{
 "public_id": "AIR-2026-0001",
 "incident_id": "2025-12-aws-kiro-cost-explorer-outage",
 "date_disclosed": "2026-01",
 "date_occurred": "2025-12",
 "title": "AWS Cost Explorer went down for about 13 hours in a mainland China region after the internal Kiro agent deleted and recreated a production environment",
 "class": "safety_failure",
 "attack_surface": "coding_agent",
 "initial_vector": "none_autonomous_action",
 "agent_capability_abused": [
  "infrastructure_modification",
  "autonomous_command_execution",
  "inherited_operator_permissions"
 ],
 "target_product": "Kiro (internal AWS AI coding tool)",
 "target_vendor": "Amazon Web Services",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "service_disruption"
 ],
 "blast_radius": "AWS Cost Explorer in one of two mainland China regions, roughly 13 hours; no other service affected",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI10",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "no_adversary",
   "production_change",
   "inherited_permissions",
   "no_peer_review",
   "vendor_disputes_account",
   "internal_tooling"
  ]
 },
 "defense_present": "Kiro was designed to request authorisation, but held operator-level permissions inherited from the engineer",
 "defense_bypassed": true,
 "fix_shipped": "Amazon added safeguards including mandatory peer review for production access",
 "primary_sources": [
  "https://www.aboutamazon.com/news/company-news/amazon-response-financial-times-story",
  "https://incidentdatabase.ai/cite/1442"
 ],
 "verified_quote": "The issue stemmed from a misconfigured role---the same issue that could occur with any developer tool (AI powered or not) or manual action.",
 "confidence": "high",
 "notes": "DISPUTED. The Financial Times and secondary write-ups describe Kiro autonomously deciding to delete and recreate a production environment; Amazon's public response says the cause was user error from a misconfigured role, that it was an extremely limited event, and that the same thing could happen with any developer tool. Recorded with Amazon's own statement as the verified quote so the dispute is visible rather than resolved by this corpus. Either reading leaves the same control finding, which is why it is worth holding: the agent inherited the engineer's operator-level permissions with no mandatory peer review, and Amazon's remedy was to add exactly that. AI Incident Database incident 1442.",
 "risk_category": "reliability",
 "risk_secondary": [],
 "risk_subcategory": "Destructive or irreversible action",
 "risk_sub_secondary": [
  "Load & Resilience Failures"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "the agent deleted and recreated a production environment; Amazon disputes the AI framing and calls it a misconfigured role",
 "vector_family": "none_autonomous",
 "vector_detail": "none_autonomous_action",
 "guardrail_kind": [
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1442
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI10",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "unsafe_actuation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [
  "uncontrolled_resource_consumption"
 ],
 "eai_reason": "subcategory: Destructive or irreversible action",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI10 (no adversary + unsafe actuation with no attacker-supplied trigger); ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}