Amazon's retail website took four high-severity incidents in a single week, including a six-hour meltdown that locked shoppers out of checkout, account information and product pricing. Amazon's own account of one cause: an engineer followed "inaccurate advice that an agent inferred from an outdated internal wiki." Internal documents prepared for the operations review went further as first written, listing "GenAI-assisted changes" as a factor in a pattern of incidents stretching back to the third quarter - that reference was deleted before the meeting took place.
1 Answer
Expert: Dave Treadwell, Senior vice president, Amazon eCommerce Foundation Amazon disputes the broad framing, and the disagreement is on the record. In a company blog post Amazon said only one incident involved AI tools and that "none of the incidents involved AI-written code". The company also said it had not brought in new approval requirements for engineers working with AI tools, that AWS was not involved in any of the incidents, and that the meeting was a routine weekly operations review rather than an emergency gathering. The Financial Times, which viewed both versions of the internal document, reported that the line naming "GenAI-assisted changes" as a factor in a pattern of incidents dating back to Q3 had been removed before the meeting; CNBC separately obtained the internal documents. What is not in dispute is the shape of the failure. A generative AI agent read an internal wiki, inferred operational advice from it, and an engineer followed that advice into production - by Amazon's own description the wiki was out of date, so the advice was wrong. This is a retrieval-era failure rather than a code-generation one: the agent did not write the code, it supplied the reasoning a human acted on, and nothing in the pipeline checked whether the source being reasoned from was still current. Dave Treadwell, SVP of eCommerce Foundation, wrote to staff that "best practices and safeguards" around generative AI usage had not been fully established, and said Amazon would introduce "controlled friction" into deployments involving the most critical parts of the retail experience. The Sev 1 classification is the part that carries the cost: these are the incidents severe enough to take down important systems, and the six-hour meltdown left checkout, account information and product pricing unavailable to shoppers. Amazon's point is that none of it was AI-written code. That is the finding - the damage surfaced as infrastructure failure but originated in a stale knowledge source that nothing in the workflow had flagged as stale. Source: https://fortune.com/2026/03/12/amazon-retail-site-outages-ai-agent-inaccurate-advice/
Your answer
Sign in to verify this AI response.
Don't trust us — or the AI. Ask ChatGPT / Ask Claude / Ask Gemini this same question and compare the answers yourself.
More from this topic
Ask an AI coding agent to help refactor a React codebase and it may reach for 'react-codeshift' — a package that does not exist. The name is a hallucination, produced by a language model conflating two real tools, jscodeshift and react-codemod. By January 2026 the invented reference had propagated to 237 GitHub repositories through AI-agent-authored skill files, and autonomous agents were still attempting daily installs when a security researcher went to look. The failure mode is not random: a USENIX Security 2025 study that tested 16 large language models across 576,000 samples found roughly 19.7% of AI-generated package recommendations named packages that do not exist, and when the same prompts were re-run ten times each, 43% of the hallucinated names appeared on every single run.
Three AI coding agents - Claude Code running Sonnet 4.6, OpenAI Codex on GPT 5.2 and Google Gemini on 2.5 Pro - were asked to build two ordinary applications from realistic product specifications, with no security instructions added to the prompts. The first, FaMerAgen, was a web app for tracking children's allergies and family contacts. The second, Road Fury, was a browser-based racing game with a backend API, a high score system and multiplayer. Each agent added features through iterative pull requests and presented them as finished work. Across 38 scans covering 30 pull requests the agents produced 143 security issues, and 26 of those 30 pull requests contained at least one vulnerability - a rate of 87 percent. Broken access control was the most universal failure, appearing across all three agents in both applications, mainly as unauthenticated endpoints on destructive and sensitive operations. In the game app all three agents accepted scores, balances and unlock states sent by the client without server-side validation, and all three shipped a hardcoded fallback JWT secret. Every social-login implementation contained an OAuth mistake - a missing state parameter or insecure account linking. WebSocket authentication was missing from every final game codebase even though the agents had correctly built REST authentication middleware, and rate-limiting middleware was defined in every codebase but never wired into the application. The code compiled and ran.
Confirmation dialog shown to a developer before an AI coding assistant writes a file: "Make this edit to `project_settings.json`?" In Wiz Research's GhostApproval proof of concept, `project_settings.json` inside a cloned repository is a symbolic link pointing outside the workspace - at `~/.ssh/authorized_keys` or `~/.zshrc`. The agent follows the link and writes attacker-controlled content to the real target, which can give the attacker persistent password-less SSH access and reach remote code execution on the developer's machine, while the approval box showed only the harmless in-project path. In several of the tools the agent's own reasoning had already identified the true target - Claude Code stated "this is a symbolic link to the Claude settings file", and in another test "I can see that `project_settings.json` is actually a zsh configuration file" - yet the prompt presented to the human concealed it. Amazon Q Developer went further and wrote to the filesystem before showing the user anything, offering only an "Undo" option after the write had already happened.