DEV Community

Breach Protocol
Breach Protocol

Posted on Originally published at groundtruth.day

OpenAI, Anthropic and xAI all went down on the same afternoon, and none named a cause

Three frontier AI providers logged overlapping outages on the afternoon of September 3, 2026. Anthropic reported elevated errors across multiple Claude models from 13:26 to 16:23 UTC, xAI's Grok was down from 13:30 to 17:05 UTC, and OpenAI reported elevated errors across ChatGPT and Codex from 14:43 to 16:55 UTC. None of the three public status pages names a root cause, and none names a shared upstream provider.

Key facts

  • Three overlapping incidents inside one four-hour window: Anthropic 13:26-16:23 UTC, xAI 13:30-17:05 UTC, OpenAI 14:43-16:55 UTC.
  • OpenAI's incident affected 15 ChatGPT components and 4 Codex components; Anthropic's hit claude.ai, the Claude API, Claude Code and Claude Cowork.
  • Google logged no Gemini incident for September 3, 2026.
  • Primary sources: Anthropic's incident page, OpenAI's incident page, and xAI's Grok status page.

For anyone whose workday runs through an AI coding agent, the first sign was not a status page. It was a wall of 404s. GitHub issue #42559 in the Codex repository records every Codex client getting 404 responses from https://chatgpt.com/backend-api/codex/responses beginning at 14:39:25 UTC -- and notes, pointedly, that status.openai.com still showed no incident as of 15:02 UTC. Twenty-three minutes of users being told nothing was wrong while nothing worked.

Anthropic's timeline is the most granular of the three. Its page shows elevated errors starting 13:26 UTC, the cause "identified" at 13:41, a fix deployed at 16:06, and recovery complete at 16:23. Three hours from detection to recovery, with the cause understood internally within fifteen minutes -- and never disclosed publicly. xAI's page shows outage and recovery for Grok across a three-and-a-half-hour window, also without a stated cause.

The obvious hypothesis was a shared dependency: one cloud region, one content delivery network, one certificate authority quietly taking down three companies at once. It is a reasonable guess, because it has happened before, and it is exactly the kind of failure the industry's concentration makes plausible. But it is not supported. Checking each status page individually, none identifies Cloudflare, Amazon Web Services, Microsoft Azure or anything else in common. Three vendors, three timelines, three different durations, three independent resolutions -- which is what unrelated failures look like when they happen to overlap.

Google's absence from the list is the cleanest data point. Its Workspace incident history for Gemini logs nothing on September 3, 2026; the 2026 entries are June 10, May 4 and February 18. The simplest verified answer to "why did Gemini stay up" is that Google did not record an outage. That is not evidence of superior engineering, but it does undercut the shared-dependency theory: if a common provider had failed, the one large lab running on entirely different infrastructure is exactly the one you would expect to survive -- and Google runs on its own.

Why it matters is not the cause. It is the coupling. Hacker News threads that afternoon -- one titled simply Claude.ai down, another asking whether Claude was down again -- converged on a sharper complaint than usual. Not "the service broke," but that frontier AI products have quietly become production dependencies for real work while retaining the reliability profile of a research preview. When an agent is running a multi-step task and its provider returns 404 mid-loop, the failure is not a spinning cursor. It is a half-completed workflow with ambiguous state, which is precisely the failure mode that research on agent harnesses and scaffolding shows almost nobody handles -- a paper published the same week found that across 26,679 recorded agent trajectories, not one checkpoint was ever saved.

There is a second-order lesson in the timing gap. The people who kept working through the afternoon were those running fallback chains across providers, because a multi-provider setup treats any single vendor's outage as a routing decision rather than a stoppage. That is the practical argument for model routing and cascades, and it got a live demonstration.

The tempting story -- that GPT-6 Astra's launch traffic that same day overloaded something shared -- has no primary-source support whatsoever, and the timelines do not obviously fit. It should not be published as fact, and it is not published as fact here.

The honest caveat: absence of a stated cause is not absence of a cause. Status pages are public relations documents as much as engineering ones, and "identified" without disclosure is a company choosing not to explain. If any of the three publishes a post-mortem naming a common upstream, this story changes completely. Until then, the strongest supportable conclusion is the boring one: three companies had bad afternoons at the same time, and none of them has told anyone why.


Originally published on Ground Truth, where every claim is checked against the primary source.

Top comments (0)