config. Explicitly list PHP classes you cache as objects. If you only cache strings and arrays, you're fine.

Low Impact

22 minor changes covering cache prefix naming, session cookie naming, MySQL DELETE query behavior, and various contract method additions. Most apps won't be affected.

Automated Upgrade

Two options:

• Laravel Shift — automated upgrade service
• Laravel Boost — run /upgrade-laravel-v13 in your IDE with MCP support

Our Take — What This Means for Laravel Projects

Laravel 13 is the most AI-forward release of any backend framework. The AI SDK isn't a proof of concept or a wrapper — it's a complete toolkit for building AI-powered applications in PHP.

Here's what we're doing at Treesha Infotech:

• New projects start on Laravel 13 from day one. The starter kits alone save a week of scaffolding.
• Existing Laravel 12 projects are being upgraded gradually. The migration is painless.
• AI features that previously required separate Python microservices can now be built entirely within Laravel using the AI SDK. Fewer moving parts, one codebase, one deploy.
• Vector search replaces external vector databases for projects that run on PostgreSQL. One less dependency.
• PHP attributes are our default for new models and jobs. Cleaner code, less boilerplate.

If you're evaluating Laravel for a new project — or deciding whether to upgrade — Laravel 13 makes the decision easy. The framework has never been more capable.

Need help building with Laravel 13 or upgrading an existing application? Get a free quote or schedule a call with our team.

About the Author

Ritesh Patel

Co-Founder & CTO, Treesha Infotech

Co-founded Treesha Infotech and leads all technology decisions across the company. Full-stack architect with deep expertise in Laravel, Next.js, AI integrations, cloud infrastructure, and SaaS platform development. Ritesh drives engineering standards, code quality, and product innovation across every project the team delivers.

LinkedInUpwork