Claude now watermarks everything it writes, and code is the part it can't touch
Anthropic published the mechanics of Claude's text watermark on August 14, and the interesting part isn't the watermark. It's where the watermark fails.
Here's the method. Claude generates one token at a time, and at each step there's a list of plausible next tokens. Most of those choices are low-stakes — pick this synonym or that one, this clause order or the other. The watermark biases those low-stakes picks according to a key, so the finished text carries a statistical pattern nobody reading it can see. This is Google DeepMind's SynthID-Text, not something Anthropic invented. Nothing gets appended to your output, there are no hidden Unicode characters, and it doesn't cost extra tokens. Anthropic says quality is unaffected, and a detection API is coming. Read the writeup at https://www.anthropic.com/news/claude-text-watermark
Now the part that matters if you build agents. Code is barely watermarked at all. Not by policy — by physics. Watermarking needs freedom, and code doesn't have any. There's no synonym for a variable that's already been declared, no arbitrary clause order in a function signature that still compiles. The only place a signal can hide in a code file is the comments, where word choice is genuinely free. So the domain where Claude output travels furthest and gets reused most heavily is the domain the watermark can barely mark.
The durability story is the same shape. Light edits survive. A full rewrite destroys it, but as Anthropic points out, at that point it's fair to argue the text isn't AI-generated anymore. Heavy proofreading degrades detection depending on length. In other words the watermark is a good signal for text that came out of Claude and went straight into the world, and a weak one for anything a human worked over — which is most professional output.
The driver is EU AI Act Article 50, and Anthropic is applying it globally rather than geofencing it. That's the right call and also the expensive one. A handful of users on X made noise about cancelling subscriptions, which is a rounding error, but it points at the real tension: a provenance mark is a feature when you're auditing what your agents produced and a liability when you assumed the output was anonymous. If you run a pipeline where Claude drafts text that ships under someone else's name, that assumption just changed. Worth checking before somebody else checks it for you.
← Back to all articles
Here's the method. Claude generates one token at a time, and at each step there's a list of plausible next tokens. Most of those choices are low-stakes — pick this synonym or that one, this clause order or the other. The watermark biases those low-stakes picks according to a key, so the finished text carries a statistical pattern nobody reading it can see. This is Google DeepMind's SynthID-Text, not something Anthropic invented. Nothing gets appended to your output, there are no hidden Unicode characters, and it doesn't cost extra tokens. Anthropic says quality is unaffected, and a detection API is coming. Read the writeup at https://www.anthropic.com/news/claude-text-watermark
Now the part that matters if you build agents. Code is barely watermarked at all. Not by policy — by physics. Watermarking needs freedom, and code doesn't have any. There's no synonym for a variable that's already been declared, no arbitrary clause order in a function signature that still compiles. The only place a signal can hide in a code file is the comments, where word choice is genuinely free. So the domain where Claude output travels furthest and gets reused most heavily is the domain the watermark can barely mark.
The durability story is the same shape. Light edits survive. A full rewrite destroys it, but as Anthropic points out, at that point it's fair to argue the text isn't AI-generated anymore. Heavy proofreading degrades detection depending on length. In other words the watermark is a good signal for text that came out of Claude and went straight into the world, and a weak one for anything a human worked over — which is most professional output.
The driver is EU AI Act Article 50, and Anthropic is applying it globally rather than geofencing it. That's the right call and also the expensive one. A handful of users on X made noise about cancelling subscriptions, which is a rounding error, but it points at the real tension: a provenance mark is a feature when you're auditing what your agents produced and a liability when you assumed the output was anonymous. If you run a pipeline where Claude drafts text that ships under someone else's name, that assumption just changed. Worth checking before somebody else checks it for you.
Comments