Claude Now Watermarks AI Text. What It Doesn't Prove

Claude now watermarks AI text. Anthropic published the details on August 11, and the short version is that supported Claude models weave an imperceptible mark into the text they generate — not a disclaimer, not a footer, something inside the words themselves. I think it is a good change. I also think most of the reaction to it is answering a question nobody in business actually has.

Here is what shipped, what didn’t, and what it means if you have an AI doing work inside your systems rather than writing your LinkedIn posts.

What Anthropic actually shipped

Two different techniques for two different kinds of output, per Anthropic’s own explanation.

For text: “When a supported Claude model generates text, it weaves an imperceptible watermark directly into the text itself. You won’t see it, and it doesn’t change the meaning, quality, or readability of Claude’s response.” For files — SVG, PNG, JPG — Claude attaches signed provenance metadata following the C2PA standard, which is the same open provenance spec the camera and imaging industry has been building on.

The coverage is broad. Anthropic says the marks apply “everywhere you use Claude, including Claude Platform (API), Claude, Claude Code, Claude Cowork, and Claude Tag,” and also when supported models are accessed through AWS, Google Cloud, or Microsoft Foundry. That matters more than it sounds: this is not a consumer-app feature that stops at the chat window. It follows the model into the API, which is where businesses actually consume it.

On durability, Anthropic is careful rather than confident: “Because the watermark is part of the text, it will travel with the text when it’s copied and pasted elsewhere, and may persist through some editing.” May persist through some editing. Note what that sentence declines to promise.

Detection is the part that isn’t here yet

This is the detail most of the coverage skated past, and it changes what the announcement means this week.

There is no public detector. Anthropic says it is “working to enable users and other third parties to detect Claude’s embedded watermarks and provenance metadata,” and that it will “share details on detection mechanisms in forthcoming technical documentation.” Forthcoming. So as of today, the mark exists in the text and essentially nobody outside Anthropic can read it.

That is not a criticism — shipping the mark first and the reader second is a reasonable order, and a detector is a genuinely hard thing to release safely. But it does mean that if a vendor tells you this week that they can now catch Claude-written text, they are ahead of the published facts. A watermark nobody can check is, for the moment, a promise about the future rather than a capability in the present.

Anthropic’s own list of what breaks the mark

Credit where it is due: the company published the failure modes itself instead of waiting for researchers to find them. Marks may not be detectable when content was generated by a model released before marking was supported, when text is “heavily edited, paraphrased, translated, or mixed into other writing,” or when file metadata is “stripped through format conversion, re-saving, screenshots, or other means.”

Read that list as a user rather than a critic. Heavy editing, paraphrase, translation, mixing into other writing — that is not a description of evasion. That is a description of normal work. The person who has Claude draft something and then rewrites half of it is not laundering anything; they are doing the thing everyone does. The same operation that defeats the watermark is the operation that makes the output actually yours.

TechCrunch asked Anthropic the obvious follow-up — how much editing removes it — and reported that it isn’t clear. I’d rather have that answer than a fake one.

Why this landed now

The timing is not a mystery. The EU AI Act’s transparency obligations took effect on August 2, 2026, and they require AI-generated or altered content to carry marks that machines can detect. Anthropic’s own wording tracks that deadline closely: “Claude models launched in the EU on or after August 2, 2026 will support machine-readable marking at launch,” with older models getting support added.

That is worth reading precisely. The rollout commitment is scoped to a regulatory deadline in one jurisdiction; the coverage description is global. Both things are true, and the gap between them is the ordinary shape of compliance-driven engineering.

I wrote about that deadline when it took effect, and argued then that the pattern of the moment is regulators asking for artifacts rather than promises — a machine-readable mark instead of a pledge to be careful. This is the first frontier lab shipping the artifact the regulation asked for. The prediction cashed out faster than I expected.

The objection that isn’t about cheating

Plenty of people are unhappy about this, and the easy move is to dismiss all of it as people annoyed they’ll get caught. TechCrunch’s follow-up the next day found exactly that flavor of complaint on Reddit — and also found that most of the thread was in favor, with one commenter flattening the whole debate into “the only reason you wouldn’t want this is to lie to people.”

That is a satisfying line and I think it’s wrong, because there’s a real objection sitting underneath the noisy one.

It shows up clearest in the proofreading case. Radio host Erick Erickson, quoted by Forbes: “I had ditched Grammarly for Claude for proofreading because it does a better job. But now the stuff I’ve written will be watermarked that Claude did the work. This is ridiculous.” One Reddit user’s version of the same worry, via TechCrunch, was that someone who used Claude to reorganize a paragraph would “come out of the process with a digital tattoo.”

They have a point, and it is a technical one rather than a moral one. A watermark records that a model produced certain tokens. It has no mechanism for recording how much of the thinking was yours. The person who wrote a full draft and had Claude tighten the prose gets marked the same way as the person who typed one sentence and shipped whatever came back. Anthropic’s careful “may persist through some editing” is an honest admission that the boundary between those cases is unresolved — not by oversight, but because the technique has no access to the distinction in the first place.

So the cost is real, and it falls hardest on people using AI as an editor rather than an author — which, for writing, is the use case most worth encouraging.

No opt-out, including for the people paying for it

The other complaint is structural: there isn’t an off switch. Forbes reports the policy is one “users cannot opt out of,” applying to all Claude models and products worldwide, Claude Code and Claude Cowork included. Some developers have objected that signatures attached to generated code will degrade the output.

On the code worry specifically, Anthropic’s own claims answer part of it: the text watermark “doesn’t change the meaning, quality, or readability” of a response, and for files the C2PA layer is signed metadata attached alongside the content rather than a rewrite of it. But notice the position that leaves you in. There is no public detector, so nobody outside Anthropic can independently verify either the mark or the assurance about it. You are asked to accept both on trust, at least until the technical documentation lands.

As for the missing off switch — that is simply what a compliance-driven feature looks like. A mark you can disable only marks the people who didn’t bother, which defeats the purpose the regulation exists to serve. I don’t think Anthropic had a realistic alternative. It is still worth saying plainly that this is a loss of control users didn’t choose, and that it lands on paying API customers and enterprises, not just free chat users. “It was the only sensible design” and “you lost something” are both true.

A watermark answers “what wrote this,” not “what did it do”

Here is where I think the conversation goes wrong.

A watermark is provenance about an artifact. It attaches to a blob of text and says: a model produced this. That is a real and useful fact, and for essays, articles, and disclosures it may be the whole question.

It is not the question when the AI is doing work. If your AI wrote a piece of code and deployed it into the system your business runs on, the watermark on that code tells you a model wrote it. It does not tell you which person asked for it. It does not tell you when, or against which system, or what the system looked like before. It does not tell you what changed, and it does not give you a way back. Every one of those is a different kind of provenance — provenance about an action — and no watermark scheme produces it, because the mark travels with the text and the consequence doesn’t.

The same argument showed up two weeks ago from the protocol end, when I argued that prompts are not permissions. This is the same conclusion reached from the content end: the label on the output is not the control surface. The environment and the record are.

What this changes if your AI works in your CRM

Practically, very little changes this week. If you point an AI at your business systems, its output is now marked, nobody can read the mark yet, and the mark was never going to answer your actual questions anyway.

Your actual questions are the boring ones. Who asked for this change. What did it touch. What did it look like before. Can I put it back. Those are answered by a log and a snapshot, not by a signal embedded in a string — and unlike watermarking, nobody upstream ships them to you as a side effect of a model release. You either run your AI somewhere that keeps that record, or you don’t have it.

That is the whole reason Sentinel exists: your AI gets a dedicated server to work from instead of somebody’s laptop, every action lands in an audit log tied to the key that made it, a snapshot is taken before deploys, and Salesforce changes go sandbox-first with tests. Sentinel is not affiliated with Anthropic and doesn’t need to be — it is bring-your-own-AI over MCP, and the accountability layer is ours, not the model vendor’s. Which, incidentally, is the one lever the opt-out complaints don’t have: you don’t control what the model marks, but you fully control what your own system records.

To be explicit, because the alternative is marketing: Sentinel does not prevent your AI from making a change you will regret. It makes that change visible and the previous state recoverable. That is a trade, and it is the honest one.

Pricing is $2,500 one-time onboarding on your first Sentinel, plus $500/month per Sentinel.

The takeaway

Watermarking is a good thing that solves a real problem for publishers, platforms, and regulators, and Anthropic deserves credit for shipping it with the limitations printed on the box instead of buried. The people objecting are not all cheaters, either — the proofreading case is a genuine cost with no clean answer, and “you can’t turn it off” is a real thing to have lost. Both of those can be true at once. Take the whole package at exactly that value.

Just don’t mistake it for governance of AI work. Knowing a model wrote something is the easiest question in this whole field. Knowing what it did, on whose behalf, and how to undo it is the hard one — and it is the one your business will actually be asked.

If your AI is touching systems that matter, give it somewhere accountable to do it from. Set up your Sentinel — onboarding included.