Back to Insights
AI

Anthropic Is Watermarking Every Word Claude Writes. It Can't Tell You Who Wrote It.

Anthropic now watermarks Claude's text output worldwide. What the invisible mark actually proves, what strips it, and why detection isn't live yet.

S5 Labs Team August 11, 2026

Anthropic published documentation on August 11 confirming that every Claude model launched on or after August 2, 2026 embeds an invisible, machine-readable watermark directly into the text it generates. The marking is applied at the model level, so it reaches the Claude Platform API, claude.ai, Claude Code, Claude Cowork, Claude Tag, and Claude served through AWS, Google Cloud, and Microsoft Foundry. Anthropic told Euronews the watermark applies in every region where Claude is offered, not only the European Union that prompted it. For files Claude produces in supported formats (.svg, .png, .jpg), the company attaches digitally signed provenance metadata using the C2PA standard.

What Anthropic has not published is the method, an accuracy figure, or any tool that lets you check a document. Detection is described as forthcoming, so for now the mark is in the text and nothing on the market can read it.

What the mark actually claims

Anthropic’s own support page is considerably more careful than most of the coverage of it. A detected mark means content “may have been processed by Claude.” Processed is not the same as written, and most of the trouble starts in the gap between them.

Anthropic names the reason itself. People run their own writing through Claude to proofread, tighten, restructure, and translate it. Paste a memo you wrote into Claude for a grammar pass and the text that comes back carries the mark, even though every idea in it is yours. The watermark only records that a model touched the text. It has no way to separate “write me a 900-word post about supply chain risk” from “fix the comma splices in this.”

The failures run in the other direction too, and Anthropic lists them plainly: heavy editing, paraphrasing, translation, format conversion, and screenshots can strip the mark; short outputs may carry no detectable signal; and content from models released before August 2026 has no mark at all until the retrofit work lands. The absence of a watermark is not evidence that a human wrote something.

Put those two lists together and you get a signal with a real but narrow job. It is useful for platform-scale provenance, where you are triaging millions of documents and something probabilistic beats nothing. As evidence against one person in one dispute it is close to worthless, and that is exactly where a lot of people are going to reach for it.

Nobody has said how it works

Anthropic has not disclosed the technique. The production text watermarks that have been described publicly all work along the same lines: the model’s token sampling is nudged toward a key-dependent subset of plausible next tokens, and a detector holding that key runs a statistical test on the resulting text. Because the perturbation is spread across many token choices, no single sentence gives it away, and the signal accumulates with length. That is also why short outputs fail to register.

The research on this family of methods is not flattering about robustness. Google’s SynthID-Text is the best-studied production example. It has run inside Gemini since 2024 and was open-sourced in October of that year, and a 2025 robustness assessment (arXiv 2508.20228) found it degraded by meaning-preserving attacks including paraphrasing, copy-paste modification, and back-translation. The broader literature is older than that. Sadasivan et al. demonstrated a recursive paraphrasing attack against watermarked and unwatermarked detection alike in Can AI-Generated Text be Reliably Detected? back in 2023, and the arms race since has mostly produced watermarks that survive one paraphrase pass, not ones that survive a determined adversary.

None of this makes Anthropic’s implementation bad. It makes the threat model specific: this catches the person who copied and pasted, not the person who ran the output through a second model first. Anybody with a motive to hide AI involvement has a workaround that takes thirty seconds and costs nothing, which means the people who reliably get marked are the ones who were never trying to hide anything.

The regulation that caused it

The driver is Article 50 of the EU AI Act, whose transparency obligations became applicable on August 2. We covered what those obligations require of ordinary businesses last week. The provision that bites model providers is Article 50(2), which requires providers of AI systems generating synthetic audio, image, video, or text to ensure outputs are “marked in a machine-readable format and detectable as artificially generated or manipulated,” with solutions that are “effective, interoperable, robust and reliable as far as this is technically feasible.” Non-compliance carries fines up to €15 million or 3% of worldwide annual turnover, whichever is higher.

The Commission published a Code of Practice on Transparency of AI-generated Content on June 10, and the Commission and AI Board assessed it as adequate in early July, making it the only EU-wide instrument currently blessed for demonstrating compliance with these obligations. Roughly 190 organizations had signed by July 31. The providers the Commission names include Anthropic, Google, Meta, Microsoft, OpenAI, Mistral, Cohere, Aleph Alpha, Black Forest Labs, and Synthesia; deployer signatories include Getty Images, Lenovo, and Lufthansa.

Signing a code and shipping a text watermark are different acts, and Anthropic is not the first to do the second one. Google has been running SynthID-Text inside Gemini for two years. What is new is that a lab is treating an EU marking obligation as a global product default and publishing the failure modes alongside it. The AI Omnibus deal in May accelerated the synthetic-content transparency deadline instead of delaying it, leaving systems already on the market until December 2, 2026 to comply, and the open question at the time was which technical schemes the AI Office would actually accept. The Code answered that in July. Anthropic’s first marked models shipped about a month later.

OpenAI went the other way. The Wall Street Journal reported in August 2024 that OpenAI had a text watermarking system ready for roughly a year, described in internal documents as 99.9% effective on sufficiently long ChatGPT output, and had withheld it. The stated reasons were that translation and rewording through another model defeat it, and that detection would fall unevenly on non-native English speakers. Both objections are still true, and Anthropic’s own documentation concedes the first one. What Anthropic decided differently is that a partial signal published with its limitations beats no signal at all.

What changes if you use Claude in your business

Start with the mundane part. Product descriptions, support macros, RFP boilerplate, and blog drafts that come out of Claude now carry a mark that a third party will eventually be able to test for. Anthropic’s documentation mentions no opt-out. If your content operation depended on nobody being able to tell, the assumption underneath it expired on August 2.

The legal obligation and the technical mark are separate things, and worth keeping apart. Article 50(4) puts a disclosure duty on deployers who publish AI-generated text on matters of public interest, but it exempts content that “has undergone a process of human review or editorial control” where a person or company holds editorial responsibility. Run a real edit and own the byline, and the disclosure duty lifts. The watermark stays in the text regardless, following the paste buffer wherever the text ends up.

The place this gets dangerous is accusation. Detection tooling does not exist yet, and when it arrives it will produce a probabilistic result whose ceiling is “this text may have been processed by Claude.” That will get compressed into “AI wrote this” by HR systems, academic integrity processes, editors, and clients, exactly as earlier AI-detector scores were. The false positives will land unevenly on non-native English writers, which is one of the reasons OpenAI gave for staying out of this entirely. If you are building any policy on top of a watermark check, the check belongs at the start of a conversation and never at the end of one.

What to watch

Detection is the part that decides most of this, and there are two ways it can land. If Anthropic publishes a verifier anyone can run, the watermark becomes shared infrastructure and third parties can measure its false-positive rate independently. Ship it as a gated API instead, and Anthropic becomes the sole adjudicator of whether its own model produced a given document, which is a strange amount of authority to hold over other people’s disputes. The Code sets February 2, 2027 as the deadline for providers to have an interoperability solution for detecting marks, so the shape of this should be visible well before then.

The retrofit runs on a tighter clock. Models released before August 2, including everything Anthropic shipped through the Sonnet 5 launch in June, are unmarked today, and the December 2 deadline for pre-existing systems is under four months away. Whether an older model can be retrofitted without a re-release is a technical question nobody has answered in public.

Every major lab signed the same code, so the rest of the field has the same obligation and is watching how this goes. If text watermarking costs nothing in output quality and buys real regulatory goodwill, they will ship it within a year. If Anthropic’s version gets publicly broken by a paraphrase script in the first month, they will stay exactly where they are and point at the wreckage.

Sources

Want to discuss this topic?

We'd love to hear about your specific challenges and how we might help.

Start a conversation