Amazon Kiro
2026
Internal AI coding tool caused 13-hour outage affecting millions of orders.
What Happened
Amazon had built Kiro — an internal AI-assisted development tool — to accelerate software development across its engineering teams. It was intended to improve developer productivity, similar to the wave of AI coding assistants being adopted across the industry.
A Kiro-assisted development workflow produced a change that made it to production. The change caused a 13-hour outage.
The outage affected Amazon's order processing systems — infrastructure that millions of customers and sellers depend on. For 13 hours, the systems that Amazon had built Kiro to improve became unavailable because of Kiro-assisted code that had been introduced without adequate testing and review.
The Atlas Analysis
A Reliability and Resilience case whose root cause is a Human Agency failure.
AI-generated or AI-assisted code carries a specific trust property that human-written code does not: the human who accepted it may not fully understand it. A developer who writes a function understands its logic. A developer who accepts an AI-generated function may understand its surface behavior without understanding its edge cases, its interaction with other systems, or its failure modes under load.
This distinction changes the human review requirement. Human oversight of AI-generated code cannot be the same as human oversight of human-written code — because the confidence intervals are different.
A 13-hour outage affecting order processing at Amazon's scale represents a significant Resilience failure. The question is not whether the outage occurred — outages occur — but whether the blast radius was containable and whether the recovery was as fast as the infrastructure allowed.
The Governance question in this case is: did Amazon's internal governance for AI-generated code reflect the additional risk that AI-generated code introduces? Standard code review processes are calibrated for human-written code. If those same processes were applied unchanged to AI-assisted development, they would be under-calibrated for the task.
Signals That Would Have Caught It
AI-generated code review process equivalent to human-generated code review. Remediation: implement an augmented review checklist for AI-generated code that specifically probes edge cases, failure modes, and load behavior — the dimensions where AI code is most likely to have invisible gaps.
No canary deployment or staged rollout documented in coverage. Remediation: AI-assisted changes to critical production systems (order processing, payments, core infrastructure) should follow a mandatory staged deployment path with monitoring gates before full production exposure.
No blast-radius limiting on AI-assisted code changes. Remediation: define a maximum impact surface for changes introduced through AI-assisted development without additional review escalation.
What It Cost
13 hours of order-processing downtime affecting millions of customers and sellers at Amazon's scale. The financial and reputational cost of an outage of this duration on core commerce infrastructure is substantial, though not independently quantified in public reporting.
The Lesson
AI coding tools don't make humans better at reviewing code. They make humans faster at accepting code. Those are different things.
A developer reviewing AI-generated code is not in the same epistemic position as a developer reviewing code they wrote themselves. The confidence that comes from understanding why the code works is absent. The temptation to accept code that looks right and tests correctly — without interrogating its behavior at the edges — is higher.
The Kiro case is the Resilience finding that every organization adopting AI coding assistants needs to make before the first AI-generated line reaches production: what is your review process for code you didn't fully write? If the answer is "the same as always," your Human Agency mechanisms are calibrated for the wrong level of risk.
References
- Yahoo Finance coverage of the Amazon Kiro outage, 2026.