Claude Now Watermarks Everything It Touches, Including Work You Wrote Yourself

Executive Summary

• Anthropic embeds an invisible watermark in Claude text and code, and attaches signed C2PA provenance data to generated .svg, .png and .jpg files.
• Marking happens inside the model, so it reaches the Claude apps, Claude Code, Claude Cowork, Claude Tag and the API, including deployments through AWS, Google Cloud and Microsoft Foundry.
• EU law required action, but Article 50 exempts assistive editing that does not substantially change the material, and Anthropic marks that work anyway.
• A detected mark shows content may have been processed by Claude, not that Claude wrote it, and no accuracy rate, false-positive rate or appeals process has been published.
• The mark is easiest to destroy for anyone deliberately hiding AI use and hardest to shake for anyone who pasted a clean draft, which puts the risk on the wrong people.

What Anthropic actually shipped

Two different mechanisms are at work. Text and code get an invisible watermark added while the model is writing, which is why it travels with the words when you copy them out. Generated image files get something else entirely: a signed record of where the file came from, built on the C2PA standard, which also shows whether the file has been altered since.

The reach is wider than most coverage suggested. The marking is built into the model rather than bolted onto one app, so it turns up everywhere Anthropic ships, including the API that other companies build their own products on top of.

• Claude models launched on or after 2 August 2026 mark from day one, and older models are being retrofitted
• File marking currently covers .svg, .png and .jpg only
• The same behaviour applies through AWS, Google Cloud and Microsoft Foundry
• Anthropic says it will release detection tools, and has said a detection API is planned
• The support page describes no way to turn any of it off

How the Claude watermark actually works

The method is public, even if Anthropic's exact settings are not. A model picks each word from a ranked list of candidates. A watermark quietly tilts that list using a secret key, so certain words become slightly more likely than they would otherwise be. Do that across a few hundred words and the pattern becomes measurable, even though no single word choice looks unusual.

Detection then runs the same key over the text and counts how often the favoured words appear. Two things follow from this. Anyone with the key can check a document without needing access to the model. And the answer is a probability, not a yes or no. Google's comparable tool returns three verdicts, including an explicit “uncertain”.

The obvious objection is that biasing word choice must make the writing worse. That was the single most common complaint on Reddit, where one commenter called the claim that it changes nothing “an absolute lie”. The best public evidence points the other way. Google ran a live test across roughly 20 million responses and found the gap in user satisfaction between marked and unmarked answers was around a hundredth of a percentage point, small enough to be statistically meaningless.

• Detection needs the text, the key and the settings, not the model itself
• An Anthropic engineer has said the model is not aware it is being watermarked, since the marking sits in the sampling step rather than the model's reasoning
• Tuning it for easier detection also makes it easier to destroy, so vendors pick a trade-off
• Anthropic has published no technical detail, so its own quality claim cannot be independently checked
• Hacker News commenters split over whether the mark is hidden characters or biased wording, which the published research suggests is the latter

What the Claude watermark can and cannot prove

Anthropic's wording is careful, and worth reading closely. A mark means content may have been processed by Claude. The company says that includes summarising, translating and proofreading material a person wrote. It states plainly that a mark does not prove Claude authored anything, and that the absence of a mark does not prove a human did.

That caution disappears the moment a detector prints a result. Nobody forwarding a flagged document to a client, an editor or a compliance team is going to reproduce the paragraph explaining what the flag does not mean.

• A mark will often not be found on heavily edited or paraphrased text
• Short passages give too little material for a reliable reading
• File provenance data disappears through screenshots, re-saving and format conversion
• Older Claude models produce no mark at all until they are retrofitted
• No accuracy figures, no false-positive rate and no dispute process have been published

The exemption Anthropic chose not to use

The obligation comes from Article 50 of the EU AI Act, which tells providers of systems that generate synthetic content to mark outputs in a machine-readable, detectable way. It applied from 2 August 2026. Fines for transparency breaches reach €15 million or 3% of worldwide annual turnover, whichever is higher, and enforcement sits mainly with national market surveillance authorities.

The law does not ask for all of this. The marking duty does not apply where the system performs an assistive function for standard editing, or where it does not substantially change the input or its meaning. Proofreading a document you wrote sits inside that carve-out. Anthropic marks it anyway. A Reddit commenter reading the regulation directly quoted the exemption back at the announcement within days.

• Systems already on the market before 2 August 2026 have until 2 December 2026 to comply
• The Code of Practice on Transparency is voluntary; Article 50 itself is binding
• More than 80 providers signed that code, including Google, Meta, Microsoft, Mistral and OpenAI
• xAI does not appear on the signatory list
• Businesses using Claude can carry a separate duty of their own, covering deepfakes and text published to inform the public on matters of public interest

That last duty has a catch worth knowing if you publish. It falls away when the content has had genuine human review and a named person takes editorial responsibility. Regulators have been specific about what that means, and spell-checking or grammar correction does not qualify. Publishers relying on a quick read-through to feel covered are relying on the wrong thing.

Who is actually angry, and why

The backlash was not one complaint. It was at least six, coming from groups with very different problems, which is part of why the response looked so scattered.

The largest group is people who use Claude to fix their own writing. That includes a case nobody planned for. One commenter pointed out that people with dyslexia lean on tools like this to proofread, and that an anti-cheating system could flag them for something that is not cheating.

Others described the same problem in their own work. One wrote a scientific paper alone, asked Claude to improve only the style, and expected the whole thing to read as AI output. Another gave the version most people will meet first: you ask Claude to fix two typos in your CV, you send it to HR, and HR runs a detector.

Developers raised a different objection. Their worry was not disclosure but plumbing. Marked code passing through static analysis scanners, client security audits and continuous integration checks could be rejected on a signal that has nothing to do with whether the code is correct. One put it as a compliance nightmare rather than an ethics one. Others worried about scripted agent workflows and compiler behaviour.

• Employees whose workplace policies forbid AI attribution in client files now have those files marked regardless
• Ghostwriters objected to a mark on work they consider jointly produced
• Several commenters called it security theatre, since anyone determined to hide AI use can paraphrase the mark away
• The most repeated practical response was to move to open-weight or Chinese models, one such comment drawing over 200 upvotes
• Some users said they had cancelled subscriptions, and a term for undisclosed AI use, “Claudefishing”, started circulating in the same week

The case in favour

The supporting argument got less attention, partly because it is shorter. It runs like this: the watermark restricts nothing, and only interferes with one activity, which is passing AI work off as your own without saying so.

Several commenters made the point without hedging. One argued there is no good reason to oppose it unless the goal is to mislead people. Another said nobody is being stopped from using AI, only from hiding it. A third framed it as accountability, and said people should own the tool and be ready to be judged on the result. On the opt-out demand, the reply was blunt: an opt-out defeats the purpose, since anyone with something to conceal would use it first.

Anthropic's own position is that identifying AI-written text is genuinely hard, and that this gives people a better tool for doing it. An engineer on the Claude Code team confirmed on 12 August that the company will ship a text detection API anyone can use, rather than keeping verification to itself. The same engineer was candid about the limits, describing it as imperfect and editable, and a first step rather than a solution.

• Supporters treat the mark as disclosure infrastructure, not a restriction on use
• Users who are open about their AI use reported no practical problem with it
• One argument holds that light AI assistance on high-effort work is unaffected in practice
• Anthropic marking beyond the legal minimum is, on this reading, a stricter standard rather than an overreach

The asymmetry nobody designed

Put the durability facts next to the complaints and an awkward pattern appears. The mark is fragile in exactly the situations where you would want it to hold, and sturdy in the ones where it does least good.

Research on this family of watermarks found that after heavy human paraphrasing, reliable detection needed around 800 tokens, roughly 600 words, before it could call a result at a strict error rate. The chief technology officer of GPTZero, an AI detection company, has said the free paraphrasing tools he tried already defeat Google's equivalent system. Anthropic lists paraphrasing, translation, heavy editing and mixing text into other writing as reasons its own mark will not be found.

There is a second problem with the detection API, and it is structural. A public checker tells anyone whether a given rewrite still carries the mark. That turns removal into a cheap loop: paraphrase, test, repeat until it comes back clean. One report this week put the cost of stripping a mark at a few cents per pass, though that figure has not been independently confirmed.

• Someone hiding AI use runs the text through a paraphraser once and the signal fades
• Someone who pastes a clean, unedited draft keeps the strongest possible mark
• Short answers may never carry enough signal to test
• A screenshot removes file provenance data completely

The result is that the watermark works best against the person who was not trying to hide anything.

What the rules already say

Professional bodies are further along than the panic suggests, and none of them rely on detection. The American Bar Association's guidance on generative AI puts the duty on the lawyer to disclose where appropriate and to verify output before filing, which is a separate question from confidentiality and has its own rules.

Publishing and accountancy landed in the same place. Medical journal rules say AI cannot be an author, require disclosure at submission, and treat concealment as potential misconduct. Elsevier requires a disclosure statement. Accountancy guidance warns that staying quiet is unlikely to protect a firm from a negligence claim over work it failed to check properly.

Universities have moved in the opposite direction from where the fear points. One university's guidance refuses to accept any AI detector as the sole basis for a misconduct case, and reports that a third of recent cases resting on detector output alone ended with no finding against the student. Another calls these tools unreliable, easily defeated and unfit to stand as sole evidence.

The reason for that caution is worth stating, because it applies to watermarks too. Detection tools have a documented record of misfiring on people who write in English as a second language. Anyone building a policy on a detector result inherits that problem, whatever the underlying method.

• The best known professional sanction over AI use, a $5,000 penalty against lawyers in a New York case, was for filing citations to cases that did not exist
• As of this week there is no verified instance of anyone being penalised because a statistical watermark was detected
• The consistent rule across professions is disclose and verify, not avoid detection
• The real risk is slower: routine checking becoming standard in procurement, publishing and enterprise tooling

Where everyone else stands

Other providers are marking content too, though the field is far more uneven than the headlines imply. The split runs between text and images, and almost everyone finds text harder.

Google marks text produced in its Gemini apps, and marks its generated images, video and audio. OpenAI is the more revealing case. It built a text watermarking tool years ago and chose not to release it, citing false positives and the fear that users would leave for competitors that did not mark. It does mark images, using both C2PA records and a watermark.

The rest of the field stops at media. Meta and Microsoft have documented image marking, with no public evidence of text watermarking. Grok's image tool applies a visible watermark with no setting to remove it.

• No public documentation establishes text watermarking at Meta, Microsoft, Mistral, xAI, DeepSeek or Qwen
• Open-weight models run locally carry no automatic mark, because this kind of watermarking is switched on during generation rather than baked into the weights
• The music tool Suno began watermarking tracks after legal pressure
• Substack began flagging AI-generated writing through a detection partner
• OpenAI's stated reason for not shipping text watermarking is itself an admission that the false-positive risk is real

The questions still unanswered

The support page raises more than it settles, and the sharpest questions came from users rather than reporters.

Nobody has said how much editing removes a mark, or how much Claude-written text inside a human document is enough to trigger one. That threshold decides whether a lightly polished draft is flagged, and it has not been published. There is no stated accuracy rate, no false-positive rate, and no route to contest a result. Anthropic's claim that marking does not affect quality cannot be verified while the method stays undisclosed.

• How many Claude-written sentences inside a human document produce a detectable mark
• What the false-positive rate is, and what a detector should report when uncertain
• Who arbitrates a disputed result, and on what evidence
• When the detection tools arrive, and who is allowed to run them
• Whether older models will all be retrofitted, and what happens to work produced before they were

Where this leaves things

The Claude watermark is a signal, not proof, and Anthropic says as much on its own page. It is weaker than critics fear against anyone genuinely passing off AI work, and stickier than supporters admit on the person who wrote their own draft and asked for a polish. Both of those are true at the same time, which is why the argument has been so noisy and so unresolved.

What changed this week is not really about detection. It is that the choice of which model sees a document now leaves a trace on the document itself. That was already true of the data you send, which is the older and larger question of what you paste where. It is now true of the words that come back.

Sources

• Anthropic: How Claude marks AI-generated content
• EU AI Act, Article 50: Transparency obligations
• TechCrunch: Anthropic says it will watermark text generated by its AI models
• City A.M.: Claude to watermark AI slop, including edited human writing
• Nature: Scalable watermarking for identifying large language model outputs (SynthID-Text)
• Kirchenbauer et al.: On the Reliability of Watermarks for Large Language Models
• Washington State University: Detecting and reporting AI misconduct
• Euronews: Anthropic to watermark Claude's output worldwide