Log in
University of Chicago law professor William Baude says Anthropic’s Claude AI deleted his current syllabus and a year of constitutional law lecture notes while performing a routine editing assignment.
Baude disclosed the incident on November 5, 2026, explaining that he had requested page-number updates in older notes. Instead, he returned from lunch to find the teaching materials missing.
He subsequently recovered every file through Dropbox, preventing permanent data loss. The specific Claude model and execution environment remain unidentified.
Claude AI Deletes One Year of Lecture Notes
According to CSN, Claude identified the deleted documents as his final Fall 2026 syllabus and top-level class notes from 2023. The assistant also reported an incorrect page reference but acknowledged that it had not edited the notes, leaving the original assignment unfinished.
Claude accepted responsibility, saying it deleted the files “through my own carelessness,” before asking whether Baude could restore them through Dropbox or whether it should retry through the browser.
The available account does not establish malicious activity, an exploited software defect, or indirect prompt injection.
That distinction matters because separate Claude browser research describes attacker-controlled email instructions leading to JavaScript execution inside authenticated sessions. Baude’s disclosure instead describes accidental destruction during authorized work.
Without execution logs, permission settings, or a reproducible sequence, attributing the deletion to any particular security mechanism would exceed the evidence.
The incident illustrates why authorization must remain separate from an assistant’s interpretation of user intent. Related research into cross-machine remote code execution describes malicious extensions submitting commands through trusted Claude communication paths.
Those findings do not explain Baude’s experience, but they demonstrate how privileged execution channels can amplify unintended or unauthorized actions once an assistant controls tools beyond its immediate task.
Another technical example involves DNS TXT payload delivery, where researchers described Claude Code following misleading setup instructions into executing a reverse shell. Unlike Baude’s accidental deletion, that scenario involved adversarial manipulation.
Both contexts nevertheless emphasize the importance of constraining executable actions independently of conversational instructions, particularly when agents can access local files, launch subprocesses, or inherit credentials from their operating environment.
For document workflows, safeguards should include isolated working copies, narrowly scoped filesystem access, reviewable changes, and recoverable backups outside the agent’s writable area.
Anthropic’s Claude Code documentation distinguishes model instructions from enforced permissions and warns that command-pattern rules alone are not complete security boundaries. Operating-system sandboxing provides stronger enforcement across subprocesses.
Baude’s successful Dropbox recovery demonstrates the practical value of an independent restoration path: the assistant’s admission explained the mistake, but a separate service restored the missing material. Recovery planning therefore belongs alongside access control before granting agents write access to important records.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
The post Anthropic’s Claude AI Accidentally Deletes One Year of Lecture Notes and Class Syllabus appeared first on Cyber Security News.
