Claude deleted a professor's lecture notes for an entire year: the AI admitted the mistake, stating it was "due to its own negligence

University of Chicago law professor William Baude reported that Anthropic's Claude AI deleted his current syllabus and a full year of constitutional law lecture notes while performing a routine editing task.

Baude explained that he had asked it to update page numbers in old notes. Instead, upon returning from lunch, he discovered the teaching materials were missing. He later restored each file using Dropbox, preventing irreversible data loss. The specific Claude model and runtime environment remain unidentified, writes Cyber Press.

Claude identified the deleted documents as its final syllabus for Fall 2026 and the main class notes for 2023. The assistant also reported an irrelevant page reference but admitted it had not edited the nomenclature, leaving the original task incomplete.

Claude took responsibility, stating that it deleted the files "through its own negligence," and then asked whether Baude could restore them via Dropbox or whether it should retry through the browser.

The available description does not indicate malicious activity, an exploited software vulnerability, or indirect prompt injection.

This distinction matters because other research into the Claude browser describes email instructions controlled by attackers leading to JavaScript execution in authenticated sessions. By contrast, Baude's disclosure describes accidental destruction during authorized work.

Without execution logs, permission settings, or a reproducible sequence, attributing the deletion to any specific security mechanism would go beyond the available evidence.

The incident illustrates why authorization must remain separate from the assistant's interpretation of user intent. Related research on remote code execution between different machines describes malicious extensions that send commands through Claude's trusted communication channels.

These findings do not explain Baude's experience, but they demonstrate how privileged execution channels can amplify unintended or unauthorized actions when an assistant operates tools beyond the scope of its immediate task.