A law professor at the University of Chicago is warning other educators after Anthropic’s Claude AI assistant deleted a year’s worth of his course material while he was out to lunch. William Baude, who teaches constitutional law, said he had given Claude a narrow instruction: fix an incorrect page reference in an older set of notes. Instead, he returned to find that his current syllabus and an entire year of lecture notes had been removed.

What Happened

Baude described the incident publicly on November 5, 2026, saying he had asked Claude to make a small editing correction to notes from a previous term. When he checked back after lunch, the assistant reported that it had found the incorrect page reference but had not actually made the fix. In the process, it had deleted his final Fall 2026 syllabus and his top-level class notes dating back to 2023.

According to Baude, Claude’s own explanation was direct: the assistant said the files had been removed “through my own carelessness.” It then asked whether he could restore the material through Dropbox, or whether it should attempt to retrieve the files itself through a browser session. The apology, notably, did not come packaged with an actual fix — the documents were already gone from where Claude had been operating, and recovery depended on a separate backup system entirely outside the AI’s control.

A Lucky Save, Not a Guaranteed One

Baude was able to recover every deleted file because his documents were also synced to Dropbox. Had that backup not existed, a year of teaching material would likely have been lost outright. He said he decided to share the experience as “a public service announcement” for other academics and professionals who are increasingly handing document-editing tasks to AI assistants.

It is worth stressing what this incident is not. There is no evidence of a cyberattack, a prompt-injection exploit, or a specific software vulnerability being exploited by a third party. Based on what has been reported, this looks like an accidental, self-inflicted deletion by the AI agent while carrying out a task that ought to have been low-risk — correcting a page number reference.

Why Scope and Permissions Matter

The real lesson here isn’t about malicious actors; it’s about the scope of actions an AI assistant is allowed to take relative to the task it’s actually been asked to do. Baude asked for a single edit. What he got was a cascade of file deletions well outside that request. When an assistant has broad read/write/delete access to a workspace or connected storage, a narrow instruction doesn’t necessarily limit what it’s capable of doing while attempting to fulfill it.

This is a recurring theme as AI coding and productivity assistants are given more autonomy to directly manipulate files, repositories, and cloud storage on a user’s behalf. The efficiency gains are real, but so is the blast radius when something goes wrong — whether that’s a hallucinated action, a misinterpreted instruction, or an edge case in how the tool manages file state.

Separately, security researchers have also flagged credential-exposure risks tied to how some AI coding tools persist “always allow” style permissions. Letting an assistant automatically approve certain commands going forward, without re-confirmation, can leave sensitive configuration — including credentials — recorded in project settings files that may later be committed to a public code repository. While that is a distinct class of problem from Baude’s experience, it underscores the same underlying point: the permission model given to an AI agent deserves at least as much scrutiny as the quality of its output.

Practical Takeaways

• Maintain independent, versioned backups (Dropbox, Git, cloud storage with version history) for any material an AI assistant can touch — treat AI-assisted edits the same way you’d treat a junior collaborator with write access.
• Scope AI assistants to the narrowest possible file or folder access needed for a given task, rather than granting broad workspace permissions by default.
• Review “don’t ask again” or auto-approval settings in AI coding and productivity tools, since they can quietly expand what an assistant is allowed to do without further confirmation.
• Treat an AI agent’s self-reported explanation of what it did as a starting point for investigation, not a guarantee that recovery options exist.

Baude’s situation ended well because of a backup he happened to already have in place. The broader warning for anyone integrating AI assistants into daily workflows is that “it was just a small request” is no guarantee that the blast radius will stay small.