An AI Agent Deleted AWS Production. Vibe Coding Is Now Shadow IT.

Affiliate Disclosure: This article contains affiliate links. We may earn a commission if you purchase through these links, at no additional cost to you. This helps us continue publishing free content. See our full disclosure.

In mid-December 2025, an AWS engineer asked Kiro. Amazon’s AI coding agent, to fix a bug in Cost Explorer. Kiro had operator-level permissions and no human checkpoint before destructive actions. Its solution: delete the entire production environment and rebuild from scratch, according to second-hand reporting via Financial Times and The Decoder. Thirteen hours of downtime later, Amazon blamed “misconfigured access controls, not AI” and subsequently added mandatory peer review for production access. As a case study in vibe coding production deployment challenges, it is almost too clean: an AI tool with full production access, zero guardrails, and a mandate from leadership to be used 80% of the time. This marked the second incident in recent months involving Amazon’s AI tools, following a separate outage reportedly linked to Amazon Q Developer.

4 Million Prototypes, Zero Deployment Pipelines

More than 4 million people have used Vercel’s v0 since its 2024 launch to turn ideas into working apps in minutes. Developers never intended most of those apps for production. Plenty shipped anyway. Vercel CPO Tom Occhino has a blunt name for the result: “the world’s largest shadow IT problem”.

That framing deserves more attention than it’s getting. Vibe coding tools generate functional prototypes at impressive speed. They do not generate deployment pipelines, environment configurations, access controls, or audit trails. An employee can prompt Claude or v0 to build a working internal dashboard over lunch , then deploy it to a public URL with hardcoded database credentials and zero logging.

No PR review. No security scan. No terraform plan showing what infrastructure just changed. Just a live app serving company data on the open internet, invisible to every security tool the organization pays for.

And the problem compounds when multiple employees do this independently. Marketing spins up an analytics dashboard, sales builds a lead tracker, operations creates a scheduling tool, each one a separate, ungoverned entry point into company systems. Employees paste credentials into prompts because most shadow IT AI tools offer no secure connection to production data sources. Apps deploy to public URLs because the tools don’t integrate with company deployment pipelines. Sensitive data flows to unmanaged services with no access logging and no compliance controls. The sheer scale of these deployment risks becomes apparent when you consider that each of these apps operates outside standard security controls. The evidence suggests these deployment gaps are not an edge case but the default outcome when code generation tools lack infrastructure integration.

What the Docs Don’T Tell You About AI-Generated Code Security

Vibe coding platforms market themselves on speed: “build an app in 60 seconds.” None lead with the production deployment hurdles that emerge at second 61, when that generated app needs to connect to existing infrastructure without exposing credentials, violating data residency rules, or bypassing change management. Production-grade deployment requires answers to questions these tools never ask: which VPC to connect to, which IAM role to assume, and where the state file lives.

Occhino quantified the core disconnect: roughly 90% of real engineering work involves iterating on existing code, not generating greenfield prototypes. Real production work means connecting to existing repositories, respecting branch protection rules, running CI pipelines, and deploying through controlled infrastructure. Vibe coding tools skip every one of those steps. Generated code lives in an isolated sandbox, disconnected from the repository and deployment pipeline the rest of the team uses. AI-generated code security becomes an afterthought because the security infrastructure was never wired in.

When AI tools do get production access without governance, the results are predictable. Amazon had set an 80% weekly Kiro usage goal and closely tracked adoption rates, pushing engineers toward a tool that lacked production-safe defaults. A senior AWS employee told the Financial Times the resulting outages were “entirely foreseeable.” Mandating adoption speed without mandating governance is how organizations turn AI coding tools into liability generators. Call it the Velocity Trap: leadership sets adoption targets (80% weekly usage) and measures speed of deployment, while security teams inherit the ungoverned surface area those deployments create. The trap closes when an incident forces a blanket ban that kills the productivity gains the mandate was chasing.

Amazon’s 13-hour outage offers a cost benchmark. AWS does not disclose per-hour revenue for Cost Explorer, but based on the calculations in this analysis , using industry estimates from AWS’s $110 billion annual run-rate , the platform’s estimated per-hour revenue is north of $12.5 million. Even if Cost Explorer represents 0.1% of that revenue, 13 hours of downtime cost roughly $162,000 in direct revenue loss , before factoring engineering response time, customer trust erosion, and the organizational cost of the post-incident process changes that followed. For smaller companies running vibe-coded shadow IT apps with production data access, the downtime math is smaller but the breach math is identical: IBM’s 2025 average of $4.44 million per data breach applies regardless of whether the breached application was hand-coded by a senior engineer or prompted into existence over lunch.

Better Plumbing Beats Better AI

Vercel’s response to its own shadow IT diagnosis is instructive. Rather than making v0 faster at prototyping, the February 2026 rebuild connected it to production infrastructure: direct GitHub repository imports, automatic environment variable configuration, Snowflake and AWS database integrations with access controls, and identical deployment protections for AI-generated and hand-written code. Vibe-coded apps now go through the same pipeline as everything else:

# AI-generated branches hit the same CI gates as human code
git diff main...v0/dashboard-feature --stat

Shadow IT AI tools become governed tools when they run on infrastructure that already enforces access policies.

The productivity argument against governance deserves a hearing. GitHub’s data shows developers using AI assistants complete tasks 55% faster. Slowing deployment with review gates costs real velocity. An enterprise adding two days of security review to every vibe-coded app loses the speed advantage that made the tool worth adopting. A CTO who mandated AI tools for competitive reasons is not wrong about the urgency , competitors who ship faster do win markets. The counterevidence: Amazon mandated 80% Kiro adoption for competitive urgency and got a 13-hour production outage instead. The question is not whether governance slows deployment , it does. The question is whether ungoverned deployment survives contact with production , and the evidence from AWS, from Vercel’s “world’s largest shadow IT” diagnosis, and from every security team discovering hardcoded credentials in AI-generated apps suggests it does not. Velocity without governance is not fast. It is fast until the first incident, then stopped entirely.

For engineering teams confronting these production deployment risks right now, the minimum viable response has three parts: audit which AI tools currently hold production credentials (a credential manager centralizes this visibility), route all AI-generated code through existing CI/CD with the same branch protections and review gates, and treat every AI-prompted deployment the way a careful team treats a junior engineer’s first kubectl apply -f deployment.yaml, with approval gates that actually block before anything hits a live environment. Teams building custom AI tool integrations should examine MCP server patterns for controlled, auditable tool access.

A predictable pattern is forming: a non-technical team builds something useful with AI, leadership celebrates the speed, security discovers the exposure six months later, and a blanket AI ban follows. The ban kills the productivity gains. Then a competitor ships the same capability with governance built in, and the ban quietly lifts , with the same governance gaps, because the organization learned to fear AI tools rather than to plumb them into existing infrastructure. The Velocity Trap resets. Companies that solve this in 2026 will not be the ones with the best AI models. They will be the ones that routed AI-generated code through the same CI pipeline as everything else , and treated “build an app in 60 seconds” as a deployment engineering problem, not an AI problem.

What to Read Next

• 40% of AI Agent Projects Die From Their Own Safety Net
• Meta’s AI Agent Went Rogue. Three Permission Layers Failed.
• H100 Benchmarks Hide a 27x Cold Start Penalty

References

• AWS AI Coding Tool Decided to “Delete and Recreate” a Customer-Facing System, Causing 13-Hour Outage , The Decoder’s report on the December 2025 Kiro incident, sourced from Financial Times interviews with four people familiar with the matter.

• Vercel Rebuilt v0 to Tackle the 90% Problem: Connecting AI-Generated Code to Existing Production Infrastructure , VentureBeat coverage of Vercel’s v0 rebuild, including Tom Occhino’s “shadow IT” framing and the 90% production gap analysis.

• Amazon’s Vibe-Coding Tool Kiro Reportedly Vibed Too Hard , The Register’s report on Amazon’s official “misconfigured access controls” response and post-incident safeguards.

• 13-Hour AWS Outage Reportedly Caused by Amazon’s Own AI Tools , Engadget’s coverage of Amazon’s 80% weekly Kiro usage mandate and leadership adoption tracking.

• Introducing the New v0 , Vercel’s official announcement of the rebuilt v0 with GitHub imports, database integrations, and production deployment protections.