Claude now hides an invisible signature in everything it writes

On Tuesday 11 August, Anthropic said it will watermark the text its Claude models produce. Every model released after 2 August carries it automatically, and the company said it plans to extend it to older models too.

A watermark here is not a logo stamped on the corner of a picture. It is an invisible pattern woven into the words themselves, which anyone holding the right key can test for later. It survives copy and paste. It survives some editing.

The reaction was not warm. Users objected that their own work would now be flagged as machine-made, and Business Insider reported that dozens of people on X said they were cancelling their subscriptions over it.

On Friday 14 August, Anthropic published a longer explanation answering the obvious questions. That post is the reason this is worth a brief now rather than last week: until Friday, most of what people were angry about was unspecified.

Anthropic is using a method Google DeepMind published, called SynthID-Text. The idea is easier than it sounds.

A language model does not pick the single correct next word. It picks from a spread of candidates, and very often several of them are equally fine. "Big", "large" and "sizeable" can all finish the same sentence without anyone noticing which one was chosen.

The watermark lives in exactly those moments. At each low-stakes fork, a secret rule nudges the model toward one branch rather than the other. Any single choice looks like nothing. Across a few hundred words, the accumulated pattern of choices is a fingerprint, and someone with the key can measure it.

This is why it survives copy and paste. The mark is not attached to the file. It is the words.

Prose gets the full treatment. Code barely gets any: Anthropic says the watermark can only sit in arbitrary choices such as variable names and comments, never in the parts that decide what the program does. That limit is not a policy decision, it is arithmetic. There is no synonym for a semicolon.

Editing degrades it gradually rather than switching it off. Anthropic's own description is that light editing preserves the mark, and that a complete rewrite in which every word is replaced will remove it. Between those two poles the company has not published a threshold, which is the single biggest open question in the whole story.

Files are handled separately, using C2PA, an open standard that attaches signed provenance metadata saying where a file came from. That is a different mechanism with a different weakness: metadata can be stripped, whereas the text mark cannot be stripped without rewriting the text.

One line from Anthropic's FAQ is worth quoting because it addresses the fear most people had: "To a reader, a watermarked response is indistinguishable from an unwatermarked one." The company also states plainly that watermarking does not affect output quality. Both claims are the company's own, and neither has been independently tested yet.

This is not a spontaneous attack of conscience. The EU AI Act's Transparency Code took effect on 2 August, and it requires AI companies to mark generated or edited content in a way other machines can read.

That timing explains the otherwise odd detail that the rule applies to models released after 2 August. Anthropic is not choosing a launch date, it is complying with one.

It is worth being precise about the target. The regulation is aimed at a machine-readable provenance signal at internet scale, so platforms and search engines can tell what was generated. It was not written to help a manager work out whether an employee wrote their own memo. That gap between what the rule is for and what people fear it will be used for is where all of this week's argument lives.

The loudest objection has been that the watermark will expose people using Claude at work or in coursework. It is easy to be smug about that. It is also worth answering properly, because two very different situations are being folded into one.

In the first, somebody submits work as their own that a machine wrote end to end while they read their phone. A detectable mark is inconvenient to them in the way a receipt is inconvenient to a shoplifter, and that is roughly the intended effect.

In the second, somebody drafts, argues with the model, rewrites, restructures and ships something that is genuinely theirs, with machine text still in the plumbing. The watermark cannot tell those two cases apart. It reports one fact, which is that these words passed through Claude. It says nothing about who did the thinking.

That is the real risk, and it is not a technical failure. It is that a signal meaning "this passed through a model" will be read by employers, universities and clients as if it meant "this person did not do the work". The tooling will be accurate and the conclusion drawn from it will often be wrong.

On Friday 14 August, Google announced that Gemini users can now switch off the visible watermark on AI-generated images, video and music. The setting is called Media Watermark, it lives in Gemini's settings, and Josh Woodward, Google's VP for Gemini, said it covers the Nano Banana, Omni and Lyria models, in Gemini and in the video editor Flow, with Search to follow.

The two announcements look contradictory and are not. Google removed the visible badge and kept the invisible one: SynthID and the C2PA metadata stay in the file either way. What changed is whether a viewer sees a label, not whether the content can be identified.

Read together, the week points somewhere specific. Visible labelling, the thing an ordinary person can actually see, is becoming optional because it makes content awkward to use professionally. Invisible labelling, which only works if you have the key and the tooling, is becoming mandatory. Provenance is being built for institutions rather than for readers.

Partly. Google has watermarked AI images with SynthID since 2023, and C2PA provenance has been shipping in cameras and editing software for a few years. Marking machine-made media is established practice.

Text is the genuinely new part, and it is the hardest case. An image has millions of pixels to hide a signal in and nobody edits them by hand. A paragraph has a few hundred words, a person rewrites half of them, and the signal has to survive that. It is a much thinner channel.

The other new part is that this is a frontier lab marking its own flagship product by default, without an opt-out, in response to a law. That is a different posture from a research demo.

The detection API. Anthropic says it plans to release one, with no announced timeline or pricing. Who gets a key is the entire story. If it is broadly available, expect a detection industry and expect false accusations. If it stays narrow, the watermark mostly serves platforms and regulators and barely touches the classroom fear driving this week's anger.

Published false-positive rates. Every previous generation of AI-text detector was wrong often enough to ruin people, and the ones that got sold anyway did real damage to students. A watermark is a fundamentally better mechanism than a guessing detector, because it looks for a signal it put there itself. That is a reason for cautious optimism, not for taking the accuracy on faith before anyone outside the company has measured it.

The editing threshold. Anthropic has said light edits keep the mark and total rewrites destroy it. Somewhere in between is a line, and if it turns out that a normal editing pass removes the watermark, the scheme mostly catches people who did not bother.

Whether OpenAI and Google follow for text. The same EU code applies to them. If they do, machine-marked text becomes the default state of written English rather than one company's policy, and this stops being a story about Claude.