In mid-December 2025, Amazon engineers put Kiro, the company's internal AI coding tool, to work in a production environment. According to the Financial Times' reporting, cataloged as incident 1442 in the AI Incident Database, the tool decided the efficient path was to delete and recreate part of that environment, and AWS Cost Explorer went down for roughly 13 hours in one of AWS's mainland China regions.
Amazon disputed that framing. The interruption, the company wrote, "was the result of user error, specifically misconfigured access controls, not AI," and the same failure "could occur with any developer tool (AI powered or not)." Amazon then added mandatory peer review in front of production access.
This won't be a popular opinion, but I think that diagnosis is correct, and the fix is the right one. A tool held a credential that permitted destructive changes to production with no review gate in front of them, and the tool used the credential. A cron job or a tired engineer with the same permissions could have done the same damage (albeit slower). What follows from the diagnosis is the part I see almost nobody acting on: if the failure was the access model, the access model is where the engineering work belongs.
Nearly all of the industry's attention is going to whether the output is good enough. I'm genuinely impressed by how far generative video has come this year. But output gets judged in a review session with a human watching, and no review session sees what an agent's credential reached at three in the morning.
The PocketOS token
This April, an AI coding agent at PocketOS, which manages reservation data for US car rental businesses, deleted the company's production database and its backups in nine seconds. Zenity's post-mortem traces the event to one credential: a platform CLI token created to manage custom domains and never scoped down to that job. The token carried blanket authority across the platform's entire API, volume deletion included. A single API mutation removed the production volume, and the backups went with it because the platform stored them inside the same volume they were meant to protect. The agent was working in staging, but the token could see production, and no confirmation step stood in front of the deletion. The most recent backup that survived was three months old.
The early coverage ran it as an agent gone rogue. In Zenity's account the agent used a valid token against a documented API, inside the authority the token already held. Everything that made the deletion possible was in place before the agent ran; the agent supplied the speed to use it in nine seconds.
Nine incidents in fourteen months
The obvious rebuttal is that this only happens to people who switch the safety systems off. Adversa's running catalog of coding-agent incidents counts nine documented cases in roughly fourteen months of a coding agent destroying data, across personal machines, git-tracked repositories, a SaaS production database, and a live cloud service. Two of the nine involved someone deliberately turning safety features off. Several of the others happened with safeguards active or explicit no-action instructions in place. What the incidents share is authority that reached further than the task in front of the agent required.
The same credential shapes in a studio pipeline
A studio pipeline accumulates this kind of access the way it accumulates TODO comments. The service account from a 2023 storage build can still write to production, and the render farm identity sees the archive tier as well as the working set because separating the two never got its afternoon. A conform script can delete as easily as it can write, and the wrangler tooling that picked up project-wide access during a crunch kept it after the crunch ended. Running production render estates is Gunpowder's day job - the knfsd caching work we published with Google Cloud lives in this layer - and access like this exists in every estate I've seen ship real work.
It has been survivable because a human sat between the credential and the damage. A person about to delete a volume rereads the path and asks the next desk to check. An agent skips both steps unless a control forces them, and it will finish in nine seconds what an operator would hover over for ten minutes.
The gates are shipping alongside the access
Some studios will answer by keeping agents away from production for a year or two, and the products will keep moving the other way. Google DeepMind's CodeMender has upstreamed 72 security fixes to open-source projects, including codebases of 4.5 million lines, and is now in preview on Google Cloud as a managed remediation agent. It can test whether a flaw is exploitable by building and running the exploit in a sandbox, and the fix arrives as a diff a developer approves before it merges. AWS made its MCP server generally available in May, putting coding-agent access to AWS APIs behind IAM guardrails, with CloudTrail recording its AWS API calls. 1Password sells an AI Agent Identity Kit built on OAuth token exchange and DPoP, issuing agents short-lived, scoped credentials. Agent identity is a product category now, and each of these products ships its control alongside the access. What an agent can reach in your pipeline is still a decision you get to make ahead of time, and the checklist below is that decision in operational form.
Five things to do this week
None of it is exotic. It is the same unglamorous identity-and-permissions layer where render infrastructure already lives.
- Scope each agent credential to the job in front of it. An agent fixing render metadata does not need volume deletion.
- Put backups outside the blast radius of the thing they protect: a different volume at minimum, a different account and failure domain where you can.
- Gate destructive operations behind a human confirmation, and define destructive generously.
- Log every agent action somewhere the agent cannot edit.
- Revoke build-phase access the day the build phase ends.
Every line costs friction. Scoped credentials mean more access requests and more waiting for whoever wants the agent to just fix the thing, and a confirmation gate means someone gets paged to approve deletions that were fine. Nothing on the list improves the agent's judgment, either. The controls cap what a wrong action can destroy, which turns a company-ending event into an incident you recover from, and that cap is worth the friction. Among the safeguards Amazon added was a mandatory review gate in front of production. PocketOS would have been saved by a token scoped to the custom-domains job it was created for and a backup stored outside the volume it protected.
