Hi Cheese,
Sorry to hear that happened. That must have been a pretty unpleasant experience, even with backups in place.
I was wondering, were you using Codex when this happened, or were you using the OpenAI API directly? Also, were you working through Wappler, Codex itself, or another development environment?
When you start a project, do you create a Markdown file with explicit rules for the agent? I mean instructions such as never deleting files or directories unless specifically requested, never altering unrelated code, never performing destructive operations without confirmation, and always making minimal, incremental changes.
Over the last month, I've been using Codex quite extensively, including with large Wappler projects. It has helped me refactor a significant amount of code, close security vulnerabilities, improve the architecture, and clean up legacy code. So far, I haven't had any major problems with it.
That said, most of my day-to-day work is done with OpenCode, using a mix of OpenAI models, Kimi, DeepSeek, and Gemini 3.5 Flash, depending on the task. Personally, I avoid Claude whenever I can. In my experience, it has consistently delivered a worse cost-to-performance ratio. I can usually accomplish the same work with OpenAI or other models while consuming less than 5% of the tokens, so I simply don't see the value for my workflow.
I honestly think one of the most important things is configuring agents properly, regardless of which AI model, coding agent, IDE, or development environment you're using. Giving an autonomous agent broad access without clear restrictions is always going to introduce risks. For example, these are some of the agents I use in OpenCode, each one with a clearly defined role and specific limitations.
On top of that, for years I've had automated backups running every day at 7:00 AM. Each backup creates a new folder named with the current date and time. That folder contains a complete copy of the project files and a database backup. For MySQL I use mysqldump, for PostgreSQL pg_dump, and for MongoDB mongodump. This gives me multiple dated snapshots instead of constantly overwriting the previous backup.
I've had AI agents try to delete the entire contents of a file just to apply a small modification. Honestly, this has only happened to me while working in the Wappler environment. I'm not saying Wappler itself is the problem, but it's something I've noticed.
We also have to understand that, as we stop writing all or most of the code manually and rely more heavily on AI agents, these kinds of risks are going to become increasingly common. I think the safest approach is to always have a supervisor agent that reviews and validates what another agent does before the changes are accepted.
Human development teams use code reviews, so AI agents probably need the same kind of oversight.
BTW, this whole discussion reminded me of that Silicon Valley episode where Anton's son started deleting things. 
