Anthropic starts watermarking Claude's output
Anthropic updated a help center article confirming that Claude models launched on or after August 2, 2026 embed an invisible watermark directly into the text they generate, and attach digitally signed metadata to supported file types like .svg, .png and .jpg. The metadata follows C2PA: the same provenance standard Adobe, OpenAI, Google and others have been pushing for a couple of years. The trigger? The EU AI Act: Anthropic signed the Code of Practice on Transparency of AI-Generated Content article, with existing systems given until the end of the year to comply. Models released before the cutoff are still in progress.
Since the mark lives in the text rather than in an attached metadata field, it survives copy-paste and, according to Anthropic, "may persist through some editing". Watermarking is applied at the model level, so it shows up regardless of whether the text came from the app, the API, Claude Code, Cowork, or anywhere. And it applies worldwide, not just in the EU. Anthropic has published no technical detail on the method, but the approach is biasing at the token level with a secret key, which is what Google's SynthID-Text has done since 2024.
Now, a detected mark means content was processed by Claude, not authored by it - proofreading, translating or summarising someone else's work produces marked output. Absence of a mark proves nothing either: short passages carry too little signal, heavy paraphrase or translation destroys it, and file metadata dies on a screenshot or a format conversion. The detector itself does not exist yet, and Anthropic says technical documentation is forthcoming.
Online reaction was mostly negative among paying users. The reactions basically split between people who liked the idea in principle and people who felt they'd bought a product that now tags their work. Some are poinging out that biasing token choice has a cost, and Anthropic's claim that the watermark doesn't touch quality or meaning has to be tested. Others have asked the simpler questions: what does watermarked text look like? On r/ClaudeAI, the mood was less outrage than doubt about whether any of it survives contact with a rewrite, plus the recurring argument that this is one more reason to run open weights models.
Image watermarks have already been defeated by post-processing, C2PA strippers are sitting on GitHub, and as The Register pointed out, round-tripping text through OCR would flatten anything that depends on trickery at the character level. Statistical token watermarks are harder to strip than zero-width characters, but they degrade under exactly the workflow most people already use: ask a model to rewrite it, and the signal thins out. Now, code is the interesting case. Output that is not very random by nature leaves the sampler very little room to encode anything, so either generated code carries a weak mark or the biasing has to show up somewhere visible, like identifier choice. Without documentation, nobody outside Anthropic can say which.
Compliance required marking output for the EU; Anthropic chose to mark everything everywhere, and the honest reasons are probably operational rather than principled because maintaining two sampling paths for one model is a maintenance tax nobody wants. For better or worse, that turns a European transparency rule into a default for every Claude user on the planet.