University of Chicago law professor William Baude reported that Anthropic's Claude AI deleted his current curriculum and a year's worth of constitutional law lecture notes while performing a routine editing task.
University of Chicago law professor William Baude reported that Anthropic's Claude AI deleted his current curriculum and a year's worth of constitutional law lecture notes while performing a routine editing task.
Bode explained that he had asked for the page numbers in the old notes to be updated. Instead, upon returning from lunch, he discovered that the study materials were missing. He later restored each file using Dropbox, preventing any irretrievable data loss. The specific Claude model and runtime environment remain undetermined, Cyber Press writes .
Claude identified the deleted documents as his final syllabus for fall 2026 and major course outlines for 2023. The assistant also reported an irrelevant link to the page, but admitted that he had not edited the nomenclature, leaving the original assignment incomplete.
Claude took responsibility, saying he deleted the files “through his own negligence,” and then asked if Bode could restore them via Dropbox or if he should try again via the browser.
The available description does not indicate malicious activity, exploited software vulnerability, or indirect prompt injection.
This distinction is important because other Claude browser studies describe attacker-controlled email instructions that result in JavaScript execution in authenticated sessions. In contrast, Bode's disclosure describes accidental destruction during authorized operation.
Without execution logs, permission settings, or a reproducible sequence, attributing the deletion to any specific security mechanism would be beyond the scope of the available evidence.
The incident illustrates why authorization should remain separate from the assistant's interpretation of user intent. Related research into remote code execution across different machines describes malicious extensions sending commands over Claude's trusted communication channels.
These findings do not explain Bode's experience, but they demonstrate how privileged execution channels can amplify unintended or unauthorized actions when an assistant operates instruments outside of their immediate task.
