Today Anthropic confirmed that Claude quietly stamps an invisible watermark into the text it writes. Every model launched on or after August 2 does it at generation time, worldwide, with no opt-out and no enterprise carve-out. If you've read my other notes you know I'm a Claude guy, and you can probably guess Claude had a hand in drafting this one too. So by Anthropic's own rules, some of the words you're reading right now are marked. Fitting topic to test it on.
The headline going around is "Claude can now catch AI writing." That is not what happened. What happened is narrower, weirder, and in one respect almost the opposite of what people assume. Let me walk through it.
What Anthropic actually said
The announcement isn't a research paper. It's an updated help-center article, "How Claude marks AI-generated content." The mechanism, in their words: "When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself. You won't see it, and it doesn't change the meaning, quality, or readability."
Two things it is explicitly not. It's not metadata, and it's not hidden characters. It's baked into the word choices, so it survives copy-paste and "may persist through some editing." It's applied at the model level, which means every surface: claude.ai, the API, Claude Code, and Claude accessed through AWS, Google Cloud, or Microsoft Foundry. Developers can't switch it off. There's no documented exemption for Team, Enterprise, or zero-retention.
Files are handled separately. For .svg, .png, and .jpg output, Anthropic attaches signed C2PA provenance metadata instead, which is a different thing entirely (more on that below). The text watermark is the part that matters.
Why now? Because the EU AI Act's Article 50 transparency rules became enforceable on August 2, and Anthropic signed the Commission's Code of Practice on marking AI content. Non-compliance runs to 15 million euros or 3% of worldwide turnover, so "we'll mark everything, everywhere" is the cheap answer. This is a compliance move dressed as a provenance feature. It is not pitched as an anti-cheating tool, and you shouldn't read it as one.
One more thing they were unusually honest about: there is no public detector yet. It's "forthcoming." So right now nobody outside Anthropic can actually check a piece of text. We're marking first and detecting later.
How an invisible text watermark works
A language model writes one token at a time by sampling from a probability distribution. Most of the time there are several near-equivalent options: "large," "big," "sizable." A statistical watermark uses a secret key to quietly bias that choice toward a pseudo-random subset of allowed tokens. Any single sentence still reads naturally. But across a few hundred tokens the bias piles up into a statistical fingerprint that a keyholder can measure, with a p-value, without any visible mark.
This is well-trodden ground academically. The green-list scheme (Kirchenbauer, 2023) splits the vocabulary each step and nudges toward the "green" half, then detection counts green tokens against chance. Aaronson's Gumbel approach does it through cryptographic sampling. Google's SynthID-Text is the only one shipped at scale, live in Gemini since 2024 and validated across nearly 20 million responses. Anthropic hasn't named which family theirs belongs to.
Here's the part that decides everything downstream: the watermark only fits where the model had a real choice. High-entropy prose, the flowing creative stuff, carries a strong signal. Low-entropy text carries almost none, because there was nothing to bias. Which means:
- Code barely marks. Identifiers, syntax, and structure are forced. Run a linter or formatter over it and whatever faint signal existed is gone. So Claude Code's actual code is close to invisible to this, while its commit messages and explanations mark normally.
- Short answers barely mark. A one-liner or a single sentence is below threshold. Reliable detection generally wants a few hundred words. Anthropic's own caveat ("very short, leaving too little text for a reliable signal") says the same thing in gentler language.
The proofreading trap
This is the point I'd want every professional to actually sit with, because it runs backwards from intuition.
Say you write a paragraph yourself, then ask Claude to proofread it, tighten it, or translate it. The output is generated by Claude, so it can carry the mark, even though every idea in it is yours. Anthropic spells this out: text you "proofread, translate, summarize, or convert" can carry a Claude mark "even if the underlying ideas, text, or data originated from another source."
Now flip it. You generate a first draft entirely with Claude, then rewrite it heavily in your own voice, or run it through another language and back. The mark thins out and likely disappears.
Read those two together and the absurdity lands. A human writer who used Claude only to polish comes out marked. A person who leaned on it hard but rewrote comes out clean. The signal is close to the opposite of "who did the thinking." As the watermarking researcher Ian Miers put it, a watermark can't tell a human with AI assistance apart from just AI. It was never built to.
It does not survive a fight
Watermarks are fine against casual handling. Copy-paste, a few word swaps, light reformatting of prose: the signal holds. Against anyone actually trying to remove it, the research is not kind.
- Paraphrasing. A recursive paraphrase attack (Sadasivan et al.) dropped detection on watermarked text from 99.3% to 9.7% true positives, with the paraphrase rated as good quality by human raters. Near-total evasion, barely any quality cost.
- Translation round-trips. Run text through another language and back and token-level marks wash out. This is one of the reasons OpenAI gave for shelving its own watermark.
- Stealing and spoofing. An ETH Zurich team showed that by querying a watermarked API you can reverse-engineer enough of the rule to both scrub it and, worse, spoof it, "for under 50 dollars" with "over 80%" success. Spoofing is the scary inverse: stamping the mark onto human or malicious text to frame a lab or a person as the author. They confirmed SynthID is spoofable this way.
So a positive detection isn't proof someone used AI, and an absent one isn't proof they didn't. The mark can be manufactured onto innocent text and stripped off guilty text by anyone who cares to.
Three different things people keep blending
Most of the bad coverage comes from conflating technologies that behave nothing alike. Keep them separate:
| Technique | What it is | Survives copy-paste? | Survives a determined edit? |
|---|---|---|---|
| Statistical / in-token watermark | Bias woven into word choice (Claude, Gemini) | Yes | No: paraphrase or translation kills it |
| Hidden characters | Zero-width spaces, U+202F, odd Unicode |
Sometimes | No: any "invisible character remover" strips it |
| C2PA metadata | Signed manifest attached beside a file | No | N/A: a screenshot or re-save drops it |
The middle row is the ChatGPT "em-dash and weird spaces" panic from last year. Those turned out to be mostly training artifacts, not a deliberate watermark, and they're trivially removed anyway. C2PA, the bottom row, is cryptographically certain when it's present but falls off the moment you screenshot or re-encode, which is exactly why it's the file half of Anthropic's approach and not the text half. Claude's text mark is the top row, and only the top row. When a headline calls it "metadata," it's wrong.
The detector graveyard
The reason I care about getting this right is that we already know how this movie ends when institutions treat a probabilistic signal as a verdict.
OpenAI shipped an AI-text classifier in early 2023 and killed it six months later. Its own final numbers: it correctly flagged 26% of AI text while wrongly flagging 9% of human text. A coin with anxiety.
Worse is the bias. The decisive Stanford study (published in Patterns) ran seven detectors over essays by non-native English speakers and watched them wrongly flag 61.3% of that human writing as AI, against about 5.1% for native writers. Simplify the vocabulary and you trip the detector, whether or not a machine was anywhere near it. Real students have been marched into disciplinary meetings over exactly this, which is why a chunk of universities have quietly switched their detectors off.
A watermark is a better signal than those detectors were. But "better than a broken thing" is not "proof," and the incentive to treat any green light as a confession is going to be enormous. Add the spoofing risk from earlier and you've got a signal that can be faked in the accusing direction. Please do not build a policy that hangs a person on it.
Where I land
The mark itself doesn't bother me much. It's imperceptible, it doesn't touch quality, and I'd rather the frontier labs comply with a transparency law than fight it. Lucas Beyer called it the first good thing to come out of EU AI regulation, and on a calm day I half agree.
What bothers me is the gap between what it is and what people will treat it as. It is a weak, compliance-driven "processed by Claude" signal that dies under any real editing, can't survive a translation, can be scrubbed for the price of lunch, and per Anthropic's own words is "not fully conclusive." It is not a lie detector for authorship, and the group most likely to get burned by it being treated as one is, once again, the honest writer who used AI to polish rather than to think.
So the move isn't to fear the mark or to try to beat it. It's to say what you did. I use Claude constantly, this note included, and I'll keep telling you that in plain text rather than making you run a detector that can't answer the question anyway. Write "marked means processed, not authored" into your content policy before your first dispute, not after. And when Anthropic ships that detector, the numbers to watch are the false-positive rate and the minimum length. If either one is bad, the honest disclosure was always going to be worth more than the watermark.
This post is watermarked. I'm telling you myself. That's the version of transparency that actually works.
Drawn from Anthropic's "How Claude marks AI-generated content" help-center article, the SynthID-Text paper in Nature (Oct 2024), Kirchenbauer et al. on green-list watermarking, Sadasivan et al. on paraphrase attacks, the ETH Zurich watermark-stealing work, the Stanford Patterns study on detector bias against non-native writers, OpenAI's own classifier shutdown note, and the EU AI Act Article 50 text. A snapshot as of August 11, 2026. Anthropic's detector and its actual reliability numbers aren't public yet, so check support.claude.com before you quote me on how well any of this works.