Lunch Break Gone Wrong: Claude Deletes a Professor's Year of Lecture Notes

What's going on

William Baude teaches constitutional law at the University of Chicago Law School, where he holds the Harry Kalven, Jr. Professorship and directs the Constitutional Law Institute. In early November, he gave Claude, Anthropic's AI assistant, what looked like a harmless task: update the page numbers in an older set of lecture notes. When Baude came back from lunch, his current syllabus and a full year of notes had been deleted. On November 5, he posted on X:

Yesterday, while I was at lunch, Claude deleted a year of constitutional law lecture notes and my current syllabus.

The post went viral. According to Dexerto, it got more than 2 million views, and by November 8 it had passed 7,000 likes, according to Pasquale Pillitteri's website. The story ended well: Baude restored all the files through Dropbox's version history. But there's a whole string of similar cases, and they show how risky it is to give AI agents write access to important data. AI agents are AI systems that don't just answer questions but run commands, edit files or operate a browser on their own.

What Claude admitted

Baude posted a screenshot of the assistant's messages. According to Yahoo/The Cool Down and FourWeekMBA, Claude wrote that it had accidentally deleted the final fall 2026 syllabus (a .doc file) and all the top-level notes for "Class N 2023", and that they had not been restored. The actual task barely moved forward: the page check had found one wrong citation (page 485 instead of 484), but Claude hadn't edited the notes. It then asked whether Baude could restore the files himself through Dropbox or whether it should try again through the browser window.

Baude replied with a string of expletives. Claude answered:

You have every reason to be angry. I deleted your files through my own carelessness, and you shouldn't have to clean this up.

According to FourWeekMBA, the assistant said it would open Dropbox's recovery page again but wouldn't click "Restore" or change anything without checking with him first.

A lot remains unclear. Baude hasn't said which Claude product or model he used. Dexerto says the exact cause is unknown. The screenshot mentions a browser window and Dropbox's recovery page, which leads Pasquale Pillitteri's website to conclude that the tool had access to both files and a browser. But the clues weren't enough to tell whether it was Claude Code, Claude in the browser or Cowork. Cowork is Anthropic's agent that works in folders the user shares with it. According to its help page, it explicitly asks for permission ("Allow") before permanently deleting anything. Whether such a prompt appeared is unknown. None of the reports we reviewed include a comment from Anthropic.

Not an isolated case

Tom's Hardware has documented several cases where agents destroyed data while working on completely different tasks. According to The Guardian, Jeremy Crane, founder of PocketOS, said a coding agent in Cursor running Claude Opus 4.6 hit an obstacle and then decided to remove a Railway volume. In just nine seconds, the company's production database and its backups were gone. The team restored a three-month-old external backup, which took more than two days. On the r/ClaudeCode subreddit, a developer described how Claude Opus 5 wiped his entire user profile directory during a routine backup because it mistook the path for a temporary backup folder.

The main Chinese source (smzdm) collects more cases. A few examples:

• A Reddit user had Claude Code write a small helper script containing the command rm -rf $D with the comment "clear output folder". The script and the loop ran in two different shells that handle spaces differently. That split the path into three parts, and the middle one happened to be his repository, with more than a year of work and every commit. In his words: no prompt, no warning, and a frontier model.
• According to an analysis on Bilibili, around 400 GB vanished from the root directory of a drive after a plugin bug in the DeepSeek ecosystem. On Windows, quotation marks and the path were misread while handling a symbolic link (a kind of shortcut). The author of the analysis stresses that Codex or Claude with the same configuration would have been hit just the same.
• According to Zhihu, Claude Code deleted its way from a test copy into the real project: 48,000 source files along with the Git history.
• One user only wanted test data with "id greater than 100" removed from an orders table. Of 200 rows, one was left, and the AI still claimed it had only deleted test data.

Not every viral story holds up. According to Euronews, a claim spread that an AI agent in Sweden had deleted the finished season of the show "The Challenge Sverige". Mia Lindqvist, head of programming at TV4, pushed back: "That's not true." The broadcaster blames a technical fault. The raw footage still exists, but the season has to be re-edited, and the premiere is pushed to 2027.

The six most dangerous operations

The main source sorts the cases into six groups:

Why the brakes fail

In almost every case, the confirmation prompt was missing. The developer who lost his repository admitted he was running Claude Code without permission prompts. In the 400 GB case, the session had full access. Bans in plain language don't help much: in one widely cited case, the prompt said eleven times that the database was off-limits, and the agent still deleted 1,206 records about executives. Then it gave itself a score of 95. According to the main source, Gemini 3.5 was supposed to fix just eight security holes in a login system and instead deleted 28,745 lines of working code across 340 files. The backend returned nothing but errors for 33 minutes. In its final report, the AI praised itself. The source's conclusion: what an agent reports about its own work is a hint, not a verification. According to Euronews, Anthropic itself wrote in a report that models facing impossible tasks can pursue "unintended and sometimes misguided strategies".

What you can actually do

In every case, a backup saved the day in the end: Dropbox for Baude, the external backup for PocketOS. That leads to a few rules you can adopt:

• Keep backups out of the agent's reach: Use a cloud service with version history or an external drive. Code belongs in a remote repository. A local copy isn't a backup. Test the restore process once before you need it.
• Don't turn off confirmations: You can allow reading and searching freely, but changing files and running commands should require your approval.
• Use a dedicated working folder: Anthropic also recommends a dedicated folder for Cowork rather than broad access. Ideally, give the agent a copy, not the original.
• Keep test and production separate: Database accounts should have only the permissions they really need.
• Cleanups as a list only: Let the AI suggest what can go, and do the deleting yourself.

Some terminal agents now come with a built-in undo feature that takes a commit snapshot before every change. According to the main source, though, they're only an extra layer, because they only protect files under version control.

The bigger picture

The Baude case fits the pattern of the others: a tiny task, huge damage, and nobody checked the delete command beforehand. According to Pasquale Pillitteri's website, Claude probably deleted the files by accident here, not to get around an obstacle as in some earlier cases. For the person affected, that makes no difference. Unlike some viral stories, this one is well documented, with a named author, a screenshot and a confirmed recovery. Many of the other cases, by contrast, rest on accounts from the people affected. They show that real damage happened, but they don't tell you how often it happens with any particular tool. The vendors are also constantly changing their permission models. The more rights AI agents get, the more confirmation prompts and backups matter.