Claude's text watermark ships before the API that reads it

Anthropic published an implementation note on Claude's text watermarking on August 14, 2026. The opening claim is short: "Future Claude models will generate text that contains a watermark. This is a way of determining the likelihood that Claude was involved in writing the text."

How the mark gets in

The mechanism rides on a property of sampling that already exists. At many points in a generation, several candidate words are equally good; the model currently breaks that tie with randomness. Watermarking replaces the randomness with a function: it "uses the key and a few words that come before to settle what word the model should pick." Do that thousands of times across a passage and the choices carry a statistical signature that only the key-holder can test for.

Anthropic credits Google DeepMind's SynthID-Text as the basis of the approach and traces the idea back to a 2022 proposal by Scott Aaronson. The company's cost claims follow from the design rather than from benchmarking: "Watermarking does not impact the quality of Claude's output," "Watermarking has a negligible impact on the speed of models," and — the one that matters to anyone paying per token — "because it produces no extra tokens, the model is the same price to serve and use." Nothing is appended, and there are no hidden characters. Images and files get something different: a content credential, described as "a small, cryptographically signed note in the file's metadata," using the C2PA standard.

Where the mark is thin

The post is candid in a way these announcements usually are not, and the admissions are the technically interesting part. The watermark needs low-stakes choices to hide in, so it disappears exactly where choices vanish. On code, "Where an exact output is required," the watermark isn't applied, and code carries "generally less watermarking than some other forms of text." On prose, "Watermarking is sparser on factual passages where there are fewer choices that can be made without decreasing the accuracy of the text." Length is the other axis: "As a passage increases in length, confidence about Claude's involvement increases too" — which is a polite way of saying short samples are not testable.

Editing behaves the way you would expect from a statistical mark: "Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will." And proofreading barely marks anything, because most of the words were not the model's choices to make.

Put those limits together and a pattern falls out that should interest anyone using Claude for technical work. The passages a reader most wants to attribute — a config snippet, a shell command, a tight factual paragraph — are precisely the passages carrying the least watermark. The mark is densest in discursive prose, where the stakes of authorship are lowest.

Using our key, one can only answer the question "What is the likelihood this was partly written by Claude?"

Anthropic, "How Claude's text watermarking works"

The regulation, and the gap

The forcing function is European. The Commission's Code of Practice on Transparency of AI-generated Content was published on 10 June 2026, and its Section 1 requires that outputs of AI systems — "audio, image, video, text" — be "marked in a machine-readable format and detectable as artificially generated or manipulated," with technical solutions that are "effective, interoperable, robust, and reliable as far as technically feasible." The Article 50 transparency obligations applied from 2 August 2026. By the Commission's count on 31 July 2026, about 190 organizations had signed, Anthropic among the Section 1 examples alongside Aleph Alpha, Black Forest Labs, Cohere, Google, Meta, Microsoft, Mistral, Open AI and Synthesia. Anthropic states the same in its own words: "We're implementing watermarking to comply with the EU AI Act." Older models get time — "The EU law includes a transition period for Anthropic models launched before August 2, 2026," with the rollout "over the coming months."

Which leaves the gap. "Detectable" currently means detectable by Anthropic. The post's line on tooling is one sentence and a shrug: "We will soon be offering a watermark detection API. We're in the process of working out the details." Until that exists, text leaving Claude carries a mark that no reader, publisher, university, or court can read without asking the company that made it — and the answer it will eventually give is a likelihood, not a verdict. Anthropic is clear that the watermark "doesn't confirm whether the text was human-written" and "can't tell whether the text was written by a different AI," and that the key reveals nothing about who prompted it: "There's nothing in the watermark, or its key, that would allow anyone to recover any information about the user, their organization, or their chats."

That is the right privacy trade. It also means the useful half of this — verification by someone other than the vendor — has a ship date of "soon."

Primary sources: Anthropic, "How Claude's text watermarking works", European Commission, Code of Practice on Transparency of AI-generated Content, European Commission, "Strong backing for the Code of Practice on Transparency of AI-generated Content", read 2026-08-18.