Four AI providers wobbled in the same three hours — and for thirty minutes there was nowhere to fail over to

The timelines

Individually, each of these was an ordinary incident. Collectively, they are the first real test of an assumption a great many teams have been quietly relying on.

Anthropic reported elevated error rates across Mythos 5.1, Fable 5.1 and Opus 5, said it identified the cause about fifteen minutes in, and resolved at 12:16. OpenAI reported degraded performance, deployed a mitigation at 11:17 and declared resolution at 12:55. xAI’s incident spanned two US regions. Google’s is the odd one out: third-party monitoring showed a burst of failures, and Google’s public service health page recorded nothing.

Now overlay them. Anthropic’s window contains the whole morning; xAI’s runs longer still; OpenAI’s opens at 10:43; Gemini’s runs 10:45 to 11:15. Between roughly 10:45 and 11:15 a.m. Eastern, all four were degraded simultaneously. For half an hour, a team whose architecture said “if Claude fails, call GPT; if GPT fails, call Gemini” had a chain in which every link was impaired.

Why “no shared cause” is the alarming version

The instinct is to look for the single upstream failure — an AWS region, a Cloudflare change, a DNS provider, a BGP event. None has been identified, and no vendor has named one.

That absence is not reassuring; it is the opposite. A shared cause is a discrete, fixable, attributable thing. You read the post-incident report, you learn which dependency you did not know you had, and you route around it. Unexplained correlation offers none of that. It tells you the events moved together and gives you no mechanism to design against.

Three readings remain open, and they lead to different actions:

• Coincidence. Possible. Four independent incidents on one Thursday morning is unlikely but not remarkable across a year of operations.
• An unnamed shared dependency. Also possible. Three companies declining to publish a root cause is consistent with either embarrassment or ordinary reticence.
• Cascade. The most operationally interesting. When one large provider degrades, traffic and automated retries shift to the others within seconds. Load moves, and retry storms are rarely gentle. Under this reading, your own retry configuration is a participant, not a spectator.

Nothing in the public record settles which applies. The prudent posture is to treat correlation as unexplained rather than disproved.

The assumption that failed

The failover arithmetic everyone quotes assumes independence. Two providers at 99.9% availability combine to something near five nines only if their outages are uncorrelated. Correlation collapses that number quickly, and correlation is exactly what nobody measures.

The shared surfaces are more numerous than most architecture diagrams admit: cloud regions, DNS providers, CDNs, identity providers, transit paths, and — increasingly — the gateway sitting in front of everything. That last one deserves particular attention now that Stripe has acquired OpenRouter and the neutral router has an owner: a router is genuinely useful for switching providers, and it is also a single point of failure placed directly in front of your redundancy.

This is the reliability twin of a contractual point this desk made when OpenAI cut Cursor’s model access and multi-model turned out to be a contract rather than a setting. Having a second model configured is not the same as being able to use it — legally then, operationally now.

The blast radius grew while nobody re-examined it

A three-hour AI outage in 2024 meant a chatbot was slow. In September 2026 it means something else entirely, and Anthropic’s own incident scope makes the point: the failure covered Claude Code and Claude Cowork alongside the web app and API.

Coding agents stall mid-task. Document and research workflows halt. Agentic pipelines fail partway through multi-step work with recovery semantics that are frequently undefined — a category of fragility visible when a GitHub outage stalled agentic coding workflows in August, and again when a Microsoft 365 authentication failure took Copilot’s grounding with it.

It also lands in a month of unusually dense releases — Fable 5.1’s cache-read repricing on 1 September, Gemini 3.8 Flash on the 2nd, GPT-6 Astra on the 3rd. Rapid serving-stack change is a plausible contributor to instability. No vendor has said so, and asserting it would go beyond the evidence.

The uncomfortable structural note is that the concentration is increasing rather than easing. The same week, Nvidia confirmed its acquisition of Hugging Face, consolidating the open-weight distribution layer under the dominant compute vendor. Self-hosted open weights are one of the few genuinely independent fallbacks available — a path worth keeping open precisely because its failure modes are yours rather than shared.

What to do about it

Map your correlation surface. List every dependency your primary and fallback paths share — cloud, DNS, CDN, identity, transit, gateway. The ones you did not consciously choose are the ones to write down.

Exercise the fallback, do not merely configure it. Untested failover fails when it matters. Run it on a schedule, in production, deliberately.

Add backoff and jitter. Synchronized retries are how one provider’s degradation becomes the next provider’s load problem. If the cascade reading is right, this is the single change that stops you contributing to it.

Alert on your own error rates. On 3 September the fastest available signal for a Gemini customer was their own telemetry, because Google posted nothing. Vendor status pages are a lagging indicator and, in one of four cases here, not an indicator at all.

Define the degraded mode in writing, now. Which features are load-bearing and which vanish quietly. What gets queued and drained rather than lost. What the status message says. Decide it while nothing is broken.

Ask better procurement questions. What is the availability commitment, what credits attach, on what clock are incidents posted, and are post-incident reports published for customer-visible events? Anthropic withdrew its Priority Tier uptime commitment after August’s incidents, which makes the written terms behind Claude, ChatGPT and Gemini worth reading rather than assuming — and worth comparing directly when you weigh the major assistants against each other.

The bottom line

Three hours of degradation across three confirmed vendors is not an industry crisis, and the recovery times were unremarkable. Treating this as a scandal would miss what it actually offers, which is rare and useful: a free test of an assumption almost nobody validates.

Most teams that adopted a second model in the past year did so for pricing leverage or capability coverage and quietly booked it as redundancy too. On 3 September, for about thirty minutes, that redundancy was not there. Nobody has explained why, which means the next occurrence is equally unpredictable — and the work that makes it survivable is architectural, cheap, and entirely within your control.

Questions or corrections? Email Pick Right. Want the full list? See all news.