Every Word Claude Writes Now Carries a Hidden Signal You Cannot See

Every piece of text that Claude generates now carries a hidden signal. You cannot see it. You cannot find it by reading carefully or looking for unusual characters. It does not change the meaning of a single word or alter the quality of the response in any way a reader would notice.

But it is there. And if you have the right key, you can detect it.

Anthropic began rolling out invisible text watermarking for Claude in August 2026, initially for models launched on or after August 2 to comply with the EU AI Act’s transparency requirements. Claude Fable 5.1 and Mythos 5.1, released September 1, both support it. Older models are being added over the coming months.

This isn’t a rumour or a plan. It is live. Understanding how it works, what it can and cannot do, and why it exists matters for anyone who uses Claude to generate text.

How You Watermark Text Without Touching a Single Word

The obvious intuition for watermarking text is wrong. Invisible watermarks do not work by inserting hidden characters, zero-width spaces, unusual Unicode, or anything you could find by stripping formatting or running a text comparison. The watermark isn’t in the characters at all. It is in the statistical pattern of which words were chosen.

Here is the mechanism, in plain terms.

When a language model generates text, it does not produce one word with certainty at each step. It assigns probabilities to every possible next word and then samples from that distribution. Many adjacent words could follow any given sentence without meaningfully changing its quality or meaning. You could say “dog,” “a puppy,” or “a cat.” You could say “noted,” “observed,” or “remarked.” Each choice is defensible. Each produces a slightly different text but essentially the same meaning.

The watermarking algorithm exploits those choices.

Before generation begins, a secret key is used to secretly classify every possible token as either preferred or not preferred for this particular position in this particular text. It is somewhat like sorting words into green and red buckets, though the specific mechanism involves context-dependent probabilities rather than a fixed list. When the model reaches a position where multiple reasonable choices exist, the preferred words receive a slight statistical boost. Not enough to change the output in any noticeable way. Just enough to create a detectable pattern across many such choices.

Over a long enough piece of text, the pattern accumulates. A detector with the key can count how many preferred tokens appear. If the count is high enough, probability makes it extremely unlikely that a human randomly produced the same distribution by chance—the more text there is, the stronger the statistical signal and the more confident the detection.

Anthropic’s implementation is based on Google DeepMind’s SynthID-Text approach, which uses context-dependent probabilities and a tournament system rather than a simple binary classification. The underlying principle is the same across most research in this area.

What It Reveals and What It Does Not

Several misconceptions about text watermarking circulate, and Anthropic’s documentation addresses them directly.

The watermark does not identify you. Nothing in the watermark or its key encodes anything about the user, their organisation, or the content of their conversation with Claude. It shows that Claude generated or processed the text. It does not show who asked Claude to do so.

It does not prove authorship with certainty. A detected watermark means Claude may have processed the content. It does not prove Claude authored it from scratch. No watermark does not prove human authorship. These are probabilistic signals, not absolute verdicts. Anthropic documents this limitation explicitly. As one analysis put it, almost nobody downstream will read that documentation.

Light editing does not remove it. Swapping a few words, changing some phrases, fixing typos: none of these removes the watermark reliably. The signal is distributed across hundreds of token choices. Changing a small percentage of them does not wash out the statistical pattern.

Heavy rewriting does remove it. If you replace essentially every word and restructure the entire text, the watermark likelywon’tt survive. Thorough translation into another language and back also significantly weakens the signal, per Google’s own SynthID-Text research. Complete rewrites defeat the detection.

Code is a partial exception. Watermarking depends on having low-stakes token choices where alternatives exist. Many parts of code are deterministic: there is one correct syntax, one correct variable name, one correct function call. Anthropic says watermarking still applies to arbitrary choices within code (comments, variable naming where flexibility exists) but has negligible effect on the actual logic produced.

Short texts carry weak signals. Detection confidence depends on text length and the amount of entropy (genuine optionality) in the generation. A two-sentence response does not accumulate enough choices to produce a strong signal. A multi-paragraph essay does.

Who Can Actually Check for a Watermark

Right now: very few people.

Anthropic is releasing a detection API, currently in private preview for eligible organisations, including certain enterprises with EU compliance duties. The API is not publicly available.

The detection API requires Anthropic’s secret key. Without the key, you cannot verify the watermark. Importantly, this means the standard AI detection tools you may have encountered, which claim to detect AI writing from style patterns and phrasing quirks, are doing something completely different. They are looking at surface characteristics of text (AI models do tend to use “quietly” and “it’s not X, it’s Y” more than humans) rather than checking a cryptographic pattern. Those tools will continue to work independently of watermarking and will also continue to produce both false positives and false negatives.

There is also already an open-source tool that claims to strip C2PA metadata from files. Removal of C2PA metadata is verifiable. You can’t verify removal of the statistical text watermark because you cannot check for its absence without the key.

Why This Is Happening

The legal driver is the EU AI Act, specifically Article 50, which came into force on August 2, 2026. It requires AI system providers to mark AI-generated content so it can be identified. Anthropic, along with more than 190 other signatories, including other major AI providers, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026.

Anthropic is applying watermarking globally rather than only within the EU because it does not yet have a reliable way to scope the feature by region. Every user, regardless of location, gets watermarked output from supported models.

The stated purpose is transparency: making it possible for institutions, platforms, and researchers to detect AI-generated content when they have legitimate reasons to do so. The stated limitation is equally explicit: watermarking is not a perfect identification system and should be treated as one signal among several, not a definitive verdict.

The Harder Question Underneath

The transcript that prompted this article did not agree with the watermarking rollout and published it to inform people. That is a fair position to hold, and the technical concern beneath it is real.

A system that produces a probabilistic, authorship-agnostic signal is being deployed at scale. Schools, employers, platforms, and detection tools will encounter the system’s output. Anthropic has clearly documented that a detected watermark means “Claude may have processed this,” not “Claude wrote this and a human did not.” That distinction matters enormously if detection results are used to accuse people of academic dishonesty or plagiarism.

The documentation is careful. The real-world deployment will not always be.

On the other side of the argument: the same technology that lets AI labs generate convincing text at scale creates a genuine societal interest in being able to identify it. Watermarking is one of the few technically grounded approaches available. The alternative, no provenance mechanism at all, is not obviously better.

Open-weight models that run locally produce no watermark, because the generation happens on your own hardware and no external key is involved. That remains true regardless of how closed-model watermarking evolves.

What is clear, regardless of where you land on the policy question, is that Claude’s text output now contains a hidden statistical signal in every response from supported models. It travels with copied text. It survives light editing. It requires Anthropic’s key to detect. And it is the new default for the most widely used frontier model that most people interact with.