Enterprises are facing a disturbing new question in the age of AI: What happens when agentic assistants go dark?

This became a very real scenario on Thursday, as OpenAI’s ChatGPT, Anthropic’s Claude, and SpaceXAI’s Grok near-simultaneously, and somewhat mysteriously, experienced significant, prolonged outages.

Beginning in the morning, Eastern time, several ChatGPT models went down over a roughly two hour period, Claude models over a four-hour span, and Grok models for a near three-and-a-half hour duration. All three companies acknowledged the “elevated” issues and applied fixes.

As users grumbled in forums and IT teams scrambled to get them back online, the incident revealed how hastily some organizations have adopted generative AI workflows without considering the potential, and inevitable, impact of widespread outages.

AI agents are increasingly taking over automated and wider-scale workflows, and enterprises could find themselves “uncomfortably exposed” when AI hits the brakes, said technology analyst and journalist Carmi Levy. The situation should “serve as a wakeup call to IT leaders who have largely ignored what it’ll cost them if these increasingly critical platforms suddenly go dark. The risk is no longer hypothetical.”

Hours-long outages impact core services

ChatGPT went down on the same day as OpenAI’s anticipated launch of GPT-6 Astra, the new frontier model that the company says approximates artificial general intelligence (AGI) and gets nearer to its goal of creating autonomous systems that outperform humans.

The OpenAI outage occurred around 11 a.m. ET on Thursday and impacted a slew of services, including search, file uploads, agents, GPTs, voice mode, image generation, ChatGPT work, Compliance API, Deep Research, ChatGPT Atlas, and other connectors and apps. In some cases, users were prevented from logging in, conversations failed to load, and the interface returned errors when attempting to send messages. OpenAI’s Codex services, including web, API, command line interface (CLI), and VS code extension, were also impacted.

OpenAI fixed the issue by 12:55 p.m. ET, and advised Codex remote control users to re-pair their mobile devices.

Claude began to go dark around 7:37 a.m. ET, with Anthropic acknowledging an “exhaustive list” of impacted models with elevated errors over the next few hours: Mythos and Fable 5.1 and 5, Sonnet 5, and Opus 5, 4.8, and 4.6.

The issue was resolved by 11:27 a.m. ET. The incident followed a roughly 27-minute outage just the day before, also due to elevated errors on requests in Sonnet 5.

Grok, meanwhile, began experiencing issues around 9:30 a.m. ET. Grok Web, Build, API, Office/Workspace plugins, Android, and X were all impacted. The services returned to “healthy” traffic at 1:08 p.m. ET.

“It’s a curious scenario for multiple different providers to experience outages at the same time,” noted Brian Jackson, a principal research director at Info-Tech Research Group. It could be related to a common infrastructure such as a content delivery network (CDN) layer, domain name system (DNS), or shared cloud infrastructure, he theorized.

A case for outage planning

Just a few months ago, the extent of AI use within the typical enterprise was limited to employees using chatbots to get answers to basic questions or to draft simple email messages, Levy noted. Large-scale AI platform outages, when they occurred, had relatively little impact on overall organizational productivity. “But things are changing, and quickly,” he said.

Organizations must now have a better understanding of the impact agentic AI has on day-to-day workflows, and the degree to which they disrupt employees’ ability to complete complex tasks once they’ve handed the reins over to automated, cloud-based tools, Levy noted.

In incidents like Thursday’s, employees may fall back on traditional manual workflows, such as updating spreadsheets or pulling reports together the old-fashioned way. But they might also realize that, after relying on AI agents to do so much work on their behalf, they’ve become too dependent on automation, and their “cognitive skills may not be as sharp as they once were,” Levy said.

The growing prevalence of agentic AI should prompt organizations to revisit their disaster recovery and business continuity plans and assess the productivity impact of potential service outages, he said. While cloud-based productivity platforms like Google Workplace and Microsoft 365 offer limited degrees of “offline mode” functionality using locally-stored data, and documents can be synchronized to hard drives in Dropbox or Google Docs for Desktop, agentic AI platforms offer up fewer offline workarounds, at least in their current form.

Organizations should document workflows in greater detail and scenario-plan what near-term recovery might look like in the event of an extended AI platform outage, Levy said. They also need better training to ensure employees maintain their manual skills over time and are equipped to press them into service in the event of a service outage, because the more enterprises lean on agents to complete critical tasks, “and pull humans out of the loop in the interest of productivity,” the less able employees will be to step back in during inevitable service interruptions, he pointed out.

“It is entirely possible for otherwise well-meaning organizations to be over-reliant on AI automation,” Levy said. “Too many organizations are about to learn some hard lessons about not having a backup plan in place.”

Info-Tech’s Jackson also recommends a modular architecture for LLMs; enterprises should view the model as a “commodity that can be hot-swapped with an alternative.” That might be another cloud service provider (which hopefully isn’t experiencing a concurrent outage) or a self-hosted option like an open-weights model.

“In a scenario like this, when your first choice provider might not be available, you have a fallback that can supply that same intelligence layer, even if it’s only a stopgap solution,” said Jackson.

This article originally appeared on Computerworld.

Ransomware remains one of the most disruptive cyber threats organizations face. Companies have strengthened their cyber defenses over the years, but attackers in 2026 have become faster, more targeted, and increasingly reliant on AI, forcing the need for a change in how organizations approach cyber resilience.

From the rise of AI-enabled attacks and extortion-only campaigns to growing concerns around third-party risk, several trends have emerged over the past several months that are reshaping the ransomware landscape and raising new challenges for enterprise security leaders.

Ransomware attacks today are increasingly designed to disrupt business operations, steal sensitive data, and apply pressure far beyond an organization’s IT environment. Those developments signal that CISOs need to look beyond traditional cybersecurity controls to address operational resilience as well.

Ransomware has become a business disruption strategy

Ransomware has traditionally followed a straightforward model: Attackers encrypt systems and demand payment in exchange for a decryption key.

But today’s attacks are far more complex. Many ransomware groups now combine operational disruption with data theft, extortion, and reputational pressure. Instead of simply locking organizations out of their systems, attackers steal sensitive information before encrypting systems, creating multiple opportunities to pressure victims into paying.

Some campaigns have moved beyond encryption altogether. Rather than deploying ransomware, threat actors exfiltrate sensitive data and threaten to publish it or contact customers, partners, or regulators unless payment is made. These extortion-only attacks are often faster to execute, more difficult to detect, and capable of creating significant business disruption even when systems remain operational.

For IT leaders, this approach changes the conversation. The question is no longer whether systems can be restored. Now the question lies in whether the organization can continue operating while still protecting customer trust, regulatory obligations, and critical business relationships.

AI is changing both sides of the cybersecurity equation

AI expands the volume of valuable enterprise data by increasing the number of connected systems and introducing new third-party dependencies. At the same time, attackers are leveraging AI to accelerate phishing campaigns, identify exposed assets, and make scams that manipulate employees into revealing sensitive information more convincing and difficult to detect. This creates an environment where both defenders and attackers have access to increasingly sophisticated capabilities.

AI is also expanding the number of potential entry points attackers can target. Organizations are rapidly deploying generative AI assistants, integrating large language models into internal workflows, and connecting AI applications to enterprise data repositories. Each new integration introduces additional identities, APIs, and permissions that must be secured.

Without strong governance, these tools can inadvertently expose sensitive information or create new pathways for attackers to exploit. As AI adoption accelerates, CISOs should inventory where AI is being used, understand what data those systems access, and ensure security controls evolve alongside innovation. Technology leaders should evaluate not only how AI systems improve operations but also how these same systems affect identity management, data governance, access controls, and incident response planning.

Third-party risk expands the threat landscape

Enterprise organizations rarely operate in isolation. Cloud providers, software vendors, managed service providers, and AI platforms all have varying levels of access to corporate systems and sensitive information. As organizations become more interconnected, attackers increasingly view trusted third parties as potential entry points.

This means ransomware preparedness extends beyond internal infrastructure. Vendor risk assessments should evaluate cybersecurity maturity, incident response capabilities, and contractual obligations around breach notification. Organizations should also understand how quickly business partners can detect, contain, and communicate cyber incidents, particularly when shared systems or data are involved. A resilient security strategy depends on protecting your own environment and understanding the risks introduced by the broader technology ecosystem.

Cyber resilience has become a board-level priority

Ransomware is no longer viewed solely as an IT issue. Extended outages can interrupt revenue, halt operations, affect customer service, damage brand reputations, and trigger regulatory scrutiny. As cyber incidents become more consequential, boards are asking different questions. Rather than focusing exclusively on security tools, they want to understand recovery capabilities, operational dependencies, and the organization’s ability to maintain business continuity during an attack.

This shift places CIOs and CISOs in more strategic roles. In addition to overseeing technology and cybersecurity, they are increasingly responsible for helping executive leadership understand cyber risk in business terms. That includes communicating the potential operational impact of ransomware, prioritizing technology investments based on enterprise risk, and ensuring cybersecurity aligns with broader business resilience objectives.

Recovery time objectives, business continuity planning, and executive communication protocols are becoming just as important as endpoint protection and network monitoring. Organizations that regularly test recovery procedures, validate backup integrity, and conduct simulated cyber incident exercises with executive leadership are often better positioned to respond effectively when an incident occurs.

What CIOs and CISOs should prioritize now

While no organization can eliminate cyber risk entirely, several foundational practices can strengthen resilience against ransomware and improve an organization’s ability to respond when an incident occurs.

Technology leaders should prioritize the following:

• Maintain and test offline backups. Store critical data in encrypted, offline environments and regularly test restoration procedures to ensure systems can be recovered quickly if production environments are compromised.
• Strengthen identity and access controls. Require multifactor authentication for privileged accounts, limit employee access to only the systems and data they need to do their jobs and continuously monitor for unusual authentication activity.
• Prioritize vulnerability management. Establish a disciplined patch management program to identify and remediate known vulnerabilities before they can be exploited by threat actors.
• Develop a comprehensive incident response plan. Go beyond technical recovery by clearly defining executive decision-making, communications protocols, legal coordination, and stakeholder responsibilities before an incident occurs.
• Evaluate third-party and AI-related risks. Regularly assess the security posture of cloud providers, technology vendors, and AI-enabled platforms to ensure security controls keep pace with an increasingly interconnected digital ecosystem.

Looking ahead

Ransomware is continuing to evolve faster than many organizations’ security strategies and the benchmark for victory can no longer be preventing every attack.

Future success will depend on treating ransomware as an enterprise resilience challenge rather than a purely technical problem. The organizations best positioned for the future won’t necessarily be those with the largest security budgets, but those that have embedded cyber resilience into every aspect of technology strategy. In an environment where both technology and threats continue to evolve rapidly, resilience will increasingly be measured by whether organizations can prevent every attack and by how effectively they can anticipate, respond to, and recover from the incidents that inevitably occur.