Claude's text watermark, explained (August 2026)

What Anthropic announced on August 11, 2026

On August 11, 2026 Anthropic updated its help center and briefed the press: text generated by Claude now carries a machine-readable watermark, and files produced by Claude (SVG, PNG, JPG) carry signed provenance metadata following the C2PA standard. TechCrunch, Axios and Forbes covered the news between August 11 and 13. The company's own wording is that Claude "embeds an imperceptible watermark directly into the text itself" and that the mark "doesn't change the meaning, quality, or readability" of the response.

Two things are worth separating from the start. The file metadata is the familiar kind: a signed manifest attached to a file, which disappears if you screenshot the image or re-export it. The text watermark is different in nature. It is not attached to the text; it is the text. That is what makes it interesting, and what makes it hard to remove by hand.

How a statistical text watermark works

Forbes summarised the mechanism in one sentence: the watermark "works by statistically biasing Claude's word choices according to a key held by Anthropic." This is the same family of techniques as Google's SynthID-Text, published in Nature in 2024 and open-sourced the same year, and as the academic "green list" schemes that came out of the University of Maryland in 2023.

The idea is simple. When a language model writes, it picks each next word from a probability distribution. A watermarking model nudges that choice: for each position, a secret function of the previous words and a key splits the vocabulary into a "preferred" and a "non-preferred" set, and the model leans slightly towards the preferred set whenever it does not cost quality. One nudge is invisible. Over a few hundred words, the preferred set gets picked far more often than chance would predict, and anyone who holds the key can count that excess and compute a confidence score.

Three consequences follow, and they explain most of what people are now noticing:

• You cannot see it. There are no zero-width characters, no odd spaces, no Unicode look-alikes. Pasting the text into a plain-text editor changes nothing. Find-and-replace has nothing to find.
• It is probabilistic, not binary. A detector does not say "yes" or "no", it says "this text is X standard deviations above chance." Long texts give strong signals; short ones give weak signals. Anthropic's note says as much: very short passages may show no detectable signal.
• Editing dilutes it, it does not delete it. Change one word in ten and nine tenths of the signal remain. That is why Anthropic can say the mark "may persist through some editing." Rewriting most words, or translating the text, does destroy it, because the preferred sets no longer line up.

Which texts are affected

According to Anthropic's help article, "Claude models launched on or after August 2, 2026 will support machine-readable marking at launch," and the company is "working to add marking support" to earlier models during a transition period. Marking applies across the Claude app, Claude Code, Claude Cowork, Claude Tag and the Claude Platform (API), and it functions worldwide, not only for European users. Cloud partners (AWS, Google Cloud, Microsoft Foundry) are listed as supporting the text watermark, while the signed file metadata "may not be supported on every platform."

In practice, for someone writing in August 2026:

• Text you generate today with a current Claude model is watermarked, whether you use the consumer app or the API.
• Text you generated with an older model before the rollout is not retroactively marked, but Anthropic intends to bring older models into the scheme, so "older model" is a shrinking exception.
• There is no opt-out setting described anywhere in the help article, for individuals or for API customers. If you deploy Claude in your own product, Anthropic tells you to "independently assess what Article 50 requires."

What survives, what does not

Anthropic's own robustness statement is careful. The watermark "will travel with the text when it's copied and pasted elsewhere, and may persist through some editing." Marks "may disappear" if the text is "heavily edited, paraphrased, translated, or mixed into other writing" or if passages are "very short." Read as a checklist:

The last row matters for expectations in both directions. A subject line generated by Claude carries, for practical purposes, no usable signal at that length in either direction. A 1,500-word article is the opposite: plenty of positions, strong signal.

Who can detect it, and what a detection means

Because the mark depends on a secret key, only a party holding the key can compute a reliable score. As of mid-August 2026 Anthropic says it is "working to enable users and other third parties to detect Claude's embedded watermarks," and Forbes notes that the detection tools are "forthcoming" and that no accuracy thresholds or dispute procedures have been published. So today, a random online "AI detector" is not reading Anthropic's watermark; it is guessing from style, which is a different and much noisier thing.

The second point is more important and easy to miss. Forbes puts it plainly: "A detected watermark means that content may have been assessed or processed by Claude, not that Claude wrote it." If you paste your own draft into Claude and ask for a tighter version, the tighter version is Claude output and carries the mark. If a detector later flags it, the detector is technically right about the last step and wrong about authorship.

Why proofreading and translation cause false positives

This is the scenario behind most of the complaints Forbes reports from subscribers. Consider three ordinary workflows in August 2026:

1. A translator drafts a paragraph, then asks Claude to check terminology and smooth the sentence. The returned paragraph is regenerated by the model, so it is watermarked. The client's checker flags it as AI-written.
2. A journalist writes a piece and uses Claude to shorten it to length. Same result: the shortened version is model output.
3. A student or an employee writes a report in their second language and asks Claude to correct the grammar. The corrected report is marked, even though every idea and most sentences are theirs.

None of these people asked a model to write for them, and all of them end up with a text that carries a signal saying "processed by Claude." That is exactly the gap between "processed" and "written" that Anthropic itself points to, and it is why a tool that neutralises the signal while keeping the meaning has a legitimate audience: people who did the writing and used Claude the way they used to use a spell checker.

Why now: the EU AI Act, article 50

The timing is not a coincidence. Article 50 of the EU AI Act sets transparency obligations for providers of generative systems, including the requirement that outputs be marked "in a machine-readable format and detectable as artificially generated or manipulated." Those obligations started to apply on August 2, 2026, the same date Anthropic uses as the cut-off for its models. Forbes reports fines of up to 15 million euros or 3 % of worldwide turnover for non-compliance. Anthropic chose to apply the watermark globally rather than only in Europe, which is simpler to run and harder to circumvent by changing region.

Anthropic is not alone. TechCrunch lists Google, Meta, Microsoft, OpenAI, Black Forest Labs and Synthesia among the signatories of the EU transparency code, and notes that Suno and Substack announced their own marking initiatives. Google has watermarked images since 2023 and extended SynthID to text, audio and video. OpenAI, according to Wall Street Journal reporting quoted by Forbes, has had a text watermark ready for years and has not switched it on, citing competitive concerns. Our comparison of what each vendor actually ships is in AI text watermarks compared.

What this changes if you write with Claude

A few practical conclusions, none of them dramatic:

• Assume that anything a current Claude model returns is marked, including "just fix the grammar" passes.
• Do not rely on light editing to change that. Detection is statistical, and nine tenths of a signal is still a signal on a long text.
• Know your disclosure obligations. The watermark does not create them; your employer, your client, your publisher or the AI Act may. Neutralising a mark does not change what you must declare, and it should not be used to misrepresent authorship where that matters.
• If your problem is the false-positive case above, a meaning-preserving rewrite is the honest fix: it returns a text you wrote to a state where it reads as yours. That is what Unmarker is built to do; the method, and its limits, are described in How to remove the Claude watermark.

This guide describes public statements by Anthropic and press coverage as of August 15, 2026. Anthropic has not published the algorithm, the key management or the detector thresholds; where this text says "likely" or "in practice", it is reasoning from how published statistical watermarks (SynthID-Text, Kirchenbauer et al.) behave, not from Anthropic's internal documentation.