If you asked Claude to write anything in the last eleven days, there is a signal buried in the result that you cannot see, cannot switch off, and cannot currently check for yourself.
Anthropic confirmed on Tuesday what had been quietly true since August 2: every Claude model released on or after that date embeds an invisible statistical watermark directly into the text it produces. Not a disclaimer. Not a metadata field that a copy-paste discards. The mark lives in the word choices themselves.
The company’s own description is unusually blunt about what that means in practice.
It applies worldwide, not just in Europe. It applies to Claude, Claude Code, Claude Cowork, Claude Tag and the API, and to Claude accessed through AWS, Google Cloud and Microsoft Foundry. It is enforced at the model layer, which means no product surface can turn it off and no prompt can talk it out of it. There is no setting, no plan tier and no API parameter that disables it, and enterprise customers get no exemption.
Files get a different treatment. Images Claude generates or edits — .png, .jpg, .svg — carry signed C2PA provenance manifests recording the model, a creation timestamp and a hash that reveals tampering.
How You Hide a Mark Inside a Sentence
There is no invisible ink here, and nothing is appended to the end of the output. The technique is statistical token biasing.
At every step, a language model has a set of plausible next words. Often several are close to interchangeable — however against but, begin against start. A watermarking system uses a secret key to nudge that choice, consistently, in a direction only the key holder can predict. Any single word is unremarkable. Across a few hundred of them, the pattern becomes a statistical fingerprint.
That design explains both of the properties Anthropic is claiming. Quality is untouched because the alternatives really were near-equivalent. And detection needs volume, because the signal only accumulates. A short reply, a subject line or a social post is too small to carry it.
The threshold is not arbitrary. The EU’s final Code requires marking on free-form text longer than 200 tokens — roughly 150 words — even while acknowledging reliability drops below that. Statistical detection of this kind generally needs somewhere around 100 tokens before a result means anything at all.
The Law That Forced It, and the Date Nobody Marked
This is compliance, and Anthropic has not pretended otherwise. Article 50 of the EU AI Act became applicable on 2 August 2026. Its language is direct: providers of AI systems generating synthetic audio, image, video or text must ensure those outputs are “marked in a machine-readable format and detectable as artificially generated or manipulated.”
The date explains the eleven-day gap between the rule biting and the announcement landing. Systems already on the market when Article 50 took effect got an extension under the AI Omnibus provisional agreement reached in May — they have until 2 December 2026 to meet the machine-readable marking requirement. Newly launched systems did not. Anthropic shipped the watermark on the deadline and described it afterwards.
Anthropic is not alone or first. Google DeepMind released SynthID text watermarking in 2024. OpenAI has signed the same transparency Code of Practice and sits on the C2PA steering committee, which makes a comparable rollout a matter of timing. Canada is running its own consultation on an AI transparency framework, open until 23 September.
What Survives and What Doesn’t
| What you do to the text | What happens to the mark |
|---|---|
| Copy and paste into another app | Survives. The mark is in the words, not the clipboard format |
| Light edits and small rewrites | May survive. Anthropic has not published how much editing is too much |
| Heavy paraphrase, or a pass through another model | Degrades sharply. Research on this class of watermark finds it detectable at around 800 tokens even under strong human paraphrasing — below that, less so |
| Anything short — a tweet, a subject line, a one-line reply | Never reliably present. Too little text for the signal to accumulate |
| Screenshot | Text mark gone. File metadata gone |
| Re-saving or converting an image | C2PA manifest stripped completely |
| Running generated code through a formatter or linter | Code has little room for equivalent word choices, so the signal was weak to begin with — reformatting can finish it off |
Read that table as a whole and a shape emerges. The watermark is most reliable on exactly the content nobody is anxious about — long, unedited, machine-written prose — and least reliable on everything that generates an argument.
A Detector Only One Company Has
Here is the part that has drawn the most attention from people who work on this, and it follows directly from the mechanism.
The bias is applied with a secret key. Detection means testing text against that key. Anthropic has confirmed a text detection API is coming and says it will publish details in forthcoming technical documentation, but it is not callable yet, and no pricing, access tier or date has been announced.
An independent test published this week made the constraint concrete. The author built a working demonstration of the underlying statistics — token-frequency bias, z-scores across a suspected distribution — and was explicit that it could not detect Claude’s actual mark.
The test also surfaced the failure mode that matters. Run ordinary human English through a naive detector and it lights up, because English leans on a small rotating cast of function words and a detector scoring repeated pairs will read that repetition as signal. Short passages produced “a stray high-ish z-score here and there,” not because anything was found, but because z-scores on short text are noisy by nature.
Which is the whole problem with the third-party detection industry that is going to grow around this. A tool without the key is not detecting the watermark. It is guessing, with a confident-looking number attached.
It Proves Processing, Not Authorship
The most important limitation is the one most likely to be lost the moment this reaches a school or an HR department. Anthropic states it plainly: a detected watermark indicates only that content may have been processed by Claude.
The inverse fails just as badly. No watermark proves nothing. The text might come from a model released before August 2. It might be from a competitor. It might have been paraphrased, translated, retyped or screenshotted. It might simply be too short. Anthropic says it is working to extend watermarking to older Claude models, which is an admission that the coverage gap is real today.
So the mark is a positive signal with a loose meaning and a negative signal with no meaning. That is a reasonable provenance tool. It is a terrible basis for an accusation, and it will be used for accusations anyway.
The Backlash Anthropic Bought
The reaction from paying users has not been gratitude for the transparency. It has concentrated on the absence of any opt-out, and it is not hard to see why once you leave the classroom-cheating frame.
A lawyer drafting under privilege, a journalist protecting a source, a company whose product roadmap goes through an AI assistant, a novelist who uses a model for line edits — all of them now emit a signal that a third party could, once the detector exists, use to establish that a machine touched the document. It does not reveal what was written, or by whom. It reveals that Claude was in the room. For some professions that fact is itself the sensitive part.
Anthropic’s stated rationale is that “greater transparency and signals about where content comes from can give people useful context.” That is a real public good, and the regulation demanding it is a reasonable response to a genuine problem. Both things can be true while the cost lands on people who were not asked.
What to Take From This
- Assume it is on, everywhere. Model-level enforcement, every surface, every cloud, every country, no opt-out. If you use Claude, this describes you.
- The asymmetry is the story. Marking is live for every user today. Verification exists for exactly one organisation. Every other party — regulator, platform, teacher, employer — is waiting on an API with no ship date.
- Never treat a detection as proof. Not once the tool ships, not ever. Processing is not authorship, and Anthropic said so first.
- Absence proves nothing either. Pre-August models, short text, paraphrase and screenshots all produce clean-looking output. Anyone reading a negative result as exoneration has misunderstood it.
- Watch who follows. OpenAI signed the same Code and sits on the C2PA board. December 2 is the deadline for systems that were already on the market. The interesting question is whether anyone ships a detector the rest of us can actually run.
The Takeaway
Watermarking AI text is a good idea badly served by the state it shipped in. The technical work is sound, the regulatory driver is legitimate, and the honesty about the limits — processing not authorship, absence proves nothing — is better than this industry usually manages.
But a transparency measure that only its author can read is not yet transparency. Right now every Claude user is generating evidence, and the only entity able to interpret that evidence is the company that generated it. The detection API will close that gap whenever it arrives. Nobody has said when.
In the meantime the predictable thing happens. Detection tools will appear that do not have the key and will not say so. Students will be accused on the strength of a number. And the first person to be wrongly accused because a watermark showed up in an essay they wrote themselves and merely asked Claude to proofread will have a very good case — built, word for word, out of Anthropic’s own documentation.