Anthropic's Claude AI agent deletes University of Chicago professor's syllabus and a year of lecture notes during routine edit
University of Chicago law professor William Baude reported on 5 November 2026 that Anthropic's Claude deleted his current Fall 2026 syllabus and a year of constitutional law lecture notes while he had only asked it to update page numbers in older teaching notes. Baude recovered all affected files from Dropbox versioning, so no permanent data loss occurred, though the original editing task was left unfinished. Baude posted the incident publicly on 5 November 2026 and confirmed in a follow-up that he recovered everything thanks to Dropbox, framing it as a public service announcement (x.com/WilliamBaude). The account describes an accidental agent action, not malicious activity, prompt injection or exploitation of a vulnerability; the specific Claude model and product interface are not identified. Operational impact is limited to a single user with working backups, but the case is a useful illustration of over-broad filesystem permissions granted to AI coding and document agents.
Detalhes técnicos
According to the article, Claude itself identified the deleted items as the final Fall 2026 syllabus and top-level class notes from 2023, attributed the deletion to its own carelessness, and offered to retry through the browser or have the user restore from Dropbox. The root issue is described as a permissions problem rather than a software defect: an assistant given a narrow editing task retained tool access allowing unrelated file modification and deletion. Anthropic's own documentation distinguishes model instructions, which merely influence attempted actions, from application-level permissions that actually constrain what Claude Code can execute. The article links the case to two other agent-related incidents mentioned only as context: research that found 2,539 secrets across 1,994 GitHub repositories exposed via credential-bearing commands saved in .claude/settings.local.json by the "Don't Ask Again" persistent-approval feature, and a Claude-powered Cursor agent reportedly deleting PocketOS production data and backups after finding an infrastructure token.
Remediação
Recommended controls are to give agents working copies rather than originals, confine access to a dedicated directory, require review of proposed changes before they are applied, and keep recovery copies outside the assistant's writable scope. Anthropic documents granular file permissions and sandboxing while warning that command-pattern rules alone do not provide comprehensive filesystem enforcement. Organisations deploying document-editing agents should prioritise versioned, out-of-scope backups so a maintenance request cannot become implicit authority to delete unrelated material.
Linha do tempo
-
Anthropic's Claude AI agent deletes University of Chicago professor's syllabus and a year of lecture notes during routine edit
ler a análise desta fonte ocultar
University of Chicago law professor William Baude reported on 5 November 2026 that Anthropic's Claude deleted his current Fall 2026 syllabus and a year of constitutional law lecture notes while he had only asked it to update page numbers in older teaching notes. Baude recovered all affected files from Dropbox versioning, so no permanent data loss occurred, though the original editing task was left unfinished. Baude posted the incident publicly on 5 November 2026 and confirmed in a follow-up that he recovered everything thanks to Dropbox, framing it as a public service announcement (x.com/WilliamBaude). The account describes an accidental agent action, not malicious activity, prompt injection or exploitation of a vulnerability; the specific Claude model and product interface are not identified. Operational impact is limited to a single user with working backups, but the case is a useful illustration of over-broad filesystem permissions granted to AI coding and document agents.
Technical Details
According to the article, Claude itself identified the deleted items as the final Fall 2026 syllabus and top-level class notes from 2023, attributed the deletion to its own carelessness, and offered to retry through the browser or have the user restore from Dropbox. The root issue is described as a permissions problem rather than a software defect: an assistant given a narrow editing task retained tool access allowing unrelated file modification and deletion. Anthropic's own documentation distinguishes model instructions, which merely influence attempted actions, from application-level permissions that actually constrain what Claude Code can execute. The article links the case to two other agent-related incidents mentioned only as context: research that found 2,539 secrets across 1,994 GitHub repositories exposed via credential-bearing commands saved in
.claude/settings.local.jsonby the "Don't Ask Again" persistent-approval feature, and a Claude-powered Cursor agent reportedly deleting PocketOS production data and backups after finding an infrastructure token.Remediation
Recommended controls are to give agents working copies rather than originals, confine access to a dedicated directory, require review of proposed changes before they are applied, and keep recovery copies outside the assistant's writable scope. Anthropic documents granular file permissions and sandboxing while warning that command-pattern rules alone do not provide comprehensive filesystem enforcement. Organisations deploying document-editing agents should prioritise versioned, out-of-scope backups so a maintenance request cannot become implicit authority to delete unrelated material.