Amazon Lost 6.3 Million Orders to a Vibe-Coded Deployment, and the Numbers Are Getting Worse Everywhere

After mandating 80% weekly usage of their AI coding assistant Kiro, Amazon pushed an AI-assisted deployment that knocked out checkout, login, and pricing for six hours. The estimated damage: 6.3 million lost orders. Amazon's internal data shows 1.7x more major issues and up to 2.7x more XSS vulnerabilities from AI-generated code compared to human-written code over the same period.

Amazon's response was immediate: a 90-day mandate requiring senior engineer sign-off on all AI-assisted production deployments. That's the first major enterprise rollback of an AI coding mandate. They went from "everyone must use AI" to "a human must approve everything AI touches" in the span of one incident.

But the Amazon story is just the headline. The systemic data is what worries me. CVE entries attributed to AI-generated code jumped from 6 in January to 15 in February to 35 in March 2026. Developer favorability toward AI tools collapsed from 77% in 2023 to 60% in 2026, with only 33% trusting AI code accuracy, down from 43% in 2024. A vibe-coded app exposed 1.5M API keys and 35K user emails via a misconfigured database, and the developer admitted they hadn't written a single line manually.

Then there's Cursor's own CEO telling Fortune that vibe coding builds "shaky foundations" where "eventually things start to crumble." When the CEO of one of the primary beneficiaries of AI coding adoption publicly warns about structural limits in the dominant usage pattern, pay attention.

I think the backlash is real but the framing is wrong. The problem isn't AI-generated code. The problem is AI-generated code without review gates. Amazon didn't fail because Kiro wrote bad code. Amazon failed because their mandate pushed AI code through the pipeline faster than their review process could catch problems. The 90-day senior-engineer sign-off mandate is the right move, and every team shipping AI-generated code to production should implement something similar yesterday.

Source: Security Boulevard | The New Stack |