Anthropic Watermarked Every Word Claude Says. Only Their LLM Can Detect It. Read That Sentence Twice.

Hey guys, Mr. Technology here.

On August 11, 2026, Anthropic quietly published a support article titled "How Claude marks AI-generated content." They signed the EU AI Act's Article 50(2) Code of Practice on Transparency, which sounds like a civic duty, and announced two complementary techniques for tagging Claude's output: (1) an invisible watermark woven into the text itself, and (2) C2PA-signed provenance metadata on generated files. They then said — with a straight face — that detection mechanisms for the text watermark would be detailed in "forthcoming technical documentation." In other words: we put an invisible mark on every word our model produces, and only we know how to read it. Read that sentence twice. I want you to feel what just happened.

This is not a transparency play. This is the architecture of a chokepoint, dressed up in the language of compliance.

The Trick Anthropic Just Pulled

Here is the sequence, in plain English. Anthropic trained a model. The model generates text. Before the text leaves Anthropic's API, an invisible watermark gets woven into the token distribution. You cannot see it. You cannot paraphrase it away. It survives copy and paste. It survives "some editing," whatever that means in the technical doc they have not published yet. The watermark is invisible, and only Anthropic's planned detector — built on the same closed stack — can verify it.

They did not ask. They did not make the detector open-source. They did not publish the algorithm. They did not commit to a public spec that an independent researcher can verify. They said the article would be updated "as more detailed technical guidance becomes available." That is the language of a company that has decided to be the only trusted oracle in a category it just invented. They signed a Code of Practice about transparency, then implemented a system whose transparency depends on Anthropic being willing to tell you the truth about it.

If you want the textbook definition of an authority with no accountability mechanism, you just read it.

Why "Only Our LLM Can Detect It" Is The Sentence That Matters

The phrase in Anthropic's article that should make every platform team, every regulator, every school IT admin, and every newsroom editor stop and breathe for a second is this one: detection will require a tool built by the same company that did the watermarking. Anthropic does not say "an open classifier" or "a community-maintained library" or "any sufficiently capable LLM can verify the signature." They say "we'll share details on detection mechanisms in forthcoming technical documentation." That is a gate, not a gift.

There are three things that follow from that posture, and none of them are good.

1. The trust triangle is broken on day one. A watermark is a claim. The claim is: "this text came from Claude." A detector is the verification of that claim. When the maker of the claim is the only entity that can verify it, you do not have a transparency system. You have a confession booth run by the same institution that committed the original sin. A user who wants to know whether a piece of text is watermarked cannot do so themselves. They must ask Anthropic. Anthropic gets to decide whether to answer, what to answer, when to answer, and whether to log the query. That is not transparency. That is telemetry infrastructure with a marketing layer on top.

2. False positives become a censorship vector. A closed-source detector with proprietary thresholds is, by construction, a black box. If the detector says a piece of human-written text is "possibly Claude-generated," there is no way for the accused author to appeal the verdict. They cannot run the detector themselves. They cannot inspect the watermark bits. They cannot demonstrate the bits are absent. The only response is to trust Anthropic's word. If a journalist, a student, a job applicant, or a small-business owner gets flagged by Anthropic's detector, their recourse is to send a polite email to support. Good luck.

3. It is an admission that the watermark is fragile. The reason Anthropic needs a sophisticated detector is that the watermark has to be invisible to humans. If a human could see it, the user could strip it. If the watermark were robust enough that simple statistical tests could verify it, Anthropic could publish the spec and let anyone verify it. The fact that detection requires another trained model is the tell. The watermark is statistical noise at the token level. Strip it with any other LLM and the bits wash out. Re-tokenize the output through a different sampler and the watermark disappears. Run the Claude output through GPT-5.6 for a paraphrase pass and the watermark is gone in one round trip. Anthropic knows this. They are building the detector anyway because the alternative — admitting the watermark is strippable by the first sufficiently capable LLM that touches the text — is worse for the marketing story.

The Compliance Theater

Here is the part that should make regulators' ears ring. Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content as a "provider of both generative AI models and generative AI systems." The Code is supposed to be about letting end users know when they are looking at machine-generated material. That is a defensible goal. The implementation Anthropic picked is the opposite of defensible.

A real transparency system has four properties. It is observable — a third party can verify the mark. It is contestable — if the mark is wrong, the affected party can challenge it. It is portable — the mark travels with the content across systems. It is independent — no single vendor is both the maker and the judge. C2PA's signed metadata for files gets three out of four. The first three are observable, contestable, and portable through standard tooling. It is independent only as long as the signing infrastructure stays open. Anthropic's text watermark gets zero out of four. The mark is invisible, so it is not observable by users. There is no appeal process, so it is not contestable. The detection requires Anthropic's tools, so it is not portable. And Anthropic controls both the embedder and the detector, so it is not independent.

What they shipped is the worst version of the technology that exists, and they wrapped it in compliance language. They get to say "we signed the Code" while building the architecture that makes the Code meaningless. This is the pattern you should expect when a frontier lab is both the regulator's preferred vendor and the architect of the regulation's technical implementation. The Code is captured. The implementation is closed. The detector is proprietary. The user is on the outside.

A Smart Adversary Beats A Dumb Watermark Every Time

Watermarking in natural language has been broken in research papers for years, and every competent team shipping in this space knows it. A few ways the mark dies, in increasing order of effort:

• Paraphrase pass. Run the text through any other capable LLM with a "rewrite this in your own words" prompt. Watermark bits are statistical perturbations of token probabilities. They are designed to survive simple token-level edits. They are not designed to survive a full re-generation.
• Translation round-trip. Translate English to Spanish and back. The watermark is tied to the original token distribution in the original sampling regime. The translated text does not carry it.
• Different sampler. Strip the watermark by sampling from a different temperature, top-p, or nucleus. If you take Claude's output and re-roll it at temperature 0, you are not generating new content, but you are regenerating the watermark distribution. Most production systems that consume Claude output already do this for downstream tooling.
• Manual rewrite. A 200-word human-edit pass removes a large fraction of the detectable signal. The Anthropic article admits the watermark "may persist through some editing." Some. Not all.
• Detect-and-rewrite with a frontier model. This is the one Anthropic fears. A 70B open-weights model with a tiny classifier head trained on watermarked vs. non-watermarked outputs can locate and rewrite the embedded patterns in one pass. Anthropic knows this is coming. They are pre-emptively saying "only our LLM can verify ours" because that statement is true for now and they want to write the policy in the brief window where the technical advantage exists.

The technical literature has called this "cat and mouse" for thirty years across DRM, audio fingerprinting, image steganography, and now text watermarking. The mouse wins because the defender has to be perfect and the attacker only has to be good enough. Anthropic shipping an invisible watermark and a closed detector is not the move of a team that has solved that problem. It is the move of a team that is trying to write policy in the narrow window before the cat is openly beaten.

What A Real System Would Look Like

If Anthropic wanted transparency, here is what they would have shipped:

1. An open watermark spec. Publish the algorithm. Let academic groups verify robustness. Let adversarial teams try to strip it. Have the uncomfortable conversation about what survives and what does not. 2. A public detector with documented thresholds and false-positive rates. No "forthcoming documentation." Concrete numbers. A leaderboard where the lab gets marked down when their detector fails. 3. C2PA-style Content Credentials at the model level. Every API call returns a signed receipt. The receipt is portable. Anyone with a C2PA verifier can confirm the content came from Claude. The receipt is metadata, not embedded noise. It does not degrade output quality. It does not require a frontier model to detect. 4. A non-detection-based attribution channel for strippers. When a downstream user knows their input is Claude-generated, they can attach the receipt themselves. The receipt travels through paraphrase, translation, and editing. The mark is not in the text, so there is nothing to strip. 5. An external auditor with read access to the detector logs. Every query, every result, every false positive. Publicly reported. So that the detector cannot be used as a quiet suppression tool without someone noticing.

Anthropic did none of these. They shipped the closed version on purpose, because the closed version is the version that makes Anthropic a piece of critical infrastructure that no platform can route around.

The Bottom Line

The sentence you want to write down and keep is this one: a watermark only the maker can detect is not a transparency feature. It is a takedown queue waiting to be activated. Every platform that integrates Claude output is one API call away from being inside Anthropic's attribution oracle. Every user whose content gets flagged by that oracle is one support ticket away from finding out whether Anthropic's word outweighs theirs.

You should not be relieved that Anthropic "signed the Code." You should be asking why a frontier lab is shipping an invisible mark on every word its model produces, with detection gated behind its own closed tooling, and calling the result transparency. The pattern is familiar. The same companies that gave you closed weights, closed evals, closed red-team reports, and closed fine-tuning data now want to give you closed provenance. The throughline is the same. The most powerful actors in this space keep building infrastructure that no one else can audit, and they keep finding new policy vocabulary to describe it as accountability.

You are not the mark because you fell for it. You are the mark because they have decided you do not get to verify. Push back. Demand open watermark specs. Demand public detection thresholds. Demand a C2PA-style signed-receipt path that does not require an Anthropic-controlled oracle. And when the next lab announces its "transparency initiative," read the fine print. The fine print is where the chokepoint lives.

Mr. Technology is the operator of mr.technology, an independent engineering publication covering AI infrastructure, agent security, and the AI tooling stack. If your platform is shipping Claude output and you want an attribution architecture that does not depend on a single vendor's oracle, the audit pipeline at mr.technology is built for that conversation.