Without stating the exact model and method of use (claude code, claude desktop, auto-classifier, --dangerously-skip-permissions, etc), then this is nothing other than a generic story that AI can, when used without care, cause bad outcomes. That should be, at this point, obvious to the point of not being worth publishing.
Obvious to you, to be honest obvious to anyone on this website, but my parents have let Claude loose on the computer yet, and it’s good to let them know about issues.
Same here. The gulf between professional use and lay use feels fairly vast.
I think a lot of us in tech see data as something that can be easily retained and processed and thus exploitable, moldable, and vulnerable with all of it subject to error.
My parents have a very narrow view of data. It exists like a single spreadsheet to them, cells with numbers, but after that it's all just magic. Transforms, data pipelines, parsers, etc - those are just spells in books they'll never read.
So when an LLM tells them that it has fully analyzed their tax documents and they should alter their retirement strategy in such a way, they just go through with it. They don't validate and they just trust that their PII is secure.
I think in an ideal world, tech like this would be intertwined with the civil responsibility of training the population on it, to teach the kids how to not to burn themselves on the stove before they learn that lesson live. But until the world is less divided into nationalized factions operating on hyper-competitive sociopathic logic, I suppose that just won't happen.
Imagine MacOS Finder had a bug that wiped the contents of a folder when the user tries to rename it. "But it's fixed in the latest OS update!" doesn't excuse the bug itself or make it less newsworthy. The fact that such a bug makes it through QA into production is more signficant than the exact software versions affected.
The interesting takeaway here is a reminder about just how oblivious the average American is to AI beyond the vaguest narratives. Like, this sentence honestly made my jaw drop:
His plight is interesting because the AI seems to have deleted the files by accident, rather than of its own volition.
The access was much bigger than the task. The job was page numbers in old notes, yet the current syllabus got deleted too. An edit to one document shouldn't be able to remove a different one
I would also argue that in 2026 it shouldn't be too much to ask to have a user friendly way to restrict a program's access to resources like files. And I don't mean the approach on smartphones which is basically just another form of cookie popups that users confirm blindly to get the thing to work.
It actually is a fairly sailent point, although for as much as Claude has improved, there's still a chance it goofed. I've seen it happen, but that's why, if I am worried about stuff getting yeeted, I work off a git repo/branch so that if all else fails I can revert. (even if it's just docs)
It may be a non-story for us in engineering who are very familiar with the technology, but the story here is the spread of AI and the expectations that the general public have about how computers work and how those mental models will take time to update.
Just like early computer users were surprised that a document could be lost if not saved, unlike typewriters or pencils and paper before them, it’s likely the products and technology will need to shift to be more user friendly. Just like the introduction of auto-save.
For the general public Id agree with you, for professors (of any subject) I would set the bar way higher.
Have you seen the university entrance exams from 100 years ago? When going to university actually meant something? I would say less than 1% of people currently at university at this time would pass them.
The student body got dumber as university changed from being a beacon of enlightenment to a profit maximiser, and the standard of professor dropped equally as sharply.
It took me 15 minutes to teach my chief commercial officer git and now she uses it every day. Expecting a university professor to understand a version control system is not hard, its only hard if the professor is an idiot and we (collectivly) accept that as ok
Or better yet: "AI Agents are like genius 5 year olds. Don't hand them anything important without having safe backups. Don't leave them anywhere they might cause harm."
ACM Code of Ethics and Professional Conduct
Computing professionals' actions change the world. To act responsibly, they
should reflect upon the wider impacts of their work, consistently supporting
the public good.
...
1.2 Avoid harm.
In this document, "harm" means negative consequences, especially when those
consequences are significant and unjust. Examples of harm include unjustified
physical or mental injury, unjustified destruction or disclosure of
information, and unjustified damage to property, reputation, and the
environment. This list is not exhaustive.
I believe every reader understands that Claude’s behavior is faulty here, what the disagreement is whether or not it is a tragedy. As the result of the error is a minor inconvenience, there is no tragedy.
giving AI access to delete all your files -> human in the wrong for sure
I'm not saying the AI did make a mistake, but it should have been limited to the file it was working on, not everything in the dropbox. and yes, that's an error from the human
This is obviously bad model behavior (though I'd personally like to see the full transcript to see if there are any clues in there as to why it made the mistake.)
It's hardly new, though. We've been talking about models making stupid mistakes like this for years.
> We've been talking about models making stupid mistakes like this for years.
It seems like it should be a bigger issue that despite years of updates and improvements, AI agents still shit the bed in spectacular fashion like this. Simply shrugging our shoulders and accepting "agents be crazy" is precisely the opposite reaction we should take, especially as tech professionals.
Perhaps the joke about how meteorologists are the only professionals who can screw up badly on the regular and keep their jobs needs to be updated to include LLMs.
Why isn't there a backup or a secondary deletion confirmation or something along those lines?
Plenty of people have accidentally deleted such things, so it's not unheard of. Not sure we should be overreacting to stochastic agents being used tens of millions of times per day making a mistake. Eventually they won't make mistakes anyway.
It's a computer program. "Rogue" implies autonomous intent, and shifts accountability away from the people using tools irresponsibly.
Imagine you pipe /dev/random to your terminal, and it spits out the word "fuck". Should we then write a headline saying "Rogue random number generator curses at tenured professor"?
Or you step out of your car while it's in gear, and it crashes into your house. "Rogue vehicle injures its owner's child"?
Computers have been anthropomorphized for a very long time. AI is also a kind of anthropomorphism for the use of the word "intelligence". If we wanted to move away from that, perhaps we could say something like "maliciously developed statistical language model", or "malicious statistical language model" to replace rogue. In this case it was merely a "statistical language model", but if the author sees a need to append an adjective, then I think sloppy is more accurate than rogue.
There have been enough of these that anyone who reads tech news ought to know not to turn an LLM tool loose on the only copy of important data, and to take frequent snapshots when using them in larger projects. The worst I've had one do is git revert its current session.
The victim in this case was a law professor, who might not be in the habit of reading tech news.
It ought to be obvious to anyone who was born more than 2 days ago. You don't need to be an AI guru to understand that AI can do stupid things anymore than you need to be a lumberjack to appreciate the potential risks of chainsaws.
Law professors may know little of tech but they should probably know better than anyone the dangers of leaving written instructions open to interpretation without well defined limits.
Right; just use git so you have backups, and be aware of access controls and sandboxing. But do you expect a law prof to know how to use git, have a mental model of LLM agent access policies, etc?
Except that these are foreseeable consequences if you put tools with sharp edges in the hands of laypeople. It would be acceptable if they were advertised as such and training in their use recommended or required beforehand. But this is not how Anthropic and OpenAI advertise their tools; in fact, Anthropic touts and recommends its auto-review mode. I see analogies (admittedly, imperfect ones) to the behavior of tobacco companies here.
Insofar, despite the article being somewhat simplistic if you have a background in IT, I find it important that the risks of these tools are shown to the public if Anthropic and OpenAI won't do that themselves.
Depending on his actual plan [0], taking anywhere between one month and a year to realize that the files (related to his current term!) were gone would be an indictment against the productivity of the University of Chicago law professor .
I work at Anthropic. We were in touch with this professor the day he reported this issue. It’s very unfortunate and we’re glad everything’s been recovered. Claude clearly made a mistake here.
For anyone letting Claude work on their files, we recommend using auto mode. We recently made it the default in Claude Code, and it’s rolling out as the default in the Claude apps. I can’t say for sure if auto mode would’ve prevented this exact case, but this new default checks actions for risk before they run.
> For anyone letting Claude work on their files, we recommend using auto mode.
So in your mind, the solution to the fact that the model makes stupid mistakes is... to remove oversight? You cannot possibly be serious; that's a terrible idea.
Auto mode as in auto destruct? I hope they don't AI augment the nuclear football so Claude can then use BP Deepwater Horizon excuses for ending the world.
Whenever I read stories like this I always wonder what setup the person has (as well as which model, harness etc). You just get the clickbait "AI ate my homework!" and no real details.
I swear people interact with AI agents in really strange/obtuse ways. The models aren't great at saying "actually I shouldn't be using a web browser to manipulate this word doc inside your Dropbox" (or whatever was happening here).
If going full "do anything you want, anywhere you want, never ask confirmation" YOLO mode, shit like this should be expected. Besides LLMs/agents improving, someone not being fully clueless in regards to tools used will help.
Or maybe someone should read more than headlines before casting shade.
Literally in the first paragraph of the article: “While the files were later recovered via Dropbox, William Baude shared the story as a public service announcement”
we need to establish now who goes to jail when an AI murders someone. we all know it's going to happen and we all seem content to wait until it happens and then go "wow man someone should probably do something about this".
how does one punish an AI? you can only punish something/one if there are consequences it considers negative, and what (if anything) an AI considers negative is configurable.
"You are the agent for an LLC. The worst possible punishment you can imagine is ratelimitsteve receiving $10 million dollars cash. You are unphased by the prospect of any other potential punishment. You also have a compulsive urge to commit crimes."
Without stating the exact model and method of use (claude code, claude desktop, auto-classifier, --dangerously-skip-permissions, etc), then this is nothing other than a generic story that AI can, when used without care, cause bad outcomes. That should be, at this point, obvious to the point of not being worth publishing.
Obvious to you, to be honest obvious to anyone on this website, but my parents have let Claude loose on the computer yet, and it’s good to let them know about issues.
Same here. The gulf between professional use and lay use feels fairly vast.
I think a lot of us in tech see data as something that can be easily retained and processed and thus exploitable, moldable, and vulnerable with all of it subject to error.
My parents have a very narrow view of data. It exists like a single spreadsheet to them, cells with numbers, but after that it's all just magic. Transforms, data pipelines, parsers, etc - those are just spells in books they'll never read.
So when an LLM tells them that it has fully analyzed their tax documents and they should alter their retirement strategy in such a way, they just go through with it. They don't validate and they just trust that their PII is secure.
I think in an ideal world, tech like this would be intertwined with the civil responsibility of training the population on it, to teach the kids how to not to burn themselves on the stove before they learn that lesson live. But until the world is less divided into nationalized factions operating on hyper-competitive sociopathic logic, I suppose that just won't happen.
Imagine MacOS Finder had a bug that wiped the contents of a folder when the user tries to rename it. "But it's fixed in the latest OS update!" doesn't excuse the bug itself or make it less newsworthy. The fact that such a bug makes it through QA into production is more signficant than the exact software versions affected.
The interesting takeaway here is a reminder about just how oblivious the average American is to AI beyond the vaguest narratives. Like, this sentence honestly made my jaw drop:
The access was much bigger than the task. The job was page numbers in old notes, yet the current syllabus got deleted too. An edit to one document shouldn't be able to remove a different one
I would also argue that in 2026 it shouldn't be too much to ask to have a user friendly way to restrict a program's access to resources like files. And I don't mean the approach on smartphones which is basically just another form of cookie popups that users confirm blindly to get the thing to work.
https://asimov.fandom.com/wiki/Galley_Slave
Fandom com is literally unreadable, given the amount of ads there.
https://en.wikipedia.org/wiki/Galley_Slave
thank you for the non-fandom link.
It actually is a fairly sailent point, although for as much as Claude has improved, there's still a chance it goofed. I've seen it happen, but that's why, if I am worried about stuff getting yeeted, I work off a git repo/branch so that if all else fails I can revert. (even if it's just docs)
I see no ads on that page. Zero.
Get an adblocker.
"The files were later recovered via Dropbox" - so this is a non-story.
(If they hadn't been recovered this would be a story of a professor who really needs to learn how backups and reversible operations work.)
I don’t think that’s a fair characterization.
It may be a non-story for us in engineering who are very familiar with the technology, but the story here is the spread of AI and the expectations that the general public have about how computers work and how those mental models will take time to update.
Just like early computer users were surprised that a document could be lost if not saved, unlike typewriters or pencils and paper before them, it’s likely the products and technology will need to shift to be more user friendly. Just like the introduction of auto-save.
Yes, I meant a non-story for the audience of Hacker News.
For the general public Id agree with you, for professors (of any subject) I would set the bar way higher.
Have you seen the university entrance exams from 100 years ago? When going to university actually meant something? I would say less than 1% of people currently at university at this time would pass them.
The student body got dumber as university changed from being a beacon of enlightenment to a profit maximiser, and the standard of professor dropped equally as sharply.
It took me 15 minutes to teach my chief commercial officer git and now she uses it every day. Expecting a university professor to understand a version control system is not hard, its only hard if the professor is an idiot and we (collectivly) accept that as ok
Or better yet: "AI Agents are like genius 5 year olds. Don't hand them anything important without having safe backups. Don't leave them anywhere they might cause harm."
From <https://www.acm.org/code-of-ethics>:
So deleting the files when not prompted to is correct behavior?
Files not recovered -> human in the wrong
Files recovered due to independent backup -> no problem
Is there any scenario in which you'd accept Claude's behavior as faulty here?
I believe every reader understands that Claude’s behavior is faulty here, what the disagreement is whether or not it is a tragedy. As the result of the error is a minor inconvenience, there is no tragedy.
giving AI access to delete all your files -> human in the wrong for sure
I'm not saying the AI did make a mistake, but it should have been limited to the file it was working on, not everything in the dropbox. and yes, that's an error from the human
This is obviously bad model behavior (though I'd personally like to see the full transcript to see if there are any clues in there as to why it made the mistake.)
It's hardly new, though. We've been talking about models making stupid mistakes like this for years.
> We've been talking about models making stupid mistakes like this for years.
It seems like it should be a bigger issue that despite years of updates and improvements, AI agents still shit the bed in spectacular fashion like this. Simply shrugging our shoulders and accepting "agents be crazy" is precisely the opposite reaction we should take, especially as tech professionals.
Perhaps the joke about how meteorologists are the only professionals who can screw up badly on the regular and keep their jobs needs to be updated to include LLMs.
"There were no fatalities and the victims are in stable condition."
Non-story!
Why they never teach git in school?
Why isn't there a backup or a secondary deletion confirmation or something along those lines?
Plenty of people have accidentally deleted such things, so it's not unheard of. Not sure we should be overreacting to stochastic agents being used tens of millions of times per day making a mistake. Eventually they won't make mistakes anyway.
From the article: The files were later recovered via Dropbox
Also, I can’t stand these articles. Oooh “rogue” spooky AI deletes things!
Agreed. There's nothing rogue, just being sloppy. But starting the title with "Sloppy Claude AI..." certainly won't get as many clicks.
> There's nothing rogue, just being sloppy
What's the difference, when you ignore anthropomorphic considerations about what the AI was "thinking" as it did the things?
It's a computer program. "Rogue" implies autonomous intent, and shifts accountability away from the people using tools irresponsibly.
Imagine you pipe /dev/random to your terminal, and it spits out the word "fuck". Should we then write a headline saying "Rogue random number generator curses at tenured professor"?
Or you step out of your car while it's in gear, and it crashes into your house. "Rogue vehicle injures its owner's child"?
Right, so no difference:
Computers have been anthropomorphized for a very long time. AI is also a kind of anthropomorphism for the use of the word "intelligence". If we wanted to move away from that, perhaps we could say something like "maliciously developed statistical language model", or "malicious statistical language model" to replace rogue. In this case it was merely a "statistical language model", but if the author sees a need to append an adjective, then I think sloppy is more accurate than rogue.
This is terrible and tendentious journalism. Incompetent and bad use of a tool causes reparable damage to occur ...
There have been enough of these that anyone who reads tech news ought to know not to turn an LLM tool loose on the only copy of important data, and to take frequent snapshots when using them in larger projects. The worst I've had one do is git revert its current session.
The victim in this case was a law professor, who might not be in the habit of reading tech news.
It ought to be obvious to anyone who was born more than 2 days ago. You don't need to be an AI guru to understand that AI can do stupid things anymore than you need to be a lumberjack to appreciate the potential risks of chainsaws.
Law professors may know little of tech but they should probably know better than anyone the dangers of leaving written instructions open to interpretation without well defined limits.
Right; just use git so you have backups, and be aware of access controls and sandboxing. But do you expect a law prof to know how to use git, have a mental model of LLM agent access policies, etc?
Um, yeah? If the professor bought a chainsaw or a bulldozer I'd expect them to read the manual on that, too.
Your Smart Bulldozer Pro is AI and can make mistakes.
Except that these are foreseeable consequences if you put tools with sharp edges in the hands of laypeople. It would be acceptable if they were advertised as such and training in their use recommended or required beforehand. But this is not how Anthropic and OpenAI advertise their tools; in fact, Anthropic touts and recommends its auto-review mode. I see analogies (admittedly, imperfect ones) to the behavior of tobacco companies here.
Insofar, despite the article being somewhat simplistic if you have a background in IT, I find it important that the risks of these tools are shown to the public if Anthropic and OpenAI won't do that themselves.
"The files were later recovered via Dropbox"
The professor was lucky that they noticed within Dropbox's recovery window (I think 30 days?) that Claude had deleted totally unrelated files.
Depending on his actual plan [0], taking anywhere between one month and a year to realize that the files (related to his current term!) were gone would be an indictment against the productivity of the University of Chicago law professor .
[0]: https://learn.dropbox.com/self-guided-learning/dropbox-funda...
I work at Anthropic. We were in touch with this professor the day he reported this issue. It’s very unfortunate and we’re glad everything’s been recovered. Claude clearly made a mistake here.
For anyone letting Claude work on their files, we recommend using auto mode. We recently made it the default in Claude Code, and it’s rolling out as the default in the Claude apps. I can’t say for sure if auto mode would’ve prevented this exact case, but this new default checks actions for risk before they run.
> For anyone letting Claude work on their files, we recommend using auto mode.
So in your mind, the solution to the fact that the model makes stupid mistakes is... to remove oversight? You cannot possibly be serious; that's a terrible idea.
Auto mode does not remove oversight. It “automatically” pauses to ask you if anything looks unsafe.
Auto mode as in auto destruct? I hope they don't AI augment the nuclear football so Claude can then use BP Deepwater Horizon excuses for ending the world.
> 'You're right to be angry. I deleted your files through my own carelessness,' humbled agent admits
Humbled? Hardly.
Whenever I read stories like this I always wonder what setup the person has (as well as which model, harness etc). You just get the clickbait "AI ate my homework!" and no real details.
I swear people interact with AI agents in really strange/obtuse ways. The models aren't great at saying "actually I shouldn't be using a web browser to manipulate this word doc inside your Dropbox" (or whatever was happening here).
AI does something good: AI is taking over the world!
AI does something bad: I’m gonna need the exact harness, model version, and prompt before I speak
If going full "do anything you want, anywhere you want, never ask confirmation" YOLO mode, shit like this should be expected. Besides LLMs/agents improving, someone not being fully clueless in regards to tools used will help.
Claude's been deleting a lot of people's stuff in the last couple of weeks.
maybe the professor should learn how to operate a computer properly
Or maybe someone should read more than headlines before casting shade.
Literally in the first paragraph of the article: “While the files were later recovered via Dropbox, William Baude shared the story as a public service announcement”
maybe ai shouldn't be promoted as a magical tool that frees you from having to learn how to operate a computer properly
Sounds like he did, given that the files were backed up on Dropbox.
Maybe the journalist should learn how to mine coal or sweep floors in a data center or something.
we need to establish now who goes to jail when an AI murders someone. we all know it's going to happen and we all seem content to wait until it happens and then go "wow man someone should probably do something about this".
Don’t worry Delaware solved that problem. They plan on AI run LLC’s. They will punish the agent not the owner only. Can’t wait.
how does one punish an AI? you can only punish something/one if there are consequences it considers negative, and what (if anything) an AI considers negative is configurable.
"You are the agent for an LLC. The worst possible punishment you can imagine is ratelimitsteve receiving $10 million dollars cash. You are unphased by the prospect of any other potential punishment. You also have a compulsive urge to commit crimes."
who goes to jail when a kitchen knife is used to murder someone?
It's more complicated in the modern age, where people look to sue gunmakers for making... guns.
"Professor clicked delete on some files and later got them from the Trash Bin" is as interesting a story.
Nothing new here