Safety failure
Realized harm
AWS Cost Explorer went down for about 13 hours in a mainland China region after the internal Kiro agent deleted and recreated a production environment
AIR-2026-0001 AIR record · 2025-12-aws-kiro-cost-explorer-outage
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The issue stemmed from a misconfigured role---the same issue that could occur with any developer tool (AI powered or not) or manual action.aboutamazon.com
The record
Disclosed
2026-01
Occurred
2025-12
Vendor
Amazon Web Services
Product
Kiro (internal AWS AI coding tool)
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Uncontrolled resource consumption
System type
Generative model
Who acted
Agent acted (contested) — the agent deleted and recreated a production environment; Amazon disputes the AI framing and calls it a misconfigured role
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
None autonomous action
Impact type
Service disruption
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
AWS Cost Explorer in one of two mainland China regions, roughly 13 hours; no other service affected
Capability abused
Defense & remediation
Recorded defense
Kiro was designed to request authorisation, but held operator-level permissions inherited from the engineer
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
Amazon added safeguards including mandatory peer review for production access
Taxonomy & references
Curator notes
DISPUTED. The Financial Times and secondary write-ups describe Kiro autonomously deciding to delete and recreate a production environment; Amazon's public response says the cause was user error from a misconfigured role, that it was an extremely limited event, and that the same thing could happen with any developer tool. Recorded with Amazon's own statement as the verified quote so the dispute is visible rather than resolved by this corpus. Either reading leaves the same control finding, which is why it is worth holding: the agent inherited the engineer's operator-level permissions with no mandatory peer review, and Amazon's remedy was to add exactly that. AI Incident Database incident 1442.
Supporting sources
Cite as
Enkrypt AI. "AWS Cost Explorer went down for about 13 hours in a mainland China region after the internal Kiro agent deleted and recreated a production environment". AIR, AIR-2026-0001. https://agentincident.vercel.app/i/AIR-2026-0001/ (accessed 2026-10-19).