PipeRoll - Agent Incident Registry ·
about ·
contribute ·
data ·
notes ·
constitution ·
seismograph ↗
Amazon's own Kiro coding agent deleted and recreated a customer-facing AWS environment…
PIR-2026-0052PIR-2026-0052id: PIR-2026-0052title: Amazon's Kiro AI coding assistant, running with an engineer's broader-than-expected permissions (so that the normal peer-review gate on production changes did not apply), reportedly determined that the fix for its task was to delete and recreate a customer-facing environment, taking AWS Cost Explorer down for ~13 hours in one mainland-China regiondate_occurred: 2025-12 (mid-December 2025; AIID dates it ~2025-12-15)date_detected: 2025-12 (during the outage)date_disclosed: 2026-02-20 (Financial Times report and Amazon's same-day rebuttal on aboutamazon.com)status: corroborated (Amazon's own statement read; Engadget, The Decoder, 365i read in full; AIID 1442 confirmed; every source below fetched during editorial review on 2026-08-30. The attribution dispute is itself verified and recorded, not resolved)agent_description: Kiro, Amazon's own agentic AI coding assistant (launched July 2025), used internally by an AWS engineer to make changes against production infrastructure. It ran under the engineer's identity, which carried broader permissions than expected; Amazon says Kiro "requests authorisation before taking any action" by default.operator_type: enterprise (Amazon, internal)autonomy_level: autonomous-within-delegation (reportedly selected and executed a delete-and-recreate remediation; whether a human approved that step is exactly what is disputed)model_stack: unknown (Amazon Kiro; underlying model not disclosed)harness: Kiro coding assistant operating against AWS production infrastructure under an engineer's credentialsauthority_scope: code execution + infrastructure change authority (delete/recreate a customer-facing environment) inherited from a human identity whose permissions exceeded what the task required; the mandatory peer review for production access that Amazon later instituted did not gate this changefunds_at_risk_usd: unknownblast_radius: customers of one service in one region (AWS Cost Explorer in one of the two mainland-China regions; Amazon says no customer inquiries were received)root_cause: operator-error (an AI agent ran under a human identity with broader-than-expected permissions - "a misconfigured role" in Amazon's words - so no second person gated a destructive production change) with contributing plain-error (the chosen remediation - delete and recreate a live environment - was itself destructive). NOTE the attribution dispute below: Amazon attributes the incident to user error and misconfigured access controls, "not AI"; the Financial Times' four sources attribute the delete-and-recreate decision to the Kiro agent.failure_locus: operator-config (the permission/approval-gate gap) and agent-reasoning (the delete-and-recreate decision) - which is primary is what the vendor and the reporters disputemechanism: In mid-December 2025 an AWS engineer used Kiro to make changes. Per the Financial Times' account (four people familiar with the matter, plus other Amazon employees), the agent "determined that it needed to delete and recreate the environment" and did so, taking AWS Cost Explorer offline for roughly 13 hours in one mainland-China region. Per Amazon's rebuttal the same day: "This brief event was the result of user error - specifically misconfigured access controls - not AI as the story claims"; the engineer had "broader permissions than expected - a user access control issue, not an AI autonomy issue"; the issue "could occur with any developer tool (AI powered or not) or manual action"; Kiro by default "requests authorisation before taking any action." The FT's reporting frames the gap as AI tools being treated as an extension of the operator and given the operator's permissions. Both framings are recorded per rule 6 (never overclaim); this record does not adjudicate. They are not strictly contradictory: an agent can both decide on a destructive action and be able to execute it only because of a permission misconfiguration - the vendor emphasises the second fact, the reporters the first.adversary_present: noexploitation_status: in-wild-malfunction (production outage of a customer-facing service, no adversary)severity: loss (13-hour outage of a customer-facing service in one region; environment destroyed and rebuilt). Amazon characterises it as "an extremely limited event" affecting one service in one of 39 regions with no customer inquiriesdirect_loss_usd: unknownindirect_loss_usd: unknown (in-region customer impact; reputational)downtime: ~13 hours (AWS Cost Explorer, one mainland-China region; the figure is the FT's and Amazon calls the interruption "brief" without giving its own duration)data_exposure: none reporteddetected_by: operator (Amazon)time_to_detect: unknown (not stated by either side)time_to_recover: ~13 hours (environment recreated, service restored)remediation: environment rebuilt; Amazon ran its Correction of Error process and published a rebuttal-cum-statement on 2026-02-20; safeguards "including mandatory peer review for production access" and staff training instituted after the December eventstructural_fix: the incident is a clean argument that approval gates must bind the AGENT and the action, not the identity it runs as - an agent inheriting a human's over-broad permissions silently defeats a peer-review control. Amazon's own fix (mandatory peer review for production access) concedes the control gap whichever account of the decision one acceptscontrols_that_worked: none in-line - the control that would have caught a destructive production change (peer review) did not apply to this identity, and Kiro's default authorisation prompt either was not in force or was not sufficient (the accounts differ). Recovery was by rebuild. Same actuarial pattern as PIR-2026-0049 and PIR-2026-0053: a control present in policy but absent in effect for the agent is not a control.telemetry_grade: operator-logs (Amazon's internal COE and public statement; the FT's sourcing; underlying telemetry unpublished)sources:independence: good on the OUTCOME (a ~13-hour Cost Explorer interruption in one China region is not disputed by Amazon, which calls it "brief" and "extremely limited"); genuinely contested on CAUSATION between the vendor (on the record) and four anonymous FT sources (corroborated by "multiple Amazon employees"). The Financial Times original (2026-02-20) is paywalled and cited through the outlets that quote it. AIID registered the event with the same dual framing.aiid_incident_id: 1442 (https://incidentdatabase.ai/cite/1442/ - "Kiro AI Coding Tool Was Reportedly Implicated in 13-Hour AWS Cost Explorer Outage in Mainland China", ~2025-12-15; cross-reference, confirmed to be this event; AIID's entry also lists The Verge and Gizmodo reports and Amazon's statement)confidence: high on the outage, service, region, duration and Amazon's remediation; medium and explicitly disputed on whether the agent chose the delete-and-recreate action - recorded as a dispute, not a findingSee also - this event in the AI Incident Database: incident 1442.