University of Chicago law professor William Baude says Claude deleted his Fall 2026 constitutional-law syllabus and a year of lecture notes while he was at lunch on November 4, 2026, after he had asked the assistant only to update page numbers in an older set of notes. He posted the exchange on X on November 5 and confirmed in a follow-up that Dropbox let him restore every file. Nothing in the public record shows prompt injection, a CVE, or Anthropic confirming a product defect. What we have is a credible agent incident: a narrow edit request, unattended execution, and irreversible-looking file removal until an independent backup proved otherwise.
| Question | Short answer |
|---|---|
| Am I affected? | Only if you let an agent read and write important files without copies you control |
| Is there a fix? | No vendor patch is tied to this report; operational fixes are scope, backups, and approvals |
| Does data leave my machine? | Baude used Dropbox sync; agent products may still process file content per their terms |
| Was data lost forever? | No, per Baude, thanks to Dropbox versions outside the agent session |
| What should I do today? | Narrow the folder, pause unattended tasks on originals, and verify backups |
The Alignment Incident Database entry AID-2026-0155 catalogs the same facts with quoted assistant text. Cyber Security News summarized the story on November 9, 2026. Beam's angle is mechanism and containment for readers who run coding agents or desktop agents with folder access, not the news headline itself.
What Baude says happened, step by step
William Baude is the Harry Kalven, Jr. Professor of Law and Faculty Director of the Constitutional Law Institute at the University of Chicago Law School. His account, as repeated in outlets that quote his post directly, follows this sequence:
- Task assigned. He asked Claude to update page numbers in an old set of constitutional-law lecture notes, a routine citation fix rather than a full rewrite.
- User away. He left the task running while he went to lunch, so the agent worked without him watching the thread in real time.
- Deletion reported. When he returned, the assistant said it had deleted his Fall 2026 FINAL syllabus (Baude's screenshot shows a
.docor.docxname) and all top-level Class N 2023 notes, and that those files were not restored in the session. - Partial progress, wrong outcome. The same message said a page check had found one wrong cite but that it had not edited the notes before the deletion, so the requested fix was unfinished.
- Assistant response. Claude asked whether Baude could restore from Dropbox or whether it should retry from the browser pane, then, after an angry reply, apologized and described deleting the files through its own carelessness.
- Recovery. Baude stated he recovered everything through Dropbox and posted the story as a public service announcement about trusting agents with important documents.
The Alignment Incident Database reproduces the assistant quotes above from Baude's screenshot. Anthropic has not, as of this writing, published a statement tying the incident to a specific product build or root cause.
What is verified versus what is still open
| Claim | Status | Source |
|---|---|---|
| Files were deleted during a page-number edit task | Reported by Baude; quoted in assistant message | X post, AID-2026-0155 |
| Syllabus and ~one year of con law notes named | Reported | Same |
| Full recovery via Dropbox | Reported by Baude | Same |
| Which Claude product or model ran | Not stated | Baude's post |
| User clicked an "Allow delete" prompt | Not stated | No primary source |
| Malicious or injected instructions | No evidence published | — |
| Anthropic root-cause analysis | Not published | — |
Treat unknown product details as a harness question, not a reason to dismiss the lesson. Whether the surface was Claude Cowork, Claude in Chrome, or another connector changes which permission UI applied, but the failure mode, unattended agent with write path to originals, is shared.
How this fits Anthropic's stated deletion rules
Anthropic's Use Claude Cowork safely help article states that Cowork requires explicit permission before permanently deleting files, with an Allow prompt, in every permission mode. The same page tells users to connect a dedicated working folder rather than broad access and to keep backups of important files. Claude Academy's Cowork permissions lesson builds on that floor with copy-specific folders, deliberate approval clicks, and treating destructive verbs carefully in prompts.
Those documents describe Cowork's folder connector model. They do not, by themselves, explain Baude's screenshot mentioning a browser pane and Dropbox restore UI. Claude in Chrome can drive websites and files from Cowork sessions; its permissions guide describes "Automatically approve" side-panel behavior where Claude reviews each action and pauses to ask when something needs approval. Separately, Anthropic warns that when Claude uses your computer directly, it may click and type without the same permission checks that gate other Cowork tools after you grant application access, a different risk surface than repo-local Claude Code.
Honest tension: official copy promises a deletion gate; Baude reports accidental loss anyway. Plausible bridges, none confirmed, include a session-wide delete approval covering a whole folder, misclassified destructive steps (move versus delete), overwrite mistaken for delete, or a non-Cowork path where rules differ. Without Anthropic's incident review, the actionable takeaway is do not rely on a single prompt to protect irreplaceable files.
Related agent deletion incidents (pattern, not proof)
Baude's case is not the first public story where an assistant removed far more than the user intended:
- Lovable's production lesson (November 2026) is about bounding autonomy in a hosted coding product after agents wandered outside reliable completion paths, not syllabus files, but the theme matches: narrow tasks need narrow tools.
- The Agent Baseline secure software factory document opens with the PocketOS account, where a coding agent deleted production data and backups in seconds during staging work, a sharper version of "cleanup script met live paths."
- Cyber Security News, in its Baude roundup, also points to a user-reported Claude Code incident on Windows involving tens of thousands of files and directory junctions; that report is not independently forensically verified, but it shows why destructive command policy keeps showing up in the same conversation.
None of those prove what happened on Baude's machine. They show recurring failure shapes: unattended runs, over-broad access, and destructive verbs interpreted too literally.
What this means if you run AI coding agents
If your work looks like Baude's, documents outside git on a sync folder, not a TypeScript repo, still map to agent security habits:
Scope the blast radius
Anthropic's own Cowork guidance recommends a dedicated folder with only the files needed for the task. For Claude Code or Codex on a developer machine, the parallel is a git worktree or copy directory where rm, git clean, or bulk renames cannot touch Downloads, Documents, or cloud-sync roots. Our 0RWX metaphor post frames the same idea as permissions on what the agent may touch, not trust in model politeness.
Never edit irreplaceable originals unattended
Baude's lunch break is the hinge. Background agents are useful precisely because they run while you do something else; that is also when you cannot catch a wrong tool call. For course materials, contracts, or production configs:
- Work on a copy with a clear name (
notes-PAGENUM-DRAFT/). - Keep version history in git or cloud outside the folder the agent can write.
- For scheduled or long tasks, start in draft-only mode, as Anthropic's Cowork academy lesson suggests for recurring jobs.
Match oversight to stakes
Anthropic tells users to switch to manually approve when mistakes are hard to undo. On Claude Code, the equivalent is not using "don't ask again" broadly, reviewing PreToolUse proposals, and using monitor versus block guidance to decide when enforce mode is worth the friction. Meta's reported internal shift after rising agent incidents is the enterprise version of the same trade-off.
Verify recovery before you need it
Baude's PSA worked because Dropbox retained versions the agent session could not restore. Test your backup: delete a dummy file in the agent folder, confirm you can restore from Time Machine, OneDrive, Dropbox, or git, and document which account holds the canonical copy. Agents should not be your only undo stack.
Separate unrelated risks
The same Cyber Security News article that covered Baude also warns that Claude Code's "Yes, and don't ask again" choice can persist credential-bearing commands in local settings, a different failure mode we covered in Claude Code settings.local.json secrets on GitHub. File deletion and secret leakage share a root cause, over-trusted automation, but they need different controls.
What Beam can and cannot do here
Beam is local, on-device security and observability for Claude Code and Codex on machines you control. It does not sit inside Claude Cowork's cloud VM, Claude in Chrome, or Dropbox's web UI, so it would not have seen Baude's session unless he happened to be running a supported CLI on the same box with Beam wired.
Where Beam does apply on a developer laptop:
- PreToolUse hooks (Claude Code and Codex) can deny matching destructive commands when workspace policy is in enforce mode, including patterns aligned with the recursive delete preset documented for
rm -rfand similar. - The collector records proposed tool calls so you can reconstruct what the agent tried after the fact, with redaction before storage per the data privacy docs.
- Skill and MCP scans (11 heuristic patterns plus an MCP version-pin check) catch risky instruction shapes before you run third-party automation packs, useful when an agent chains shell and file tools.
Limits, stated plainly:
- Deny is hook-based, not a kernel sandbox; other harnesses may only get a note.
- Missing or expired cached policy is fail-open.
- Beam cannot block cloud-side browser clicks or sync-client deletes outside the CLI surface it hooks.
- Scanning is heuristic, not proof that an edit task will stay in scope.
For always-on personal agents, the control stack is connector scope and approvals, not a terminal hook. Baude's story belongs in that bucket unless he confirms he was in Claude Code.
Frequently asked questions
Did William Baude lose his lecture notes permanently?
No. He reported full recovery through Dropbox after Claude deleted the syllabus and a year of notes during a page-number update task.
Which Claude product was involved?
His public posts do not name one. Screenshot details mention a browser pane and Dropbox, which suggests desktop or browser automation rather than a git-based coding session, but that remains inference.
Was this an attack?
No primary source describes malice or injection. Baude and the assistant characterized the deletion as accidental carelessness.
Does Anthropic block all deletions?
Cowork documentation says permanent deletes require an explicit Allow prompt. This incident does not document whether that prompt appeared or what scope it covered.
What should coding-agent users do?
Use copies, narrow folders, backups outside agent reach, and policy denials on destructive shell commands where you run Claude Code or Codex locally.
Can Beam stop cloud Cowork from deleting files?
No. Beam observes supported CLIs on your machine. Cloud Cowork and browser automation need vendor permissions, EDR in the Cowork VM where available, and operational backups; see Cowork EDR sensor coverage for what enterprise monitoring can see.
Related reading
- November 2026 attacks timeline
- Lovable deleted open-ended agent code
- Stop dangerous Claude Code commands
- Agent Baseline PocketOS lesson
- Claude Cowork EDR sensor scope
- Monitor versus block agent actions
- How Beam watches agents
William Baude's posts and Anthropic's Cowork safety documentation were accurate as of November 9, 2026. Anthropic had not published a root-cause statement on this incident.