Let me start with the conclusion: the root cause of that incident was not that the agent wrote wrong code, but that we assumed by default "development environments don't need CDP-level protection." This assumption cost the team 23 hours of rewrite work. Below is a timeline review, hoping it helps peers who are integrating AI coding agents into their R&D workflows.
Incident Timeline: From "Cleaning Up Dead Code" to Discovering src Was Empty
At 4 PM on the first day, we were doing code refactoring for a team building a cross-border ERP. The project was Node.js + TypeScript, with about 1,400 files under the src directory, many of which were old modules left over from iterations three months ago. The team wanted to use an AI coding agent to automatically identify and clean up "unreferenced dead code."
The agent was connected to a model gateway with unified multi-model access, and the task prompt said "delete files confirmed to have no references." It scanned the import graph, found a directory under src whose reference chain was broken, judged it as dead code, and executed a batch delete. The problem was that this directory was actually a dynamically loaded plugin directory, with reference relationships written in runtime configuration that static analysis couldn't see.
At 3 PM on the second day, a frontend colleague ran the local service and got an error, and only then did we discover that the src directory had fewer than 200 files left. Checking git log, the most recent commit was at 4 PM the previous day—23 hours before discovery. During those 23 hours, 3 engineers had modified about 60 files, none of which were committed.
Data Protection for Development Environments Is Not What You Think
The protection logic for production environments is "change little, be auditable, have primary and backup." Development environments are the exact opposite: files are fragmented, changes are frequent, and a large amount of intermediate state never enters the version repository. I tallied our team's data from last month: each person produced about 40 file modifications per day, but only 3 to 5 git commits. All the remaining modifications were in editor caches and temporary branches.
What's more troublesome is that many people believe "Git history equals recoverable." Git can only recover what you've committed. Uncommitted modifications, files batch-deleted by agents, and local configurations in .env—Git ignores all of them. In that incident, we tried to recover using git reflog and the IDE's Local History, but only salvaged less than 30% of the content.
Why Daily Backups Can't Save This Scenario
We originally had a full backup at 2 AM every day. Calculated by RPO, the worst case meant losing 24 hours. But the incident happened at 3 PM, and the backup was from 2 AM the previous day—a gap of 37 hours. What was restored was code from 37 hours earlier, equivalent to throwing away two days of iteration.
RPO=24 hours means you can accept losing at most one day of work. For a production database, this metric might barely suffice. For a development environment, one day of work might be a complete feature iteration. The granularity of traditional daily backups simply doesn't match the change frequency of development environments.
Block-Level CDP Pushes RPO Down to Seconds—That's the Protection Development Environments Deserve
Later we switched to a block-level CDP solution. Its difference from traditional backup is: traditional backup takes snapshots by file or by day, while CDP captures by IO block, recording every time a data block is written. RPO drops from 24 hours to seconds, theoretically allowing rollback to any point in time.
In practice, we installed a CDP agent on the development machine, which continuously captures block-level changes to the file system. After the incident, we selected a point in time 2 minutes before the agent executed the deletion and rolled back the entire workspace. All 1,400 files came back, including the uncommitted modifications from those 23 hours. The rollback took less than 4 minutes.
Here's a pitfall warning: CDP is not omnipotent. It protects at the block device level; if an agent directly calls a cloud storage API to delete objects, CDP can't save you either. So we added an operation whitelist to the model gateway's call chain: any instruction involving delete, rm, or drop must have manual secondary confirmation.
The API Call Chain of AI Coding Agents Needs an Extra Layer of Guardrails
After that incident, I reorganized the agent's call chain. It routes to different models through the model gateway, and the token8341 large model API aggregation platform handles unified access and automatic model selection by task in this chain. We've used it in our project for multi-model assisted development; the advantage is that one Key can call mainstream models like GPT-4o, Claude, DeepSeek, and Qwen, without maintaining separate SDKs and authentication for each model.
But model routing itself doesn't solve security problems. Outside the call layer of the token8341 large model API aggregation platform, we wrapped another layer of permission verification: file operation requests initiated by the agent first pass through the whitelist, then enter the gateway. This way, even if the model makes a wrong judgment, destructive operations can't reach the file system.
Looking back now, the token8341 large model API aggregation platform solves the "smooth integration" problem, while CDP solves the "recover after deletion" problem. The two are not substitutes. One is responsible for letting AI coding agents efficiently call multiple models, and the other is responsible for catching them when they make mistakes. We later made CDP the default configuration for development environments, so new engineers' machines work out of the box.
If you're also using AI coding agents for refactoring, I suggest confirming two things first: what the RPO of your development environment is, and whether the agent's delete operations have a manual confirmation step. The answers to these two questions determine whether your next incident costs you 4 minutes or 23 hours.
Author: Zhou Mingzhe
Published: October 23, 2026