Anthropic confirmed this week that text generated by new Claude models carries an invisible, machine-readable watermark, a statistical signature woven into the words themselves that survives copying, pasting, and a degree of editing.
The change applies to Claude models released on or after 2 August 2026, detailed in an updated Claude Help Center article. It covers Claude the chatbot, the API, Claude Code, Claude Cowork and Claude Tag, and it applies worldwide rather than only to users inside the EU. Older Claude models are not marked yet; Anthropic says it is working to add the capability during the AI Act’s transition period.
The driver is regulatory. Anthropic has signed the European Union’s Article 50(2) Code of Practice on Transparency of AI-Generated Content, part of the AI Act provisions that took effect on 2 August. Those rules require providers of generative AI to make synthetic output machine-readable and detectable.
Two different mechanisms, often conflated
Coverage this week has tended to blur the two systems Anthropic is running. They are not the same thing.
Text gets the statistical watermark. It is embedded in the word choices, not attached as metadata. That is why Anthropic says it travels with the text when copied and pasted, and may persist through some editing. You cannot strip it by pasting into a plain text editor, retyping into a CMS, or screenshotting the words.
Files get something entirely different. Supported image and vector files, .png, .jpg, .svg, carry cryptographically signed provenance metadata following the C2PA standard, the same Content Credentials approach backed by Adobe, Microsoft and the Content Authenticity Initiative. That metadata records that Claude touched the file. Unlike the text mark, it can vanish if the file format changes.
How the text watermark works
Anthropic has not published its implementation, and the company says detection details are coming in forthcoming technical documentation. Every detailed explanation currently circulating, including this one, is inference from published watermarking research rather than confirmed disclosure.
The likely approach comes from a 2023 paper by Kirchenbauer, Geiping and Wen, commonly shortened to the KGW method. Alex Cui, CTO of AI-detection firm GPTZero, published a breakdown on 11 August describing it: a hash is computed from the tokens generated, combined with a secret key, that hash splits the model’s vocabulary into a “green” set and a “red” set, and verification counts how often the model drew from the green set.
During generation, the sampling distribution is nudged slightly toward green tokens. The bias is applied only among candidates that are already near-equivalent in probability, which is why Anthropic can claim the mark does not affect meaning, quality or readability while still producing a signature detectable across a long enough passage.
Crucially, the key detection does not have to be distributed. A provider can retain the detector privately and offer a verification API instead.
The four limitations
It proves processing, not authorship. Anthropic states that the mark shows Claude had a hand in something, not that a Claude model generated all of it. Asking the model to proofread or translate a paragraph could leave a trace on work that is substantially human.
Absence of a mark proves nothing. The foundational research showed that paraphrase attacks using a second language model defeat green-list signals reliably. Unmarked text cannot be treated as evidence of human authorship.
Short copy carries no signal. Statistical detection needs roughly 100 tokens or more to return a meaningful result. Social posts, headlines, subject lines and brief email replies fall below the threshold entirely.
Nobody can check anything yet. Public detection tooling has not shipped. C2PA-aware tools can already read Content Credentials on files where the metadata survives, but generic AI detectors do not read Anthropic’s text mark and should not be trusted for it. An Anthropic engineer has since confirmed a text detection API is coming and that the models itself are not aware they are being watermarked.
