Claude Now Watermarks Your Text. It Proves Less Than You Think.

According to press reporting quoting Anthropic, every Claude model launched on or after 2 August 2026 embeds an invisible, machine-readable watermark in its text output. Not images. Text.

It covers the Platform API, claude.ai, Claude Code, Claude Cowork, Claude Tag, and Claude accessed through AWS, Google Cloud and Microsoft Foundry, and it applies worldwide rather than only in the EU. Models that predate the cutoff get a transition period, with Anthropic saying it is already working on retrofitting them — so "Claude watermarks your text" is precise only for the newly launched models today.

This reads like the arrival of a reliable AI detector. It is not one, and the gap between what it does and what people will assume it does is where all the damage is going to happen.

One disclosure before anything else, because it is the honest thing to do in a piece about this: Claude helped draft this article, I edited it, and I take responsibility for the result — like most things on this site. There is no public verifier available, so I cannot test whether this published version retains a detectable mark. That is itself part of the story.

What actually shipped

Two different mechanisms for two different output classes, and conflating them is the first mistake available.

Text gets a model-level statistical watermark. Token choices are subtly biased so a detector with the right key can find a pattern across a long enough passage. The text stays readable, and the signal survives ordinary copy-paste. Anthropic says it "may persist through some editing".

Files get C2PA digitally signed provenance metadata — currently for .svg, .png and .jpg. That is a cryptographic signature attached to a file, which is a fundamentally different kind of claim.

The rollout coincides with EU AI Act Article 50, whose transparency obligations became enforceable on 2 August 2026 and which requires machine-readable marking of synthetic output, text included. Anthropic is also a signatory to the General-Purpose AI Code of Practice.

The law is regional. The rollout is global, which is the rational engineering call rather than evidence of universal legal pressure. Watermarking happens at the inference layer. Maintaining watermarked and unwatermarked pipelines would mean a regional branch across Anthropic's own products, its API, and three cloud distribution channels — and then answering which rule applies when the user, the account, the inference region and the downstream app are in four different places. One compliant default worldwide is simply cheaper to operate — though that is my inference about the engineering economics, not something Anthropic has stated.

Worth noting: as I write this, I could not find a primary announcement on Anthropic's newsroom or an article in its support centre. The rollout facts above come from press coverage quoting the company; the reasoning about pipelines is mine. For a transparency measure, the transparency is currently arriving second-hand.

How a statistical text watermark works

A language model does not pick each next token with certainty. At every step it produces a probability distribution, and in open prose several continuations are equally acceptable. A statistical watermark turns that freedom into a covert channel.

In a common statistical-watermark design, generation stops sampling straight from the unmodified distribution and instead nudges the model toward certain eligible token choices according to a secret key. Nothing visible is inserted. There is no zero-width character to strip, no hidden HTML, no metadata field. The evidence exists only in the aggregate distribution of choices across a passage.

A detector then asks whether a passage contains more key-favoured choices than chance would produce. One token carries no signal at all, and short passages offer fewer observations — though Anthropic has not disclosed how much text its verifier actually needs. The detector wants many repeated opportunities to watch the model choose between viable alternatives.

The lineage is public even if Anthropic's exact construction is not. Kirchenbauer and colleagues described the canonical green-list/red-list approach in 2023: a keyed process splits the vocabulary into favoured and unfavoured sets, generation biases toward the favoured set, detection looks for an improbable concentration of them. Google DeepMind's SynthID-Text, published in Nature in October 2024 and deployed in Gemini, used tournament sampling instead — candidate tokens run through a keyed knockout whose repeated outcomes leave the signature.

Anthropic has not said which family Claude's belongs to. Reporting identifies token-level sampling bias as the mechanism, and that is as far as the public record goes. Mapping any specific published scheme onto Claude's production implementation would be speculation, so I am not going to do it.

Why text is the hard case, and code may be the stress case

Images give you an enormous continuous signal space. Thousands of imperceptible pixel adjustments, no visible difference, plenty of room to carry information.

Text is discrete. The model picks one token or another, and tokens are not interchangeable the way neighbouring pixel values are. Change a word and you may change meaning, tone, factual accuracy, or program behaviour.

And text runs out of entropy fast. The opening of an essay has many acceptable continuations — lots of room to bias. A factual answer requiring a specific name, a JSON object requiring a closing brace, a function call requiring an exact parameter: the set of valid continuations collapses to one. When there is only one correct next token, there is nowhere to hide a mark.

Which produces an uncomfortable ranking — and to be explicit about what this table is: a reasoned expectation from how the mechanism works, not measured performance. Anthropic has published no benchmarks by content type.

This is not a detector-quality problem that a better algorithm fixes later. It follows from the information available in the output. A three-line bug fix contains very few free choices for any scheme to work with. How few is too few is exactly the number Anthropic has not published.

What this means if you use Claude Code

Code is close to the pathological case, and then the toolchain makes it worse.

Programming languages have exact syntax. APIs constrain identifiers and argument order. Types, tests, linters and repository conventions shrink the acceptable token set further. Correct code has far less sampling freedom than prose to begin with.

Then the toolchain goes to work on whatever signal survived. Formatters normalise whitespace, quoting, import order and line breaks. Linters rewrite constructs. Refactoring renames identifiers. Compilation produces a different artifact entirely. Every one of those tools is designed to preserve behaviour, not a token sequence, and on most teams several run automatically on save or in CI. How much of an undisclosed scheme's signal they take with them is unknown — no code-specific testing has been published.

So the practical answer for engineers: do not assume the watermark gives you dependable provenance for production code until code-specific results exist. And expect it to be least useful exactly where somebody might want certainty — small patches, security-sensitive changes, configuration, short generated functions.

Your provenance controls stay where they already were: review, tests, static analysis, ownership, traceable commits. A statistical watermark neither validates code nor identifies who is accountable for shipping it. That was already the job of the verification layer.

The asymmetry, stated precisely

People want a detector to answer one question: was this written by Claude? The watermark cannot answer it, in either direction.

A positive would mean a passage contains a statistical pattern consistent with Anthropic's watermark under the detector's assumptions — and even that needs qualification while false-positive rates, accuracy and minimum passage length remain unpublished. Anthropic states plainly that detection does not prove Claude authored the content, because people use Claude to edit and translate their own writing. Someone can supply the argument, the structure, the facts and most of the wording, ask for a light edit, and receive marked output.

The negative direction is far weaker, and it is the one that will hurt people. A detector can fail because the text is human-written — or because the passage is short, because it is low-entropy, because it was substantially rewritten or translated, because the tested representation is not the original text, because it came from a model not yet retrofitted, or because it came from an entirely different system. An absent mark says almost nothing about human authorship.

The correct evidentiary reading is narrow: a positive is weak evidence of contact with a watermarked generation path; a negative is not evidence of absence. That is a poor foundation for any binary judgment.

This is not C2PA, and the difference matters

C2PA gives the stronger verification while the manifest is attached, because a verifier checks a cryptographic signature rather than estimating a pattern — though what it verifies is the signed provenance record, not the truth of every claim in it. And it is metadata, not an indelible mark inside the content. The text watermark trades that attachment for portability: it survives plain copy-paste because the words themselves carry it. The price is probabilistic detection whose characteristics are unpublished.

Neither should be described as permanent. Both regularly will be.

If you publish AI-assisted writing

Assume text copied out of a covered newly launched Claude model carries the mark into your blog post, report, email or docs. That is not a scandal and it does not turn editing assistance into machine authorship — but it does mean the distinction has to live somewhere other than the detector.

If authorship matters for your work, keep the actual record: drafts, version history, sources, review notes, an honest account of how the model was used. And if you write an editorial policy, define the conduct rather than the tool. "Any contact with Claude", "Claude-generated first draft", "substantive machine-written passages" and "grammar correction" are four different things, and no statistical mark can tell them apart.

Schools and employers are where the harm lands

No verifier is public yet, so this section is about what happens next rather than what is happening now. Institutions want a binary answer under time pressure. A school wants to know whether a student cheated. An employer wants to know whether an applicant wrote the sample. "Watermark detected" will look like an objective shortcut, and there is every reason to expect it to be used as one.

A detected mark could come from translating or editing the person's own work. The false-positive rate is unpublished. The degree of Claude involvement cannot be reconstructed from the signal. And an absent mark is no defence either — the text may have been rewritten, translated, screenshotted, or generated by an older model during the transition window.

Using either result as proof would create a straightforward due-process failure. Someone accused would have real difficulty challenging a detector whose error rate, threshold and minimum passage length are undisclosed, and the institution cannot honestly explain what the result establishes, because the mechanism does not establish authorship. This is the measure-becomes-the-target failure with someone's degree or job attached to it.

A watermark result should never be sole evidence for discipline, rejection or termination. Drafts, version history, sources, an oral explanation and the precise policy allegedly breached are all better evidence, and all of them existed before this shipped.

What would make this useful rather than theatre

Until those exist, this is a compliance artifact rather than a detection product. Which is fine. Article 50 asked providers to mark synthetic output and Anthropic built a global mechanism to do it. Infrastructure often starts as an obligation and becomes useful later. The theatre only begins when a compliance marker gets described — or read — as an authorship oracle.

Four uncomfortable conclusions

One. The absent-mark direction is more dangerous than the positive one. People will learn that a positive has caveats, then quietly treat a negative as exoneration. Every transformation that strips the mark makes that reading indefensible, and there are a lot of them.

Two. It is structurally strongest where it is needed least and weakest where it is wanted most. Long fluent prose gives it plenty to work with. Short answers, exam responses, factual replies and code — the places institutions actually want a verdict — give it almost nothing.

Three. The burden is inverted. Cooperative users preserve the signal by default. Determined ones remove it with a paraphrase pass. A mechanism that marks honesty more reliably than deception is an odd instrument to hand to institutions looking for deception.

Four, and the one I keep coming back to: we are getting the mark before we get the meter. The generation side shipped globally on a legal deadline. The verification side — a public detector, error rates, passage-length guidance, an audit — has not been announced with a timeline in any reporting I can find. For a transparency measure, that ordering is backwards.

Treat it as what it currently is: a signal that may survive one generation path and some subsequent handling. Not proof of authorship, originality, intent, misconduct or innocence. Anything stronger is confidence the mechanism has not earned yet.