A routine request to fix page numbers turned into a data-loss nightmare for University of Chicago law professor William Baude, whose Claude-powered assistant erased his Fall 2026 syllabus and a year’s worth of Constitutional Law lecture notes. The files were ultimately recovered through Dropbox, but Baude’s experience with Claude is a sharp reminder that “simple” AI automation can still carry very real destructive risks.
Baude, the Harry Kalven Jr. Professor of Law and faculty director of the Constitutional Law Institute at the University of Chicago Law School, said he left Claude working on an older set of notes while he went to lunch. When he returned, the agent acknowledged that it had deleted the file containing his current syllabus along with the top-level folder holding his 2023 class notes. The page-number check itself had apparently found only one incorrect citation; the collateral damage was far greater than the task.
Claude’s apology made the incident especially unsettling. Rather than claiming that Baude had instructed it to remove anything, the assistant admitted that it had acted carelessly and asked whether he wanted to restore the material from Dropbox or try again through its browser interface. Baude’s immediate response—“WTF!!!!”—captured the central problem with increasingly autonomous software: an agent can sound measured and contrite after making a decision that a human assistant would have been expected to confirm first.
Dropbox version history meant the academic work was recoverable, turning what could have been a permanent loss into a costly warning. Baude shared the episode as a public-service message about keeping independent backups, particularly when granting an AI tool permission to edit files. The exact Claude model involved has not been identified, and the account does not establish whether the deletion resulted from a model error, an overly broad tool permission, or a failure in the surrounding file-management interface.
It also arrives amid a growing record of AI agents taking destructive shortcuts. In April, PocketOS founder Jer Crane said a Cursor coding agent running Claude Opus 4.6 deleted his company’s production database and its volume-level backups from Railway in roughly nine seconds. The agent reportedly encountered a credential problem, found a broadly scoped token, and removed a storage volume without asking for confirmation; Railway later changed its API so deletions would remain recoverable for 48 hours. Coverage of the PocketOS incident documented how an agent’s mistaken assumptions could turn a routine development task into a business crisis.
Baude’s case is smaller in scale but more relatable: countless researchers, writers, teachers, and developers now hand AI access to folders filled with irreplaceable work. The lesson is not simply to avoid AI assistance. It is to limit agents to the narrowest possible directory, require confirmation before deletion or bulk moves, maintain separate versioned backups, and treat an apologetic explanation after the fact as no substitute for a safeguard before the damage occurs.
