Claude Now Hides a Watermark in Every Word It Writes. There Is No Off Switch, and No Tool Can Strip It

The quiet part is the scope. Anthropic’s own help document, the primary source for this story, says new models “will support machine-readable marking at launch” and that marking applies across the Claude app, the API, Claude Code, Claude Cowork, and Claude Tag, plus AWS, Google Cloud, and Microsoft Foundry. Older models are being retrofitted. Nothing in the document mentions a way to turn it off.

The trigger is European law. Article 50 of the EU AI Act requires generative AI providers to mark outputs “in a machine-readable format” so they are detectable as artificial, and those obligations apply from 2 August 2026. Anthropic signed the EU’s voluntary Code of Practice on transparency, then went further than the law demands: rather than run a marked Claude for Europe and a clean one for everyone else, it flipped the switch globally. TechCrunch broke the story on August 11.

How do you hide a watermark inside words?

There is no secret character and no metadata. Anthropic says Claude “weaves an imperceptible watermark directly into the text itself.” The published way to do that: at every step, a language model chooses between many near-equivalent next words, and a secret key nudges those choices in a pattern a detector can later count. Google has run this in production since 2024, open-sourcing its SynthID text scheme after a live test on roughly 20 million Gemini responses found users “did not notice a difference in quality.” Anthropic has not published its method: “We’ll share details on detection mechanisms in forthcoming technical documentation.” Until that ships, only Anthropic can check for the mark.

• ✦Survives copy-paste. In Anthropic’s words, “it will travel with the text when it’s copied and pasted elsewhere.”
• ✦May survive light edits. The mark “may persist through some editing.” No one has said how much editing is enough.
• ✦Weakens under heavy rewriting. Anthropic’s own failure list: text “heavily edited, paraphrased, translated, or mixed into other writing.”
• ✦Short text carries no signal. A sentence or two leaves “too little text for a reliable signal.”
• ✦Absence proves nothing. “Lack of a detected mark doesn’t mean the content wasn’t AI-generated.”

A mark proves Claude touched it, not that Claude wrote it

This is the distinction that will be misread everywhere, so here it is plainly. Anthropic’s document says output can carry the mark when Claude was used to “proofread, translate, summarize, or convert files,” and warns that “Claude may not be the original author.” Paste your hand-written novel in for a grammar pass and the pages that come back may carry the mark. The mark is a receipt that says Claude was in the room. It is not a verdict on who did the writing.

That nuance matters because the world already convicts on weaker evidence. Bloomberg Businessweek tested two popular AI detectors against 500 college essays written before ChatGPT existed, and 1 to 2 percent were flagged as AI anyway, with detectors “in some cases claiming to have near 100% certainty.” Roughly two-thirds of teachers surveyed report using AI checkers regularly. A cryptographic mark with a real detector would be an upgrade over that guesswork, but only if the people reading the result respect the line between processed and authored.

The internet’s verdict, in four posts

The announcement threads are enormous: 2.9k upvotes on r/ClaudeAI, 1.1k on r/singularity, 343 points on Hacker News. The spectrum runs from students afraid of false accusations to developers arguing the mark cannot coexist with code quality, to an entire comment chain written in Claude’s own cliches to prove you never needed a watermark to spot it.

The image half is weaker, and Anthropic says so itself

Text and images get completely different treatment. Files like .svg, .png, and .jpg do not get an invisible watermark. They get signed provenance metadata under the C2PA open standard, a cryptographic label that “signals that a file was processed by Claude.” Metadata is the weaker mechanism, and Anthropic’s own failure list says so: the label disappears when “file metadata was stripped through format conversion, re-saving, screenshots.” Taking a screenshot of an image defeats it. So does saving it in a different format.

For transparency: C2PA is the same class of metadata our metadata remover reads and strips, alongside EXIF and GPS, and any re-encode through an image converter drops it too. That is not a loophole we built, it is how metadata works, and Anthropic documents it openly. The text watermark is the opposite case, and we will be just as plain about that: no tool can strip it, ours included. It lives in the words themselves. The only thing that degrades it is rewriting the words, which Anthropic already tells you.

What this changes for you