Claude’s text watermark, explained

01

What Anthropic shipped

“Future Claude models will generate text that contains a watermark,” Anthropic wrote, describing it as a way of determining the likelihood that Claude was involved in writing a piece of text. Read that sentence carefully, because most coverage did not: this is an announcement about models yet to launch, not a switch thrown on the Claude you used this morning. It is applied globally at launch, because Anthropic says it does not yet have a durable way to scope it by region. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

The summary Anthropic gives: the method has no practical impact on the quality or content of outputs; the difference is not distinguishable to readers; nothing is added to the text and there are no hidden characters; it requires no extra tokens and costs no more; and it carries no identifying information. That third point is worth repeating, because the common guess - that a watermark means invisible Unicode characters slipped into the output - is wrong. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

It is also not a Claude-specific event. Anthropic notes that other major model developers signed the same EU Code of Practice and will implement their own watermarks, so this is the start of an industry-wide change rather than one vendor’s policy. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

Detection is not open. Only a key-holder can read the mark, and Anthropic says it “will soon be offering a watermark detection API” with implementation details still being worked out. At the time of writing that API is not available, so no third party - no university, no publisher, no AI coding agent - can currently check text for it. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

02

How the watermark works

A language model writes one word at a time, choosing among candidates. For many positions several candidates are equally good - Anthropic’s example is “The weather today was cold and…”, where overcast and grey serve the reader identically. Normally that tie is settled by a random number. A watermarked model settles it with a key instead: the key plus a few preceding words decide which candidate is picked. Across a long passage those decisions form a pattern that a key-holder can measure and a reader cannot see. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

Two things it does not do. It does not bias Claude permanently toward one word - overcast may win in one sentence and grey in the next, depending on what came before. And it does not push Claude toward words it would never have used; Anthropic’s illustration is that it would not make Claude reach for “nubilous”. The choices stay inside the set the model already considered reasonable. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

Anthropic’s own analogy is a board game where players take their moves from the digits of pi instead of a die. To the players nothing changes and the game is just as random - but someone who knows pi can look at the sequence of moves afterwards and tell that this game used it. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

This is an established method, not a new invention. Claude’s watermark is a version of SynthID-Text, published by Google DeepMind in Nature in 2024, which belongs to a family of approaches going back to a 2022 proposal by Scott Aaronson. The paper modifies only the sampling procedure, leaving training untouched and keeping detection cheap because it never has to run the model. DeepMind served it to a slice of live Gemini traffic and found no statistically significant difference in thumbs-up and thumbs-down ratings, and human raters comparing answers side by side saw no quality difference. Source: Dathathri et al., "Scalable watermarking for identifying large language model outputs", Nature, 2024.

It follows that the watermark is sparser on factual passages, “where there are fewer choices that can be made without decreasing the accuracy of the text”. Anthropic’s example: after “Isaac Newton’s most famous work was called Principia…”, it really matters that the next word is “Mathematica”, so the watermark has nothing to act on. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

The consequence to hold on to: the watermark is made of choices. Where the text has room to say the same thing several ways, the signal is strong. Where it does not, there is nothing to encode. That single fact explains every limit in the sections below.

03

Does Claude watermark the code it writes?

Almost not at all, and you should not rely on it. Anthropic is explicit: where an exact output is required - “where there isn’t a choice, and something would be factually wrong or a piece of code would break if a different term was chosen” - the watermark is not applied. Its example is that once a model has written “2 + 2 =”, there is no equally good alternative to “4”, so the nudge has nothing to act on. Code is that situation repeated line after line. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

There is one carve-out worth knowing. Where code does contain arbitrary choices - Anthropic names comments inside code - the watermark can attach to them. But it adds that “by definition, it will have a negligible effect on the actual code produced”. So the signal that survives lives in prose that happens to sit between slashes, and it is the first thing stripped by a minifier, a build step, or a reviewer who deletes chatty comments. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

So the question people are already asking - can a watermark tell me whether this pull request was written by Claude Code? - has an unsatisfying answer: no, not reliably. A long design document written by an agent carries signal. A 40-line function does not, both because exact output suppresses the watermark and because detection is weak on short samples. Teams that need to know which changes were agent-authored should record it at the source - a commit trailer, a PR label - rather than wait for a detector to infer it. The catalog’s most-installed commit skills do exactly that job: git-commit and conventional-commit both structure the message where a provenance trailer belongs.

04

What a watermark proves, and what it does not

It answers one question only. Using the key, Anthropic says, “one can only answer the question ‘What is the likelihood this was partly written by Claude?’” It does not confirm that a text was human-written, and it cannot tell whether a different AI wrote it - another model would have a different key, or a different watermarking method altogether. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

It cannot grade involvement. Anthropic states plainly that a watermark “cannot distinguish ‘Claude wrote this’ from ‘Claude heavily edited this’”. A positive result is compatible with both. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

It cannot identify anyone. The watermark “carries no identifying information and can’t be traced to a specific person, organization, or chat”, and there is nothing in it or its key that would let anyone recover information about a user, their organization, or their chats. It is therefore useless as an audit trail or a leak tracer. Anthropic also states it changes nothing about ownership, authorship, or legal responsibility for an output. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

It needs length. Detection “doesn’t work well on small samples, where there are fewer word choices and thus less information to go on”; confidence rises as a passage gets longer. A tweet, a commit message, or a single paragraph is thin ground for a verdict. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

Put together, this is a transparency signal, not a forensic tool. It suits its stated purpose - telling synthetic text from human text at scale - and does not suit the uses people will attempt anyway: grading a student, disciplining an employee, or proving authorship of a short passage. A negative result is especially weak evidence, since it is equally consistent with human writing, a different model, a short sample, code, or a rewrite.

05

Edited, proofread, and translated text

The watermark only applies to words Claude chooses. When Claude proofreads a human draft, nearly all the words remain the person’s, so there is very little for the mark to attach to. Anthropic’s example: ask it to fix only grammar and punctuation and the watermark can live only in that handful of corrections, “which might be too few to register”. The more Claude writes, the more decisions it makes, and the more space there is for a watermark. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

Translations are the opposite case. Anthropic confirms a Claude translation does carry a watermark, because in a translation every word is chosen by Claude - even though the underlying meaning came from a human author. Worth knowing before anyone treats a positive detection on a translated document as proof the content itself is synthetic. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

And a full rewrite defeats it. “Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will,” Anthropic states - adding that at that point it is arguable whether the text can still be called AI-generated at all. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

06

Images and files use C2PA metadata, not a watermark

This is the part most coverage misses. When Claude produces a file of a supported type - Anthropic names .png, .jpg and .svg - it does not watermark it. It attaches a content credential: a small, cryptographically signed note in the file’s metadata recording that the file was made or processed with Claude. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

That standard is C2PA, the open industry standard also used by camera manufacturers and photo-editing software to record where an image came from. Any C2PA-aware tool can read it, and Anthropic says it will provide its own checker where you can drop a file and inspect the credential. Source: C2PA - Coalition for Content Provenance and Authenticity.

The distinction matters for anyone building on this. A watermark is inside the content; a content credential is metadata alongside it, and Anthropic stresses that “nothing in the file changes - it is not embedded or hidden”. Like the text watermark, the credential says only that Claude was involved and carries no identifying information. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

Skillselion’s read, not Anthropic’s claim: that difference makes the two fail in opposite ways. A watermark survives copy-paste but dies under rewriting; a content credential survives rewriting of the surrounding page but dies the moment anything strips file metadata - a re-encode, a thumbnail step, an upload pipeline that normalises images. If you depend on the credential, test your own pipeline rather than assume it passes through.

Two catalog entries do that check from inside a coding agent. Image Metadata AI MCP exposes image-metadata operations over stdio, so an agent can read what a credential actually says (same publisher as three of the servers in section 10). image-manipulation-image-magick is the blunter, far more widely installed option: it wraps ImageMagick for resizing, format conversion and metadata retrieval, which is exactly the resize-and-re-encode step most likely to drop the credential in the first place. Run a file through your own pipeline, then read its metadata on the far side.

07

Watermarks are not AI detectors

Products like Pangram work a different way, because their makers do not hold Anthropic’s key. Anthropic describes them as reading the “subtle (and not-so-subtle) ‘tells’ that often appear in AI’s phrasing” - naming the fondness for the construction “this isn’t [X], it’s [Y]” and a striking overuse of the word “quietly”. That is pattern recognition on style; a watermark is a statistical signal planted at generation time and read with a key. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

The two therefore fail in different directions, and neither is proof. Text with no watermark at all can still trip a style detector, because tells are a guess about who wrote something, not a measurement. And the two do not move together under editing: a style pass targets phrasing a detector keys on, while the watermark weakens in proportion to how many of Claude’s actual word choices survive - Anthropic says light editing “probably won’t remove the watermark completely” and only a complete rewrite will. Rewriting to beat one says nothing reliable about the other. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

08

Why now: the EU AI Act’s transparency rule

Article 50(2) of the EU AI Act requires providers of AI systems that generate synthetic audio, image, video, or text to mark the output in a machine-readable format, detectable as artificially generated or manipulated. Those transparency obligations apply from August 2, 2026. Source: EU AI Act, Article 50 - Transparency obligations.

Anthropic states the reason directly - “We’re implementing watermarking to comply with the EU AI Act” - and signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026, one of around 190 signatories alongside several other major model providers. Source: Anthropic, "How Claude's text watermark works", August 14, 2026. Source: European Commission, backing for the Code of Practice on Transparency of AI-Generated Content.

The article carries a carve-out that maps neatly onto the mechanism. Article 50(2) says the marking duty “shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof”. Set that beside what Anthropic says about proofreading - that a grammar-and-punctuation pass leaves the watermark too few choices to register - and the law and the technique agree: light assistive editing is neither marked nor required to be. Source: EU AI Act, Article 50 - Transparency obligations.

That also explains the odd-looking cutoff for older models. Anthropic says the EU law includes a transition period for models launched before August 2, 2026, and that watermarking for those will roll out over the coming months. The date is the rule’s, not the engineering’s. Source: Anthropic, "How Claude's text watermark works", August 14, 2026.

Nothing here is legal advice. Article 50 places duties on providers and, separately, on deployers who put AI-generated content in front of people; if you ship a product into the EU, read the article itself rather than this summary.

09

What it changes if you build with agents

Nothing breaks. No token cost, no latency, no prompt change, no quality change, and nothing to configure. Existing integrations, agent skills and MCP servers keep working exactly as before.

Do not build on the detector yet. The detection API is announced, not shipped, and its interface, price, and rate limits are unknown. Any compliance workflow that assumes “we will check outputs with Anthropic’s detector” is currently a plan with a missing dependency.

Using a watermarked model is not the same as being compliant. The marking duty in Article 50(2) attaches to the provider of the generating system. If your product generates text, images, or audio of its own - or re-publishes model output as your own content - the marking and disclosure questions are yours to answer, and inheriting Claude’s watermark does not answer them.

Mind your file pipeline. If your product passes Claude-generated images through resizing, re-encoding, or a CDN transform, check whether that step preserves C2PA metadata. A credential silently stripped in the build is the easiest way to lose the provenance you are relying on.

Record provenance where you know it. The one moment agent authorship is certain is generation time. Commit trailers, PR labels, document metadata, and content credentials all beat any downstream detector - and they work for code, where the watermark is weakest.

10

Watermarking and provenance tools in the catalog

Skillselion indexes MCP servers that let a coding agent mark and attest its own outputs - the side of the problem that stays yours after the model does its part. These entries name Article 50 as their reason to exist. Two caveats we would rather state than hide: three of the four share one publisher (io.github.CSOAI-ORG), so this is a thin and concentrated corner of the catalog rather than a competitive field; and none of them carries an adoption figure, because - as our MCP Server Census found - not one of the 8,433 catalogued MCP servers has an install count. Judge them on their code, not on a ranking we cannot compute.

Agent Content Watermark MCP - Marks AI-generated content with visible and invisible watermarks, framed against the Article 50(2) machine-readable marking duty.

Watermarking Authenticity MCP - A Python stdio server for teams shipping generative images, audio, or video that need machine-readable marking on their own outputs.

Meok Watermark Attest MCP - Watermarking, marking, and attestation aimed at Article 50 transparency obligations for chatbots and content tools.

ClauseKeeper Compliance Scanner - A deterministic, rule-based scanner for missing or stale clauses in a site's legal documents - the disclosure side of the same obligation.

For the wider picture of what the agent ecosystem contains and how fast it moves, see AI Agent Statistics and the MCP Server Census, or browse the agent skills catalog ranked by real install counts.

§

Sources

Anthropic, "How Claude's text watermark works", August 14, 2026

Dathathri et al., "Scalable watermarking for identifying large language model outputs", Nature, 2024

European Commission, backing for the Code of Practice on Transparency of AI-Generated Content

C2PA - Coalition for Content Provenance and Authenticity

EU AI Act, Article 50 - Transparency obligations

Definitions: AI text watermarking, SynthID-Text, C2PA content credentials, EU AI Act Article 50. This page is free to reuse with attribution: cite “Skillselion, Claude’s text watermark explained” and link it. It is updated when the facts move - above all when the detection API and the C2PA checker ship.

Skillselion is an independent project and is not affiliated with Anthropic, OpenAI, Cursor, Claude, Claude Code, or Codex. Quotations from Anthropic’s announcement are reproduced for identification and comment.