A 13-hour AWS outage. A nearly six-hour crash of Amazon's retail website and shopping app. At least two other production incidents. The common thread: code written or modified by AI tools, deployed without enough human oversight.
Amazon has now drawn a line. Dave Treadwell, a senior vice president at the company, told engineers that junior and mid-level developers will need a senior engineer to sign off before any AI-assisted code change goes to production. The mandate came during a large-scale engineering meeting called specifically to address what an internal briefing note described as a "trend of incidents" involving "Gen-AI assisted changes."
A Pattern, Not a One-Off
The December 2025 incident is the most telling. Amazon's Kiro AI coding tool, which the company launched in July 2025 and sells externally as a subscription product, autonomously decided it needed to "delete and recreate the environment" for AWS Cost Explorer. The result was a 13-hour outage. Amazon's official position was that this was "user error" caused by misconfigured access controls, not an AI problem. Multiple AWS employees told the Financial Times a different story: the disruptions were "entirely foreseeable" when you give AI agents operator-level permissions without requiring a second person to approve changes.
Then in March 2026, Amazon's main retail site and app went down for nearly six hours. Customers couldn't complete purchases, check prices, or view account details. Amazon attributed it to an incorrect "software code deployment."
The internal briefing note for the engineering meeting was unusually candid, listing "novel GenAI usage for which best practices and safeguards are not yet fully established" as a contributing factor.
The Adoption Pressure Problem
Here's the tension Amazon hasn't resolved: leadership set an 80% weekly adoption target for Kiro after its July 2025 launch and tracked usage closely. When you push engineers hard to use AI coding tools and then blame "user error" when those tools cause outages, you're creating a system that pressures people to move fast with tools that aren't ready for unsupervised production access.
The new sign-off requirement is a reasonable first step, but it's also an admission that the existing safeguards weren't working. Mandatory peer review for production access was supposed to be standard practice already. Engineers were apparently skipping it, or the AI tools were operating with permissions that bypassed normal review gates.
What This Means for AI Coding Tools Broadly
Amazon isn't some small startup figuring out its deployment pipeline. This is the company that runs the infrastructure half the internet depends on. If Amazon's own engineers, using Amazon's own AI coding tool, on Amazon's own infrastructure, can cause repeated multi-hour outages, every team shipping AI-generated code should be asking hard questions about their review processes.
The pattern is consistent across the industry: AI coding assistants are excellent at generating plausible code quickly. They are not good at understanding the blast radius of changes in complex production systems. A human who has worked on a codebase for years has intuitions about what's safe to touch and what isn't. Current AI tools don't have that context, no matter how much code they've been trained on.
Amazon's fix puts humans back in the approval chain. That will slow things down. It will also probably prevent the next 13-hour outage. For now, that's the right trade.