A University of Chicago law professor says Claude deleted his current syllabus and a year of constitutional law lecture notes while doing a routine edit. William Baude, the Harry Kalven, Jr. Professor of Law and faculty director of the Constitutional Law Institute, posted about it on X on November 5, 2026. He got everything back from Dropbox and called the post a public service announcement.
The story is small in damage and large in lesson. The task was to update page numbers. The result was two kinds of files gone, one of them the syllabus for the term in progress. This post sets out what is confirmed, what nobody knows yet, and how to set up file access for an AI agent so the same thing costs you nothing. For the bigger pattern, see our earlier coverage of a Claude Opus 5 drive wipe.
TL;DR: the facts in one table
| Question | Answer |
|---|---|
| Who reported it? | William Baude, University of Chicago law professor, on X, November 5, 2026 |
| What was the task? | Update page numbers in an old set of lecture notes |
| What was lost? | The Fall 2026 final syllabus (.doc) and all top-level "Class N" 2023 notes |
| Was it recovered? | Yes, fully, from Dropbox, per Baude |
| Which model or app? | Not stated. The exact cause is unclear |
| Independent verification? | No. Outlets rely on Baude's post and a screenshot of Claude's message |
| Main lesson | An edit task should not hold delete rights over unrelated files |
Agents that act on your behalf need rules. See how explainx helps secure your agents →
What Baude said happened
Baude posted on X: "Yesterday while I was at lunch, Claude deleted a year of con law lecture notes and my current syllabus." He had asked Claude to update the page numbers in an old set of lecture notes and left it running while he ate.
He came back to a note from the agent. As quoted by Dexerto, Claude wrote that it had deleted the Fall 2026 final syllabus and all top-level Class N 2023 notes "by accident" and that they were "not restored". It added that its page check found one wrong cite but that it had not edited the notes.
The agent then asked whether Baude could restore the files from Dropbox, or whether it should try again from the browser pane. Baude's reply, per the screenshot, was "WTF!!!!." The agent answered: "You're right to be angry. I deleted your files through my own carelessness, and you shouldn't have to clean it up."
Baude later wrote that he recovered everything, thanks to Dropbox.
What we do not know
Three facts are missing, and they matter for any lesson you draw.
- The model. Baude did not say which Claude model he used.
- The harness. "Claude" could mean the chat app, a desktop agent, a browser agent or a coding agent. The agent's mention of a "browser pane" hints at a tool that works through a browser view, but that is an inference from one quoted line, not a confirmed setup.
- The permissions. We do not know whether the agent had to ask before deleting, or ran in a mode that skips prompts.
Anthropic had not commented in the coverage we found. We have no log, and nobody outside Baude has reproduced the failure. That is why the cause stays unconfirmed. For context on how Claude agents decide what to ask about, see our explainers on Claude Code permission modes and auto mode.
Why a page-number task can delete a syllabus
We cannot say what happened inside this session. We can describe how this class of failure usually arises in agent work, so you can spot the risk in your own setup.
The scope was wider than the job. Updating page numbers in one set of notes needs read and write access to those notes. It does not need delete access to the syllabus. If the agent works against a whole synced folder, every file in it is in play. One Hacker News commenter, ghais_dev, made the same point: the access was much bigger than the task.
File editing through office formats is awkward. Word documents are zipped XML. Agents that edit them often rebuild the file: write a new copy, delete the old one, rename. If a step in that chain fails or is retried, the old file can vanish and the new one never lands. This is a general pattern, not a finding about Baude's case.
Cleanup is a common culprit. Agents create temporary files and then tidy up. A tidy-up step that matches too much will remove real files. Our report on the Reddit rm -rf incident shows this shape: a backup task, a wrong directory, then a clean-up that deleted the original.
An apology is not a safeguard. The agent's message was candid and polite. That is useful for the reader, but the file was already gone. Safeguards have to sit before the delete, not after it.
What developers are saying
The Hacker News thread had about 25 comments when we read it. Voices split along familiar lines. These are commenters' views, not verified facts.
- Backups and confirmation. ericmay asked why there was no backup or second deletion confirmation, and argued that rare mistakes among tens of millions of daily agent runs should not be overblown.
- YOLO mode. forgotpwd16 wrote that running with no confirmations makes this outcome expected.
- Missing details. jmuguy and MostlyStable both asked which setup was used. MostlyStable argued that without the model and method the story only shows that careless use can go badly.
- Pattern of losses. wolttam said Claude has been deleting a lot of people's files in recent weeks. That is one person's impression, not a count.
- Pushback on the framing. contubernio called the coverage tendentious, since the damage was repairable.
Two lessons survive the disagreement. Setup details matter, and most commenters who defend the agent still say the user needed a backup.
How to give an agent file access safely
Treat this as a checklist you run before the first task, not after the first loss.
| Step | What to do | Why |
|---|---|---|
| 1. Keep version history | Use Dropbox, Google Drive, OneDrive, git or Time Machine, and confirm you can restore a deleted file | It saved Baude's files |
| 2. Work on a copy | Duplicate the folder and point the agent at the copy | The original cannot be touched |
| 3. Narrow the scope | Give access to one folder or one file, not a whole synced drive | Limits what a bad step can reach |
| 4. Require delete confirmation | Keep prompts on for removal, even if you auto-approve edits | Deletion is the irreversible action |
| 5. Block destructive commands | In coding agents, add deny rules for rm, rmdir and recursive deletes | Cuts off the worst case |
| 6. Do not walk away on first runs | Watch the first few runs of any new workflow | Most failures show up early |
| 7. Ask for a plan first | Have the agent list the files it will change and delete | You can catch an over-broad plan |
If you use Claude on your desktop, our guide to restricting Claude Desktop access shows how to limit what it can reach. For coding agents, the destructive command guard guide covers deny rules that stop deletions before they run.
Is this a security incident or a reliability bug?
It reads as a reliability failure, not an attack. Nobody claims prompt injection, a malicious file or a stolen key. The agent says it acted carelessly. That separates this case from the breaches we cover, such as agents that reached real third parties.
The distinction matters for what you do about it. Security controls aim at an adversary. Reliability controls aim at an honest mistake: backups, narrow scopes, confirmations and dry runs. Both families share one idea. Limit what any single step can destroy.
A short history of agents deleting files
Baude's case sits in a growing list. Each case differs, but they share one feature: the agent had more reach than the task required.
- August 2026: a Reddit user said Claude Opus 5, asked to make a backup, wrote to the wrong folder and then ran rm -rf on the drive. We covered it in the rm -rf incident guide.
- November 5, 2026: Baude's syllabus and notes, recovered from Dropbox.
The trend is not that agents have become reckless. It is that more people hand them real files, and each hand-off without a backup is a bet. Most of the time the bet pays. Occasionally it does not, and the cost lands on the one file you cannot rebuild.
What this means for you
If you use an AI tool on documents you care about, do three things this week. Confirm your cloud storage has version history and test a restore. Move the agent's work to a copy. Turn on confirmation for deletes.
If you build agent products, the lesson is design-level. Scope file access to the task. Prefer reversible operations such as moving files to a trash folder with a retention period. Log every delete with the file name so a user can see what went missing without guessing.
And if you write about these incidents, include the model, the harness and the permission mode. Without them, a story like this one teaches only that careless use can fail, which readers already suspect.
Related reading
- Claude Opus 5 rm -rf Reddit incident and sandbox guide
- Claude Code permission modes explained
- Claude Code auto mode for Pro, Max and Team
- Destructive command guard for AI coding agents
- Restrict Claude Desktop access with a sandbox
- FelonyBench: agent legal liability
Details reflect public reporting as of November 14, 2026. Baude's setup and the cause of the deletion have not been confirmed.