When All Three Went Down at Once

On the morning of September 3, 2026, something happened that, according to the textbook, shouldn't happen: ChatGPT, Claude, and Grok went down simultaneously within a few hours of each other. Three providers, three independent infrastructures, three different companies – and yet all unreachable for hours at almost the same time. For every company that had dutifully built "two providers in the portfolio" in recent years as protection against exactly this scenario, the day was an uncomfortable lesson.

Because that was exactly the promise: if ChatGPT goes down, Claude steps in. If Claude has problems, there's still Grok or Gemini. Diversification as insurance. On September 3, 2026, that math didn't work out for many companies – not because the idea was wrong, but because there's an entire layer of architecture missing between "having a second contract" and "actually being resilient" that is rarely thought through.

September 3, 2026: three outages, three causes, one gap

The facts in order: OpenAI reported a routing error that was under control after around 34 minutes, though according to its status page, aftereffects lingered for a good two hours. Anthropic recorded a partial outage affecting the Claude models Mythos 5.1, Fable 5.1, and Opus 5, lasting around three hours. xAI, meanwhile, was fighting a data center outage in Memphis that affected Grok for roughly three and a half hours. According to third-party monitoring, Google's Gemini API even briefly showed elevated error rates during this window – though Google itself published no incident report on it, which is why this point should be treated cautiously.

What stands out isn't just the timing overlap, but what was still missing five days later: an explanation. None of the three companies had published a root-cause report by that point. AWS, Azure, and Cloudflare – the most obvious shared suspects – explicitly reported no outages of their own that day. The simplest explanation, a shared underlying infrastructure, was therefore off the table. What remained was the less comfortable possibility: three genuinely independent failures that happened to occur at the same time.

Five days after the incident, there was still no official root-cause report from OpenAI, Anthropic, or xAI – and AWS, Azure, and Cloudflare independently confirmed they had no outage of their own that day.

That's exactly what makes the incident so instructive for the resilience discussion. This wasn't about a single point of failure that could have been identified and fixed. It was about what statisticians would call independent but temporally correlated events – which, for day-to-day operations, looks exactly like a shared outage: AI access was gone, no matter which of the three major providers you had signed up with. Anyone running ChatGPT and Claude in parallel without having built automated failover between the two APIs was still without working AI access for hours – the second license didn't help, because nobody manually switched between two services in the moment while customer requests piled up.

The portfolio illusion: two contracts aren't an architecture

The obvious reflex after an incident like this is: add a third or fourth provider. More diversification, more safety. That sounds logical, but it falls short. A contract with two or three AI providers is a purchasing decision. Resilience is an operational decision. The two have little to do with each other unless someone builds the technical bridge between them.

Concretely, that means: a company using ChatGPT for its customer service chatbot and Claude for internal document analysis has two providers in its portfolio – but no redundancy. If ChatGPT goes down, nobody has automatically activated Claude for the chatbot. There's no circuit breaker that detects a degraded provider, and no fallback chain that automatically reroutes traffic. There are simply two separate systems, either of which can fail – and on September 3, 2026, both failed at the same time, plus a third that many companies were also running.

This gap between perceived and actual protection is especially pronounced in Germany. According to the DIHK Digitalization Survey 2026, roughly two-thirds of surveyed German companies see themselves as largely or completely dependent on individual AI providers. Thirty-five percent already use AI, and another 34 percent plan to within the next three years. A very similar pattern shows up around cloud dependency: 85 percent of German companies consider their dependence on US cloud providers too high – yet 71 percent keep using those services anyway. Awareness of the risk is there. Translating it into resilient architecture is missing in most cases.

What the multi-cloud numbers actually show

One could object that more providers statistically help anyway – and that's even true, though only to a limited extent. Industry data shows that multi-cloud environments record roughly 17 percent fewer total outages on average than single-vendor deployments. That's a real, measurable effect. But it comes with a second effect that often gets lost in the discussion: as the number of providers increases, so does operational complexity, and that complexity bites back during recovery.

Eighty-four percent of teams with three or more cloud providers had at least one failed recovery attempt in the past year – compared with 72 percent for teams with one or two providers. Sixty percent of all surveyed teams need six hours or more for a full recovery after a major outage, and only 5 percent manage it in under an hour. So more providers in the portfolio slightly reduces the probability of an outage – but at the same time increases the risk that recovery fails in a real incident, if nobody has practiced how to actually fail over. Sheer provider count doesn't replace a recovery architecture. It can even make things harder, when every additional system brings its own interface, its own authentication, and its own failure modes that nobody knows in an emergency.

What these numbers mean economically can be pinned to concrete orders of magnitude. Across industries, average downtime costs now sit at roughly $8,600 per minute – up from $5,600 in 2022. In Germany, serious IT disruptions cost an average of €1.7 million per hour of downtime, extrapolating to around €147 million a year; nearly half of German companies report at least one critical outage per week. For a mid-sized company with around 30 employees, an hour of IT downtime costs an average of €20,000 to €30,000. These figures come from different studies with different methodologies and aren't directly comparable – but as a rough order of magnitude, they make clear that an AI-supported process standing still for three hours isn't a purely technical annoyance, it's a cost item.

A pattern that keeps repeating: shared infrastructure, shared risk

September 3, 2026, is not an isolated case, but the latest entry in a series of similar incidents that show how tightly interwoven seemingly independent AI and cloud services actually are. On June 12, 2025, a 2-hour-28-minute Cloudflare outage took down Workers AI among other services – the cause was a third-party storage service behind Cloudflare's Workers KV that failed, dragging down services like Access, Gateway, Images, Stream, Turnstile, and Zaraz along with it.

On October 20, 2025, a latent race condition in DynamoDB's DNS management in the AWS region US-EAST-1 caused an outage that, according to analyses, affected over 1,000 to 2,500 companies worldwide, impacted 113 AWS services, and triggered more than 11 million Downdetector reports globally. The acute core disruption lasted around three hours, but aftereffects and backlogs dragged on for up to 15 hours. And on November 18, 2025, a failed configuration update at Cloudflare simultaneously took down ChatGPT, X, Discord, Spotify, and other major platforms for roughly three hours.

The pattern running through these incidents is clear: many supposedly independent services share CDN providers, DNS infrastructure, storage backends, or data centers. Even when – as on September 3, 2026 – no shared cause is ultimately found, the sheer frequency of such overlapping disruptions shows that the probability of simultaneous outages across multiple providers is higher than a naive risk calculation ("Provider A and Provider B will never go down on the same day") would assume. Anyone building their entire resilience strategy on that naive assumption is building on sand.

What the longer-term availability statistics show

At first glance, the incident of September 3, 2026, looks like a statistical outlier – three major providers going down simultaneously on a single day should, by naive probability, be extremely rare. A look at the longer-term availability history of individual providers puts that assessment into perspective, though. According to evaluations by third-party status-tracking sites, ChatGPT's uptime has historically sat around 99.3 percent – equivalent to roughly five hours of downtime per month on average, spread across individual, mostly short incidents. A more recent measurement as of September 1, 2026, based on a 90-day window, showed 99.96 percent availability with no major disruption – yet the same monitoring source also recorded, over the preceding twelve months, a single, apparently mostly intermittent API outage lasting around eleven days, with an average recovery time of about nine hours and 44 minutes.

These individual figures come from third-party status pages and aren't officially confirmed by OpenAI – definitions of "outage" differ considerably between such services, which is why they should be read as an order of magnitude rather than an exact metric. Still, they paint a consistent picture: even a single, individually reliable provider has regular short interruptions and occasional longer, partial disruption phases. Apply that to a portfolio of two or three providers, and it becomes clear why an incident like the one on September 3, 2026, isn't a one-off operational accident, but the statistically expected outcome when multiple systems, each with its own but similarly shaped failure probability, run in parallel over a longer period. In practice, that means: anyone basing their resilience planning on the assumption that a simultaneous outage across multiple providers is a once-in-a-century event is systematically underestimating how often such overlaps actually occur.

What genuine resilience means technically

The good news: there are established technical patterns for this problem, proven over years – they come from classic distributed-systems architecture and translate directly to LLM infrastructure. The first building block is retry with exponential backoff: on a 429 or 5xx error, the request is automatically retried with increasing wait times, typically up to three times – but not on a 4xx error, because there the problem lies in the request itself and retrying changes nothing.

The second building block is the circuit breaker: a mechanism that detects when a provider is visibly degraded – for example because a certain error rate is exceeded within a time window – and then automatically stops sending further requests to that provider, instead of letting every single request run into a dead end again. The third building block is a staggered fallback chain across model providers: if request one fails at Provider A, it automatically goes to Provider B, then, if necessary, to Provider C – without any human having to intervene manually.

A fourth, often forgotten building block is decisive: a defined degraded mode. Instead of losing full functionality during an outage, the system keeps running with reduced functionality – a customer service chatbot, for instance, then answers only standard questions from a knowledge base instead of going fully offline, while more complex requests move into a queue and are automatically processed once a provider is available again. That turns a total outage into a noticeably reduced but functioning operation – the difference between three hours of standstill and three hours of limited but running service.

For a company, that means concretely: a support team running an AI-powered chatbot shouldn't just have a second provider under contract, but a middleware layer that automatically distributes requests across providers, detects and blocks degraded services, and switches into a predefined queuing mode if all connected providers fail completely – instead of simply letting customer requests run into a dead end. That's the difference between a portfolio and an architecture – and it's exactly that architectural layer that was missing at most affected companies on September 3, 2026.

A concrete example makes the difference tangible: an IT service provider with 25 employees uses an AI agent to classify incoming support tickets, automatically answer standard requests, and pass only more complex cases on to human staff. Without a resilience architecture, the sequence on September 3, 2026, looks like this: the agent sends a request to ChatGPT, gets an error, tries again, gets another error – and because no fallback is defined, the ticket sits unanswered until someone intervenes manually. For a team working with reduced availability for several hours, dozens of requests pile up in that time, all of which then have to be processed at once.

With a resilience architecture, the same incident plays out differently: the circuit breaker detects after the first failed requests that ChatGPT is degraded, and automatically blocks further requests to that provider for the next few minutes instead of wasting time on futile retries. The fallback chain automatically routes new requests to Claude – if that provider also fails, as happened on September 3, 2026, the system switches into degraded mode: simple, well-documented standard questions continue to be answered from a local knowledge base, more complex requests are automatically placed in a queue with an automatic reply that an answer will follow shortly once a provider is available again. As soon as one of the connected providers is stably reachable again, the system automatically works through the queue, prioritized by wait time, without anyone having to manually re-sort it. The difference between the two scenarios isn't the number of contracts in the portfolio, but solely the architectural layer sitting between the agent and the individual providers.

What this means for your business

According to Gartner's 2026 forecast, global AI spending will rise to roughly $2.59 trillion – a 47 percent increase over 2025, more than 45 percent of which goes to AI infrastructure such as IaaS, servers, networking, and chips. For 2027, forecasts already point to up to $3.49 trillion. AI infrastructure isn't getting smaller, quieter, or less critical – it's getting bigger, more complex, and therefore also more prone to exactly the kind of incident that became visible on September 3, 2026.

For the German Mittelstand, that means: the question is no longer whether to use AI – according to the DIHK, in addition to the 35 percent already active, another 34 percent of companies plan to adopt it within three years. The question is whether operations are built so that a three-hour outage at a single provider – or, as shown on September 3, 2026, at several at once – shuts down your business, or only slows it down briefly and noticeably. "Two providers in the portfolio" is a good first step. But it only becomes genuine resilience once retry logic, circuit breakers, fallback chains, and a defined degraded mode are part of the architecture from the start – not as a retrofit after the next incident, but as the foundation every AI agent solution is built on from day one.

What makes September 3, 2026, so instructive in hindsight isn't the question of whether such an incident will happen again – the longer-term availability statistics of individual providers suggest that similar overlaps are more likely to become more frequent, not less, the more AI services run in parallel. The real question is whether the next incident again leads to a multi-hour standstill, or to a barely noticeable, automatically cushioned transition into a reduced operating mode. That decision isn't made on the day of the outage, but long before – in the architecture a company builds before the first error even occurs.