Claude’s Invisible Watermark Marks Even Your Own Writing

Anthropic is adding invisible watermarks to everything Claude produces — and to everything Claude merely edits. Under the EU AI Act’s Article 50, providers of AI systems that generate text must mark their outputs so they can be detected as machine-made. Anthropic’s implementation, announced in August 2026, applies that mark at the token-selection level: every time Claude chooses a word, the choice is nudged to encode a hidden signal. The consequence is that the technique cannot distinguish between text Claude authored from scratch and text a user wrote themselves but asked Claude to polish. If Claude touched it, it is marked.

The answer-first version: Anthropic is watermarking all Claude output, worldwide, by biasing which near-equivalent words the model selects. The mark is invisible, cannot be opted out of, and applies to edited text as well as generated text. If you use Claude to proofread your own writing, your words now carry a signal that says “processed by AI” — and you have no way to see it, remove it, or check how much of your text it affects.

What Anthropic announced

In an updated support article, Anthropic confirmed it has signed the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content. The article describes how the company plans to comply: by embedding watermarks in text, and signed provenance metadata in generated files such as PDFs, images and SVGs. For text, the key passage reads: “When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.”

Notably, the watermark applies worldwide, not only in the EU. Anthropic states that “marking will apply to output from supported models wherever Claude is offered” — meaning users in every jurisdiction receive the same treatment, regardless of whether their local law requires it. The company has not explained why it chose global application over a regional one, though a per-region carve-out would obviously weaken the signal’s utility.

How the watermark works

When a language model generates text, it does not write words; it samples tokens. At each step, the model produces a probability distribution over possible next tokens — the word “tropical” might have a 12% chance, “exotic” 11%, “fresh” 9% — and selects one. Normally this selection involves randomness: run the same prompt twice and you may get different phrasing. Statistical text watermarking works by replacing that randomness with a deterministic, key-dependent selection. Among tokens that are near-equally probable, the model consistently picks the one that encodes a bit of the watermark signal. Run enough tokens through this process and the pattern becomes detectable by anyone holding the key.

The technique is real cryptography, not security theatre. It has been studied in academic literature and its properties are well understood. As one commenter on Hacker News noted, “the very fact that there is generally no ‘best next token’ with 100% certainty is precisely why the trick works.” The output is provably drawn from the same distribution the model would have sampled anyway — the watermark selects which equally-good token, not a worse one.

The proofreading problem

Here is where the maths and the lived experience diverge. When you ask Claude to proofread or lightly edit your own text, the model does not return your text with red-pen annotations. It regenerates the entire response token by token, making a selection at every position. Even where the “right” token is obviously the same word you already wrote, the model is still choosing it from a probability distribution, and the watermark still biases that choice. The output may read identically to what you wrote, but it now carries a statistical signature.

Anthropic’s own phrasing is careful: a detected mark indicates the content “may have been processed by Claude.” Note the word “processed”, not “generated.” This is honest — it accurately describes what the watermark detects. But downstream systems that check for AI-generated content are unlikely to make the same distinction. A university plagiarism detector, a publisher’s AI-content filter, or a job applicant screening tool that flags watermarked text will read “AI-generated” whether the human wrote 90% of the words or none of them.

What the EU AI Act actually requires

Article 50 of the EU AI Act requires providers of AI systems that generate synthetic audio, image, video or text content to ensure their outputs are “marked in a machine-readable format and detectable as artificially generated or manipulated.” The regulation targets synthetic content — content the AI created — not content a human created and an AI relayed or lightly edited. But the watermarking technique, by its nature, does not make that distinction. Everything Claude outputs gets marked, because everything Claude outputs passes through the same token-selection process.

There is a reasonable argument that Anthropic is over-complying: applying the mark globally and to all processed text, rather than limiting it to text Claude substantively generated. There is also a reasonable argument that over-compliance is the safer legal position, since drawing the line between “Claude wrote this” and “Claude edited this” is exactly the sort of judgement call a regulator might second-guess. Anthropic chose the belt-and-braces approach, and the users who treat Claude as a writing tool rather than a writing replacement bear the cost.

Why this matters more than it looks

Several consequences follow, none of them hypothetical. First, anyone who uses Claude as a writing assistant — to proofread emails, sharpen cover letters, edit blog posts — now has their own writing flagged as AI-processed. In any context where AI-generated content is penalised (academic submissions, journalism, certain job applications), this creates a new risk that did not exist before the watermark.

Second, the watermark is invisible and there is no opt-out. Anthropic’s terms require users not to remove it, but since users cannot see it, they cannot know how much of their text it affects or whether a particular passage still carries the signal after editing. The detection tools are not yet public either — so users are asked to accept a mark they cannot see, on terms they cannot verify, with detection they cannot access.

Third, the watermark persists. Anthropic says it “will travel with the text when it’s copied and pasted elsewhere, and may persist through some editing.” A paragraph you asked Claude to tidy up in January may still carry its mark when a client or employer runs it through a detector in June. For anyone whose relationship with their own data already feels tenuous, this is another piece of control quietly transferred to the provider.

What users can do

The practical advice is unglamorous:

• Ask for advice, not rewrites. If you need text to remain demonstrably yours, do not have Claude return the text directly. Ask it to critique a paragraph, suggest improvements or flag errors — then make the changes yourself. This is the only way to avoid the mark.
• Retype, do not paste. Copy Claude’s suggestions and retype them in your own document. The watermark lives in the token stream Claude generated; retyped text carries no signal.
• Know the limits for code. The watermark applies to generated code tokens too, though highly constrained output (structured data, code with strict syntax) leaves less room for near-equivalent token selection and therefore carries a weaker signal. How much weaker is unknown until Anthropic publishes its detection documentation.
• Watch for the detector. Anthropic says detection tools are coming. When they arrive, test your own edited text against them — that will tell you more about the watermark’s practical reach than any amount of speculation.

What this comes down to is a question about whose words they are. Anthropic’s safety and compliance obligations are real, and the EU AI Act’s transparency goals are defensible. But a watermark that cannot distinguish generation from editing treats every Claude user’s output as AI content by default. For anyone who thought they were using a tool to improve their own writing, the tool is now asserting a claim over it — invisibly, irrevocably, and worldwide.