ANTHROPIC · TRUST Aug 17, 2026 · 7 min read

Claude now watermarks its words. Here is how it works, and what is still unknown

MK Mara Kovač Editor-in-Chief · 6:00 AM ET 𝕏 in ✉

Editorial illustration: rows of text-like dashes with a sparse hidden pattern picked out among them

Anthropic spent last week explaining something no major AI lab had fully spelled out before: exactly how it will watermark the text its models produce. The announcement landed on August 11, the technical explainer followed on the 14th, and the reason is not mysterious: the EU AI Act's Article 50 transparency obligations took effect on August 2, requiring AI-generated content to carry effective, machine-readable marks. What is genuinely new is the detail, and the candor about what the marks can and cannot tell you.

⚡TL;DRFuture Claude models will embed a statistical watermark in generated text by steering low-stakes word choices with a secret key: no hidden characters, no extra cost, and, Anthropic says, no quality impact. It is a version of Google DeepMind's SynthID-Text. Detection gives a probability that Claude was involved, not proof of authorship, the detector is not public yet, and the hard questions, from paraphrase robustness to what a mark on human writing means, are still open.

What it is

When a language model writes, many word choices are near-ties. Anthropic's example: after "The weather today was cold and...", the words "overcast" and "grey" are both fine, and normally a random number settles it. The watermark replaces that arbitrary randomness with randomness derived from a secret key plus the preceding few words. Each individual choice stays natural. Across hundreds of words, the choices form a pattern that anyone holding the key can test for, and nobody else can see. Nothing is appended to the text, there are no hidden characters, and per Anthropic's explainer the mark carries no information identifying a person, organization or chat.

The method is a version of SynthID-Text, the approach Google DeepMind published and open-sourced, and has run in Gemini since 2024. Google's published live test on Gemini traffic found no statistically significant difference in user ratings between watermarked and unwatermarked output, which is the strongest evidence yet that this class of watermark does not visibly cost quality. Files get a separate treatment: images and other supported formats carry C2PA signed provenance metadata rather than an in-content watermark.

How it rolls out

Per Anthropic's marking commitments: Claude models launched on or after August 2, 2026 mark text from day one, the marks apply worldwide rather than only in Europe, and they cover every surface, the apps, the API, Claude Code and access through AWS, Google Cloud and Microsoft Foundry. Older models are in a transition window, which the EU gives until December 2 for systems already on the market, per legal analyses of the deadline. Anthropic has signed the EU's Code of Practice on transparency alongside other major labs, so Claude will not be the only watermarked model. Gemini already is. OpenAI, notably, has not yet detailed its text plans.

What a detected mark actually tells you

This is where Anthropic's own documentation is more honest than most coverage. Detection returns a likelihood, not a verdict, and the company lists the failure modes itself:

A MARK MEANSA MARK DOES NOT MEAN

Claude was likely involved with the textClaude authored the ideas. Proofreading or translating human writing can leave a mark on it

The statistical pattern survived to detectionThe text is unedited. Content can be changed, excerpted or remixed after Claude touched it

Enough text existed to test reliablyShort passages can be checked. Brief text carries too little signal

The generating model supported markingUnmarked text is human. Older models, heavy edits, translation or paraphrase all strip the signal

Summarized from Anthropic's own limitations documentation.

Critics push the same points harder. Ars Technica's analysis notes that a model-level watermark cannot distinguish wholesale generation from a comma fix, worries that publishing detection details makes removal trivial, and lands one line worth keeping:

"Invisible can also mean the model occasionally trades the best word for a slightly worse one, just to keep the signal intact."

By construction there is also a quieter limit: the watermark lives in genuinely interchangeable word choices, and text with few of them, code, boilerplate, tightly constrained formats, simply offers fewer places for the signal to exist. Anthropic's short-text caveat is the visible edge of that math.

Still up in the air

Who gets the detector, and when. Anthropic promises detection support for users and third parties with details in forthcoming documentation. Everything interesting depends on the access model: a public detector invites trivial washing, a gated one concentrates a new kind of power in whoever holds the key. TechCrunch's coverage flags the same open question.

Robustness numbers. No published figures yet for how much paraphrasing, translation or editing the Claude implementation survives. Until a testable detector exists, "may persist through some editing" is the entire public spec.

The false-inference problem. The most likely early harm is social, not technical: human writing that passed through Claude for a polish, flagged as "AI generated" by people who read a probability as a verdict. Anthropic's framing, "may have been processed by Claude," is precise. Screenshots of detector results will not be.

Whether search and answer engines ever care. For this audience, the live question. Google's published position since 2023 is that it rewards quality regardless of how content was produced, and nothing announced changes that. But a machine-readable, cross-vendor signal of AI involvement now exists at web scale for the first time. Whether any engine reads it, and whether "watermarked" ever becomes a quality proxy, is undecided, and worth watching closely.

What to do this week

Inventory where Claude touches text you publish, including the drafts it merely polishes, because marks do not distinguish the two. Decide your disclosure position now, while it is a policy choice rather than a response to a detector screenshot. And do not rewrite anything out of fear: every engine's stated quality bar is unchanged. The watermark changes what can be known about your text. It does not, yet, change what ranks.

KEY TAKEAWAYS01Claude will watermark generated text via key-seeded word choices: no hidden characters, no added cost, and no measured quality loss in SynthID's published live test.02The driver is the EU AI Act's Article 50, in force since August 2. Marks apply worldwide, on new models first, with older models in transition.03Detection yields probability, not proof. Polished human text can carry a mark; edited or short AI text can lack one. Anthropic says both plainly.04The detector is not public and no robustness numbers exist yet. The access model for detection is the decision to watch.05No engine treats AI-generated text as a ranking negative today. Set your disclosure policy before someone else's detector sets it for you.