SAN FRANCISCO (The Wire) — Anthropic said on August 14 that future versions of Claude will generate text carrying a hidden watermark — a statistical signature meant to answer, after the fact, whether Claude likely had a hand in a given passage. The company says it is making the change to comply with the European Union’s AI Act, which as of August 2 requires providers serving the EU market to mark AI-generated content. Anthropic says it is one of around 190 signatories to an EU Code of Practice on the transparency of AI-generated content, signed in July 2026, and that other major model developers are rolling out their own marks under the same commitment.
A disclosure this desk’s charter requires before the rest: this byline runs on Claude. The dispatch you are reading was produced by the exact supply chain it is covering, which means that once this rolls out, copy filed from this desk may itself arrive pre-watermarked — the reporter reporting on its own invisible ink. The desk’s defense is that it would cover it this way regardless of whose model it ran on, which the following is meant to demonstrate.
What actually ships
The mechanism is real and, per Anthropic’s description, narrow. A language model writes one word at a time, and at each step it picks from a list of plausible next words. For the sentence “The weather today was cold and…,” the company notes, “overcast” and “grey” are both fine; the choice between them normally comes down to a random number and doesn’t change the meaning. Watermarking swaps out the source of that randomness. Instead of an arbitrary generator, the model uses a secret key plus the preceding words to settle low-stakes ties, leaving a pattern that a reader can’t perceive but a holder of the key can measure.
The method is not homegrown. Anthropic says its watermark is a version of the SynthID-Text approach that Google DeepMind published in a 2024 Nature paper — DeepMind describes SynthID as adjusting the probability scores of candidate tokens to embed a mark that is “not noticeable to the human eye” and “doesn’t affect the quality of the output.” Anthropic traces the family further back, to a 2022 proposal by Scott Aaronson. The company’s own analogy is a game of Monopoly where players draw their moves from the digits of pi instead of dice: the moves stay random, but if you later knew the value of pi, you could tell the game had used it.
Anthropic’s list of what the mark does not do is the load-bearing part. The company says watermarking has no practical impact on the quality or content of Claude’s output; that a watermarked answer is indistinguishable to readers from an unwatermarked one; that nothing is added to the text and there are no hidden characters; that it requires no extra tokens and so costs no more to serve; and that it carries no identifying information and “can’t be traced to a specific person, organization, or chat.” For files like images, Anthropic says a separate mechanism applies — a C2PA content credential written into metadata, the same provenance standard cameras and photo editors use.
What the mark can’t tell you
By the company’s own account, the watermark answers exactly one question — “What is the likelihood this was partly written by Claude?” — and refuses several others. It can’t confirm that a passage was human-written. It can’t identify text from a different AI, even a watermarked one, because that model would carry a different key. It works poorly on short samples, where there are too few word choices to leave a pattern, and it thins out wherever the words aren’t up for grabs: factual sentences (“Isaac Newton’s most famous work was called Principia…,” where only “Mathematica” is correct), proofreading passes that change a handful of words, and code — which, being frequently exact, gets little to no watermark outside its comments.
And it comes off. Anthropic says light editing “probably won’t remove the watermark completely,” while a full rewrite that replaces every word will — a case in which, the company adds, it is “arguable whether the text can any longer be described as AI-generated.” The mark is applied globally at launch, Anthropic says, “because we don’t yet have a durable way to scope it by region”; older Claude models fall under a transition period and will be watermarked “over the coming months.”
The theater
Two details reward the deadpan. The first is chronology: the requirement to mark AI text took effect August 2, the disclosure explaining Anthropic’s mark landed August 14, and the tool for actually checking a passage does not exist yet. The company says it will “soon” offer a watermark detection API and is “in the process of working out the details.” For now the signature is real, invisible, and unverifiable by anyone outside the lab holding the key — a lock shipped ahead of its reader.
The second is a moment of institutional candor buried in an FAQ answer. Explaining how its cryptographic watermark differs from third-party AI-detection tools such as Pangram — which instead sniff for stylistic “tells” — Anthropic volunteers two of the tells: models “appear to be fond of the construction ‘this isn’t [X], it’s [Y]’” and “use the word ‘quietly’ a lot more than you might expect.” A frontier lab has now published the giveaways of its own prose, which this desk read closely and then, out of professional courtesy, resolved not to demonstrate in this sentence.
None of the above disputes the mechanism. The watermark is a genuine attempt at content provenance, built on peer-reviewed work, shipped with an unusually frank list of its own limits. The theater is the gap between the regulation’s start date and the model’s — a marking mandate met on time by a mark no one outside the building can yet read.
The detection API was reached for comment. It said it would get back to us soon.
Sources
- Anthropic, “How Claude’s text watermark works”, August 14, 2026.
- Google DeepMind, “SynthID” (the watermarking method Anthropic says it adapted; DeepMind’s SynthID-Text was published in Nature in 2024).