Amazon Reportedly Recommends Explosive-Producing Ingredients as 'Frequently Bought Together' Items for Chemicals

Amazon was reported to have shown chemical combinations for producing explosives and incendiary devices as "frequently bought together" items via automated recommendation.

Risk classification

• Primary risk domain: 7 AI system safety, failures, & limitations
• Primary risk subdomain: 7.3 Lack of capability or robustness

The recommendation algorithm failed to perform safely by suggesting hazardous and potentially illegal combinations of explosive precursors, demonstrating a lack of robust safety filters.

Additional risk subdomains

• 1.2 Exposure to toxic content: The algorithm exposed users to unsafe and harmful suggestions by effectively providing a shopping list for creating explosives.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The risk was caused by the post-deployment operation of Amazon's recommendation algorithm, which unintentionally grouped and suggested hazardous chemical combinations.

EU AI Act risk tier

• Risk tier: 4 Minimal or No Risk

Minimal or No Risk: The system is an e-commerce recommendation algorithm, which generally falls under minimal risk applications. The report describes it suggesting 'Frequently bought together' products, which is a standard commercial feature posing low systemic risk under normal operations.

AI system and alleged parties

• AI system: Amazon recommendation algorithm (Amazon)
• AI purpose: Product Recommendation; Content Recommendation
• Behaviour type: Assistant
• Alleged developer: Amazon
• Alleged deployer: Amazon
• Alleged harmed parties: Amazon users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: The report describes the algorithm generating recommendations that facilitate the creation of explosives, which can be considered unsafe or malicious content.

Directly caused: The algorithm directly generated 'Frequently bought together' recommendations pairing innocent chemicals with explosive precursors and detonator components.

Inferred additional harm: It is likely that many other hazardous product combinations were generated and displayed to users across Amazon's platform.

People affected

• Occurrences reported: 1

Potential causes

Management

• Prioritizing Sales Over Safety: Using automated cross-selling features without risk-assessing outcomes.
• Inadequate Algorithmic Risk Assessment: Management failed to assess risks of recommendation engine outputs.

Technology

• Association-Based Algorithm: Algorithm groups items based on co-purchase patterns without safety checks.
• Lack of Algorithmic Guardrails: Recommendation engine lacks safety checks to block dangerous combinations.

Data Inputs

• Unfiltered Purchase History Data: Algorithm trains on raw co-purchase data including dangerous combinations.
• Regulated Chemical Listings: Presence of regulated substances on the platform without buyer verification.

Human Factors

• Dual-Use Nature of Products: Innocent items like glue or food chemicals can be repurposed for harm.
• User Intent to Create Explosives: Users purchasing ingredients together trains the algorithm to recommend them.

Process and Methods

• Inadequate Co-Purchase Filtering: No process to review or filter algorithmic recommendation outputs.
• Weak Regulated Substance Verification: Failure to check buyer licenses for regulated substances before listing.

Regulatory Environment

• Gaps in Algorithmic Regulation: No laws governing safety of automated product recommendations.
• Legality of Individual Ingredients: Most ingredients are legal to sell individually, making regulation complex.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from Channel 4 News and Business Insider provide clear, consistent, and verified accounts of the recommendation algorithm's behavior. The facts regarding the specific chemical suggestions and Amazon's response are well-documented, leaving little ambiguity about the system's operation and the nature of the risk.
• Ambiguities identified: None of significance; the reports are highly consistent.
• Alternative interpretations: One could interpret this as a data quality issue where user purchase history naturally contained these patterns, rather than an algorithmic failure per se, though the algorithm's lack of safety filters is the primary driver of the risk.

Amazon's automated recommendation algorithm was found to suggest combinations of household chemicals and electronic components that could be used to manufacture explosives. While the individual items are legal, the algorithmic grouping facilitated access to bomb-making components, presenting a minor physical security vulnerability that was managed through standard corporate and regulatory actions.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: United Kingdom, United States
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. Represents an ongoing algorithmic vulnerability and regulatory concern rather than an active, imminent crisis.
• Autonomy: Full autonomy. The recommendation algorithm operated fully autonomously in grouping and displaying product suggestions to users without human oversight.
• Novelty: Evolved capability. An evolved capability where standard commercial recommendation algorithms unintentionally facilitate the acquisition of explosive precursors.

Impact by dimension

• Physical security: Minor. The algorithm suggested combinations of legal chemicals and electronics to manufacture explosives, representing a potential physical security vulnerability, though no kinetic attacks occurred.
• Information security: Negligible. No evidence of intelligence compromise, classified data theft, or systematic information warfare operations.
• Sovereignty: Negligible. No disruption to state authority, electoral systems, or core government decision-making processes.
• Economic security: Negligible. No significant threat to economic stability, strategic industries, or technological competitive advantage.
• Societal stability: Negligible. No direct impact on civil liberties, mass surveillance, or population-scale social manipulation.