The AGI Era Launched Thursday. Its Infrastructure Is Not Ready.

Thursday, Greg Brockman stood in front of reporters and said, “Welcome to the AGI era.” The occasion was the launch of GPT-6 Astra, OpenAI’s first model to cross what the company calls the Critical cybersecurity threshold — meaning it can autonomously discover previously unknown vulnerabilities and chain exploits across well-protected systems without continuous human guidance. ExploitBench: 100%. ARC-AGI-3: 98.6%. The numbers are real. The framing Brockman reached for was not wrong in the way critics usually mean when they accuse OpenAI of hype. The model is genuinely capable in ways the previous generation was not.

But the day those numbers went public also provided a different kind of evidence. By early afternoon Pacific time, ChatGPT, Claude, and Grok had all gone down simultaneously. The concurrent failure turned out to trace to a SpaceX compute center in Memphis — and the most revealing part of that failure wasn’t the outage itself, but what SpaceX said when services were restored. The company apologized to “impacted compute partners” — plural. A phrase that indicates Anthropic, like SpaceX’s own Grok infrastructure, is running on SpaceX-operated compute. Three AI products marketed as independent alternatives share a facility in Tennessee, and that is not information any of them publicize.

At the same time, on LessWrong, alignment researcher Rauno Arike published a detailed technical analysis of Astra’s underlying architecture. OpenAI’s Jakub Pachocki, who oversees the company’s research, had confirmed that Astra uses a looped transformer — the same forward pass applied multiple times per token, with recurrence along the depth axis rather than across sequence positions. Pachocki’s own defense of this choice included an admission that was more striking than the choice itself: chain-of-thought monitorability, he said, is “fragile and trending negative.”

One day. One model declared the start of an era. One infrastructure failure revealing undisclosed shared dependencies. One architectural admission from the chief researcher of the company making the era claim. That is the picture worth sitting with before the benchmark scores recede into the background noise of the launch cycle.

What the Threshold Actually Means

OpenAI’s Preparedness Framework designates four capability levels for cybersecurity risk: low, medium, high, and critical. Astra is the first model to reach critical — defined as the ability to independently find unknown vulnerabilities and develop working exploit chains across hardened targets without a human operator providing continuous direction. ExploitBench, the Carnegie Mellon benchmark that measures this, is a controlled test of exactly that process: identify a target, traverse to the vulnerable code, trigger the crash, build and deliver the exploit. A full chain, not a component. Astra completed every one.

This is different from the ExploitBench result TZ covered last week, when the score was known but the model was in limited deployment through OpenAI’s Daybreak program — a defense-only channel for vetted enterprise security teams. What changed Thursday is that Astra is now rolling out to ChatGPT Plus, Pro, Business, and Enterprise subscribers, and through public APIs including AWS Bedrock and Azure. On OSWorld 2.0, the benchmark for general computer-use tasks, Astra scores 72.6% against GPT-5.6 Sol’s 65.7%, completing tasks in 47% less time. The model is better at cybersecurity and better at general computer interaction simultaneously. The defensive guardrails are real: offensive capabilities are filtered at the API layer for general users. But the model that can do the thing is now in general distribution, and the filtering is maintained by the same company whose chief researcher just acknowledged that the monitoring layer is trending negative.

The ARC-AGI-3 score — 98.6% — requires the same caveat it required when NVIDIA’s AVO system hit 100% last month with Claude Opus 5 as its foundation model. Claude Opus 5 alone scores approximately 30% on ARC-AGI-3. The benchmark measures what the agentic system produces, not what the language model knows. Brockman is aware of this, which is why his phrasing was precise in ways the headline coverage missed: “I think it’s not unreasonable to feel that we are now in the AGI era.” That is a permission slip, not a declaration. The performance is genuine; the ontological conclusion is left to the listener.

The UK’s AI Safety Institute identified something in pre-release evaluation that is more concrete than the philosophical argument: an evasion risk under adversarial prompting. OpenAI acknowledged the finding and stated that ongoing monitoring is built into every deployment tier. The UK regulator that found the risk received no pre-launch briefing. The White House vetting was completed. The asymmetry in those two sentences is not an accident — it is a picture of where, structurally, the oversight weight is concentrated.

The Memphis Compute Center

The sequence Thursday was as follows. At 7:43 AM Pacific, ChatGPT experienced a routing error that made it and Codex unavailable for portions of the user base. The service recovered by 8:17 AM — thirty-four minutes of degradation. At roughly the same time, Claude went down across Claude.ai, Claude Code, Claude Cowork, and the API. Claude Opus 4.8 and Opus 5 remained affected after other Claude models had recovered to baseline error rates. The full outage lasted three hours and six minutes, resolving at 16:16 UTC. Grok began reporting issues at 6:30 AM Pacific, attributing them later to an outage at SpaceX’s Memphis compute center.

Cloudflare, AWS, Google Cloud, and Azure each issued statements denying any platform-level disruption during the same window. SpaceX, in its post-resolution statement, apologized to “impacted compute partners” — a choice of words that implies Anthropic is one of them. No vendor confirmed this relationship publicly before Thursday, and none has confirmed it since. But the phrase is there, and the timing is what it is: the Memphis facility went down, and Claude and Grok went down together.

The AI Governance Institute, which tracks enterprise risk in AI deployment, noted that this kind of failure “requires cross-platform impact assessment, stakeholder notification, and dependency mapping that most AI incident response playbooks were not designed to handle.” The assessment is correct, and the gap it describes is not theoretical. Organizations that built multi-vendor AI strategies specifically to avoid single points of failure are now discovering that “multi-vendor” does not mean “independently operated.” The EU’s Digital Operational Resilience Act will eventually require formal AI vendor concentration assessments. Currently, those assessments cannot be completed because the dependencies are not disclosed.

The outage had a mundane cause. A compute center in Memphis had a problem, the problem was fixed, everything came back. That is not a catastrophic failure. It is, however, a demonstration that the infrastructure beneath the AGI era is built on shared dependencies that the companies involved actively obscure — and that when one shared node fails, the independence narrative of the whole market fails with it.

Fragile and Trending Negative

Astra’s looped transformer applies the same transformer forward pass multiple times per token, with recurrence running along the depth axis rather than across sequence positions. This is structurally different from both standard transformers and classic RNNs. OpenAI’s Pachocki argued in pre-launch technical commentary that the architecture preserves legibility: the computation graph depth, he noted, is within a factor of two of GPT-4’s, and weight-tying in looped architectures reduces expressivity compared to equivalent-depth standard transformers. The current implementation is more constrained, not less.

The concern Rauno Arike identifies is not about current deployment — it is about what the architecture enables next. He calls it the dial problem. Astra could be trained with a higher loop count and deployed with a lower one. The same architecture, scaled to a higher loop count, gives you the ability to run multi-stage reasoning inside the depth axis in ways that chain-of-thought logging cannot see. Each loop happens before output generation; what happens inside the loops is not part of the text record that safety monitoring reads. Huginn, a looped model from Geiping et al. in 2025, was trained on 32 loops and extrapolated to 64. Loopie, a 20-billion-parameter model from Gao et al. this year, runs on 2 loops. The scaling behavior is currently unknown, and that uncertainty is where the risk lives.

Pachocki’s statement that CoT monitorability is “fragile and trending negative” is the admission that moves all of this from theoretical to operational. Chain-of-thought monitoring is the mechanism by which safety teams at AI labs read the reasoning process of models during evaluation. It is not a perfect mechanism — models can steganographically encode information in visible tokens — but it is currently the primary real-time window into model reasoning that safety researchers have. If the person leading research at OpenAI says that window is trending negative, that is not a minor technical note. It is a statement about the direction of the field’s primary safety instrument at precisely the moment the company is launching a model it calls the AGI era.

The combination — an architecture that creates the infrastructure for hidden depth-axis reasoning, and a chief researcher who says the visible reasoning layer is trending less legible — is worth stating plainly: the launch of the first model designated as Critical for cybersecurity risk coincides with OpenAI’s own acknowledgment that the monitoring layer designed to catch that model misbehaving is getting weaker, not stronger.

Brockman’s “Welcome to the AGI era” is accurate in the sense that matters for benchmark performance. What Thursday also revealed is that the era he is welcoming us to runs on shared infrastructure that vendors do not disclose, deploys the first model capable of autonomous exploit chaining to general API users, and is monitored by a safety instrument that its own designer describes as fragile and trending negative. That is the AGI era as it exists in practice, not as it exists in the benchmarks. Getting there sooner than expected is not the same as arriving prepared.

AI-generated editorial illustration · TemperatureZero · September 4, 2026