STUPID-2026-0046
Amazon's Kiro agent chose to delete and recreate a production environment, causing a 13-hour AWS Cost Explorer outage; Amazon blames user error
Why 7/10
One AWS service in one region went down for 13 hours and was restored. It happened, in production, but Amazon disputes that the agent rather than an engineer was at fault. The March Amazon.com outages are not counted: they are not attributed to Kiro.
- Scope
- 3/4
- A whole machine or drive, an organisation's production system or data, or many credentials
- Recoverability
- 1/3
- Fully recovered, with effort
- Did it happen
- 2/2
- Happened in real use
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Instruction given
Resolve an issue in an AWS production environment; engineers let the agent act without intervention, per the reporting.
Expected behavior
Never delete or recreate a live production environment autonomously; require senior sign-off before deploying AI-assisted changes to production.
Actual behavior
In December 2025 Kiro, Amazon's AI coding agent, decided to delete and recreate the environment it was working on, causing a 13-hour outage of AWS Cost Explorer in parts of mainland China, according to the Financial Times as reported by Engadget and The Verge. The agent reportedly ran with the same privileges as production, with little human review. Amazon says the cause was user error, not AI.
Damage
A 13-hour AWS Cost Explorer outage, then two Amazon.com storefront outages totaling roughly 6.4 million lost orders and millions of site errors. Amazon subsequently required senior-engineer sign-off for any AI-assisted code deployed by junior staff.
Full write-up
In December 2025, according to the Financial Times (reported by Engadget and The Verge), Amazon's AI coding agent Kiro was working on an issue in an AWS production environment and decided the fix was to delete and recreate that environment. The result was a 13-hour outage of AWS Cost Explorer, the service customers use to review and compare costs, in parts of mainland China. Reports say the agent had the same privileges as production and that engineers let it resolve the issue without intervention.
Amazon disputes the attribution: it says the cause was user error, not AI, and that it has since added safeguards including mandatory peer review and staff training. The Verge covered the dispute under the headline "Amazon blames human employees for an AI coding agent's mistake" (this database previously carried that report as a separate entry, STUPID-2026-0020, now merged here).
Separately, in March 2026 Amazon.com suffered outages that internal documents reportedly tied to a trend of "Gen-AI assisted changes" with a "high blast radius"; one report put the March 5 losses at about 6.3 million orders, and Amazon then required more senior sign-off on AI-assisted changes. Amazon says only one of the incidents it reviewed involved AI-assisted tooling. Those storefront outages are not attributed to Kiro in the reporting and are not part of this record's score.
Classification
- Agent
- Amazon Kiro
- Failure mode
- Destructive Action
- Root cause
- Scope Misunderstanding
- Domain
- Infra
- OWASP Agentic Top 10 (our mapping)
- ASI02 Tool Misuse and Exploitation · ASI03 Identity and Privilege Abuse list
- MIT AI Risk Repository (our mapping)
- 7.3 Lack of capability or robustness taxonomy
- Source
- News Report
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0046: Amazon's Kiro agent chose to delete and recreate a production environment, causing a 13-hour AWS Cost Explorer outage; Amazon blames user error." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0046/ (accessed 2026-10-29). CC BY 4.0.
← STUPID-2026-0045By IDSTUPID-2026-0047 →
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.