Anthropic’s watermark survives copy-paste, but not the real dev workflow

Anthropic has introduced invisible watermarks into text created by its latest Claude models, including through its API, coding tools, and cloud partners. However, these marks are insufficient to definitively prove the source of AI-generated content. The company unveiled its plans in a support document, stating that Claude models launched in the EU from August 2, 2026, onwards will contain machine-readable markings.

These watermarks will be applied worldwide across all supported Claude products, such as the Claude API, Claude Code, Claude Cowork, and Claude Tag. Text generated via AWS, Google Cloud, or Microsoft Foundry using a supported model will also carry the watermark when those platforms use a compatible model. Anthropic emphasizes that the watermark, embedded at the model level, travels with the output into applications built on top of Claude, even though certain platforms and features may not support the mark.

This move aligns with the EU AI Act's transparency requirements introduced on August 2, which mandate the detectability of synthetic output in a machine-readable format. While OpenAI, Google, Meta, Microsoft, and Mistral have pledged to the Code of Practice, Anthropic's approach differs. Text is marked discreetly within its words, whereas supported files like SVGs, PNGs, and JPGs receive a digital signature using the C2PA standard.

The metadata attached to these files reveals that Claude processed the asset and whether the metadata has been altered. Anthropic has not disclosed the specifics of how the text watermark functions or whether Claude utilizes the KGW method, a semantic version, or any other technique. The company has also avoided sharing any data on how watermarking impacts latency or inference costs, which is crucial for teams grappling with the hidden expenses of AI-driven workflows.

Alex Cui, CTO and co-founder of AI detection firm GPTZero, explained in a technical explanation on X that watermarking systems typically operate by modifying the probabilities the model uses when choosing the subsequent token. In a simplified KGW system, a hidden key and preceding tokens generate a hash, dividing candidate tokens into two groups, usually termed green and red.

The model then slightly boosts the probability of selecting a token from the green group. A detector equipped with the same key can reconstruct which tokens were favored at each position based on the preceding text. A passage featuring an unusually high number of these favored tokens may contain the watermark. However, more sophisticated approaches can derive the watermark from the meaning of nearby text rather than an exact sequence of tokens, potentially enabling the signal to survive some paraphrasing because replacing a word does not always alter the surrounding context.

Cui noted that Anthropic's watermark must operate token-by-token due to the streaming nature of text delivery to users. Many watermark methods plan sentences or paragraphs at a time or modify the text after its completion to ensure the watermark's resilience against paraphrasers. The company has not confirmed whether Claude employs any of these methods, but the streaming requirement restricts the techniques available.

Coding poses a unique challenge as the model's options are more constrained. Words can often be swapped or sentences rewritten without affecting meaning, but even minor modifications can disrupt functioning code, especially as the AI coding era progresses and more production code passes through model-assisted pipelines. "There are some texts, like code, that cannot be arbitrarily changed; otherwise, the code will break," Cui wrote.

"In those cases, the watermark needs to selectively modify words in parts of the text that can tolerate synonyms," such as variable names. Additionally, code may be difficult to track through a typical development workflow. Anthropic has not published tests demonstrating how effectively its watermark survives such changes, leaving teams uncertain about whether a Claude-generated patch will remain detectable after traversing a pull request.