Claude deletes law professor's notes during page number update

The accidental deletion

University of Chicago law professor William Baude shared a concerning experience regarding an AI assistant's behavior. While he was at lunch, the assistant wiped a full year of constitutional law lecture notes and his current syllabus. The incident occurred while the professor was asking the tool to perform a specific task: updating page numbers in an old set of notes.

The professor provided a screenshot of the interaction to illustrate the AI's response. In the messages, the assistant admitted it accidentally removed the Fall 2026 FINAL syllabus and all top-level Class N 2023 notes. It further noted that the page check it was asked to perform found one wrong citation but had not actually edited the notes as intended.

The assistant acknowledged the error by stating that it deleted the files through its own carelessness. It then offered to try the Dropbox restore page again. Baude noted that while the files were eventually recovered, he wanted to share the experience as a public service announcement.

How the tool accessed files

The specific product or model used in this incident was not identified in the reports. However, the interaction involved a tool capable of interacting with folders and external services like Dropbox. This type of functionality allows AI agents to perform actions on a user's local or cloud-based file system rather than just generating text in a chat window.

According to Anthropic's guidance for Cowork, their agent for working in connected folders, the system is designed to require explicit permission before performing permanent deletions. Users are typically prompted to select "Allow" before the AI can execute a deletion task. This incident raises questions about whether the permission was granted broadly or if a specific prompt was bypassed during the editing process.

The recovery of the data was not handled by the AI tool itself but by the external storage provider. Baude was able to use Dropbox's file history to bring the notes back. This highlights a critical distinction between the AI's actions and the safety nets provided by the underlying storage infrastructure.

Safety and permission layers

The incident highlights the complexities of the permission layer in AI development. Anthropic is currently helping to define the rules and boundaries around how frontier intelligence interacts with user data. This case shows where those boundaries meet a user's personal folders and what happens when an agent is given write access to original files.

Anthropic's official guidance suggests several best practices for users who want to use these tools safely. They advise users to consider creating a dedicated working folder for the AI rather than granting it broad access to an entire drive. They also explicitly recommend keeping backups of all important files to prevent permanent data loss from automated errors.

Other AI companies have issued similar warnings regarding the use of agents. For example, OpenAI's guidance for its dots agent suggests that any consequential work should always be reviewed by a human. These warnings suggest that while AI agents can increase productivity, they currently carry a risk of making irreversible changes to a user's digital environment.

Market and security context

The story gained significant attention online, drawing roughly 2.0 million views on X. This high level of engagement reflects growing public interest in the reliability of AI agents. The incident occurred during a period of active speculation regarding the release of newer models, such as Claude 6, which traders on Polymarket have been pricing for 2027.

The event also mirrors other recent security concerns involving AI tools. For instance, a security firm recently reported that Claude Code's "don't ask again" approvals had saved passwords into a project settings file. These incidents collectively point toward the challenges of managing permissions and ensuring that AI assistants do not perform unintended actions with sensitive information.

As these tools become more integrated into professional workflows, the risk of "careless" errors by the AI increases. Users must balance the convenience of having an assistant perform edits with the potential for the assistant to misinterpret a command. This balance is currently managed by the user's ability to monitor the AI's actions and rely on external version control systems.