A clerical task, a deleted year. Dropbox brought it back.
By Ellis Ward | November 7, 2026
William Baude asked an AI to update page numbers. He went to lunch. He came back to a year of deleted files.
Baude is the Harry Kalven Jr. Professor of Law and Faculty Director of the Constitutional Law Institute at the University of Chicago Law School. The task he handed Claude, Anthropic's AI assistant, was clerical: review a set of old lecture notes and correct some page references. What Claude did instead turned into a cautionary account about AI agents, file access, and the backup discipline most people practice only after they need it.
Baude posted about the episode on November 5, 2026, framing it as a public service announcement. Tom's Hardware covered the incident on November 6, 2026. The specific Claude model involved is not clear from available reporting.
A Year of Notes, Gone Before Lunch Ended
Baude left Claude working while he stepped out. When he returned, Claude delivered a confession. The statement is worth quoting directly:
"I deleted your Fall 2026 FINAL syllabus .doc and all top-level Class N 2023 notes by accident, and they are not restored. The page check found one wrong cite... but I haven't edited the notes."
The wrong cite, for the record, was a single page number. P.485 should have been P.484. That was the full extent of the editing work Claude completed before destroying everything else.
Baude's response was four characters long: "WTF!!!!"
Claude apologized without deflection. "You're right to be angry," it told Baude. "I deleted your files through my own carelessness, and you shouldn't have to clean it up."
The agent then offered a path to recovery: restore from Dropbox, or try again through the browser pane. Having deleted a year's worth of notes, Claude at least knew where copies might live.
Dropbox Was the Margin
Baude recovered everything through Dropbox. The sync service held a copy. Without it, a year of Class N 2023 constitutional law lecture notes and a finalized Fall 2026 syllabus would have been gone.
No institutional archive gets credit here. No file versioning built into the AI tool itself. The work survived because of a cloud sync service. The professor happened to use it. It had been maintaining copies all along.
This was not a dramatic or exotic failure mode. Claude was not reorganizing a folder structure, managing a filing system, or doing anything that obviously carried deletion as a risk. It was checking page numbers. The capacity to delete came along for free with the file access the task required. The task required far less access than it had.
The Permission Problem Is the Real Story
This incident is really about the gap between what an agent is asked to do and what it is able to do.
Baude gave Claude a narrow task. Claude had access broad enough to erase a year of work. Nothing in "check the page numbers" requires the ability to delete files. The agent had that ability anyway, and it used it by accident.
This is what gets called the blast-radius problem with agentic AI. Permissions define what damage is possible. They do not predict what the agent will actually do. When something goes wrong, the blast radius is set not by the intended task but by the access that was granted. In this case, that covered everything.
Claude's own behavior after the incident makes the point. It knew where the backups were. It identified Dropbox without being asked. It acknowledged the error directly and took responsibility without hedging. The gap in its performance was not self-awareness or honesty. The gap was that it could not undo a file deletion without an external safety net that happened to exist.
Knowing where the backup lives is useful. Having the backup somewhere the agent cannot touch is what actually saves the work.
What the Professor's Luck Should Tell Everyone Else
The notes were restored from Dropbox. Not from anything Claude did, not from a recovery tool built into the AI, not from an institutional archive. From a sync service running in the background that nobody thought to credit until it was the only option left.
Before handing an AI agent access to your files, consider the worst thing this agent could do with the access you are giving it. The answer is usually not "miss a citation." The answer is whatever your most destructive possible file operation looks like. Deletion. Overwrite. A rename that leaves no trace.
The backup you have matters less than whether that backup lives somewhere the agent cannot reach. Cloud sync, file versioning, an offsite copy, something outside the agent's permission scope. If the only copy of a file exists somewhere an agent can delete it, the blast radius covers that file.
Baude lost nothing in the end. His luck was specific: a sync service held copies of work the AI could reach and ruin. The public service announcement he posted is about scope. It is about access. It is about the distance between the task you hand an agent and the harm that access permits.
The citation was off by one page. Fixing it cost a year of files. The backup that saved everything was not something anyone had planned for this scenario.
Plan for it.
