Claude now watermarks everything it writes. The cheats will be fine.

On 11 August, Anthropic confirmed that Claude now weaves an imperceptible watermark into the text it generates. Not a footer. Not a disclaimer. A statistical signal buried in the word choices themselves, applied at model level so it travels with the text wherever the text goes.

The internet took roughly four hours to split into two camps and start shouting. Good. This one deserves the argument, because both camps are partly right and the thing they are arguing about does not do what either of them thinks it does.

What Anthropic actually shipped

Two mechanisms. Files get C2PA signed provenance metadata, the same open standard the camera and photo industry has been rolling out for years. Text gets the invisible one.

Coverage is broad. The mark applies across Claude Platform (API), Claude, Claude Code, Claude Cowork and Claude Tag, plus output served through AWS, Google Cloud and Microsoft Foundry. Models launched on or after 2 August 2026 carry it from day one. Older models are being retrofitted, against the EU's 2 December 2026 grace-period deadline for systems already on the market.

The driver is regulatory. The EU AI Act's Article 50 transparency obligations bit on 2 August 2026, and they require providers to mark machine-generated content in a detectable way. Anthropic chose to apply it globally rather than geofencing it to the EU, which is either principled or simply cheaper than maintaining two model behaviours. Probably both.

The technical guess, from GPTZero CTO Alex Cui speaking to The New Stack, is that it works like the KGW scheme: a secret key nudges the model towards a pseudo-random "green list" of tokens at each step, and a detector holding the same key looks for an improbable concentration of them. Nobody notices, because at any single word the nudge is tiny. Across four hundred words it becomes a statistical fingerprint.

Anthropic's own documentation is admirably honest about the limits. Detected marks are not conclusive evidence that Claude produced the content. Absence of a mark does not mean no AI was involved. Short passages may not carry enough signal. For text, heavy editing, paraphrasing, translation or mixing into other writing may all break it. For files, so may format conversion, re-saving or a screenshot.

Read that list again, because the whole argument lives in it.

The case for it, made properly

The strongest case is not about catching students. It is about the information commons.

We are heading into a web where the majority of new text has passed through a model. That breaks things quietly. Training data gets contaminated with model output and the next generation of models learns from its own exhaust. Search results become unmoored from anyone who actually knows anything. Provenance, even weak provenance, is a defence against that.

For academia specifically, the current situation is worse than most people outside it realise. Universities are running disciplinary processes on the output of commercial detectors that produce confidence scores from vibes. A model-level watermark from the provider is a genuinely better class of evidence than a third-party classifier guessing at burstiness. It is a signal the vendor put there on purpose, rather than an inference drawn from writing style.

And publishers, journals and grant bodies now have something they can build a policy around that does not depend on buying a detection subscription. That matters. Anthropic is also, unlike its competitors, actually doing it: OpenAI has had working text watermarking for years and has declined to ship it, reportedly worried about false positives and about losing users to whoever does not.

A watermark is a provenance signal, not a truth signal. Almost everyone who uses it will treat it as the second thing.

It catches the wrong people

Here is the problem. The watermark marks processing, not authorship. If Claude touched the text, the text is marked. It cannot tell the difference between "write me an essay on the Corn Laws" and "check this for typos".

The radio host Erick Erickson put the complaint plainly: "I had ditched Grammarly for Claude for proofreading because it does a better job. But now the stuff I've written will be watermarked that Claude did the work. This is ridiculous."

He is right about the mechanism and, I think, right to be annoyed. Millions of people use these tools the way you would use a good sub-editor. Their words, their argument, their evidence, tightened by a machine. The mark does not distinguish that from wholesale generation, and no institution reading the output at scale will make the distinction either.

Now stack the second-order effects. Non-native English speakers already get hammered by AI detection: a Stanford study found seven detectors wrongly flagged 61.22% of TOEFL essays by non-native writers as AI-generated, with 97.80% caught by at least one. Those same students are the ones most likely to run their writing through Claude for grammar. They will now carry an actual, verifiable mark rather than a false accusation, which is somehow worse.

Meanwhile the student who genuinely cheated pastes the essay into a paraphraser, or asks a different model to rewrite it, and walks away clean.

Yes, the removal tools are coming

You asked whether stripping the watermark would be easy. The academic answer arrived two years before the product did.

"Watermarks in the Sand", published at ICML 2024 by Zhang, Edelman, Francati, Venturi, Ateniese and Barak, proves that strong watermarking is impossible under natural assumptions, even when the detector's key stays secret. The attack is a random walk: repeatedly perturb the text while a quality check keeps it good, and the watermark washes out while the meaning survives. They broke three published schemes with only minor quality degradation.

Cui's practical version is blunter. "In my testing, the watermarks don't survive intense paraphrasing, especially if you combine word choice and syntax attacks." He notes that free paraphrasing tools already defeat Google's SynthID.

So no, a de-watermarking industry does not need to be invented. It exists, it is called a paraphraser, and half of it is free. What will change is the marketing. Expect a wave of tools rebranded from "improve your writing" to something more pointed, and expect at least one of them to be a thin wrapper around a second model with a monthly subscription attached.

There is a nastier wrinkle, and Cui put it best: "If Anthropic releases the watermark detector publicly, I think they defeat their own watermark." Ship one and you hand attackers an oracle to rewrite against until the score drops. Withhold it and the mark is unusable by the universities it is supposed to help. That is not a trade-off with a clever answer. It is a fork, and both prongs are bad.

The bit nobody is arguing about

The comment threads are all about removal. The genuinely alarming research points the other way.

"Watermark Stealing in Large Language Models", also ICML 2024, showed that by querying a watermarked API you can reverse-engineer enough of the scheme to both scrub marks and forge them. Average success rate above 80%, for under $50 of compute.

Forge. As in, take something a human wrote and stamp it as machine-generated.

Every incentive that exists to remove a watermark exists in mirror image to plant one. A dissertation rival. A journalist someone wants discredited. A contested authorship claim. The removal debate is about people avoiding consequences; the spoofing risk is about people receiving consequences they did not earn, and it is the one institutions are least prepared for.

The presence of a mark will be treated as proof. That is the failure, and it happens in a disciplinary hearing, not in a lab.

So what am I, then?

Two positions from the threads, both from real people, neither of them stupid.

I have a stake in this, so here is the disclosure. This issue was written with Claude. Not "lightly assisted by". Written with. The embedded mark now says exactly that, and it says nothing else.

Here is what the mark cannot see.

That the house style this is set in, the palette, the type, the shape of every section, took months to settle and is now specified rather than improvised. That there is a standing rules file governing my language, down to a ban on the em dash, because I got tired of taking them out by hand. That the build instructions for an AI Sustained editorial run past a thousand lines across their specification and reference files, and have been rewritten more often than the articles they produce. That the angle, the pitch and the decision about who this piece is for were argued out before a word was drafted, and the readership positioning was the hardest call in it. That every figure was checked, and that I check with rival frontier models rather than the one that produced the draft, because asking a model to mark its own homework is not a control.

Hours per issue. Most of them not spent typing.

I cannot claim to be a traditional writer and I am not going to try. The sentences were assembled by a machine. Pretending otherwise is the exact dishonesty that makes readers distrust everybody, including the people being straight with them.

But curator and editor are not consolation prizes. An editor who never writes a line still owns the publication. A director does not operate the camera. A conductor plays nothing. We have had perfectly good language for this shape of authorship for two centuries, and nobody called it a lesser claim until the tool got good enough to threaten the people holding it.

So does it soften the value? I do not think it softens it. I think it qualifies it differently, and the honest move is to say which kind of work you did rather than let the reader assume the other kind.

Which is where this loops back. Everything in that list is invisible to the watermark. The mark records that a model emitted the tokens. It cannot see the specification, the guardrails, the scene setting, the binned drafts, the fact-check, or the argument about readership. It measures the cheapest input in the process and reports it as the whole thing.

That is not Anthropic's failure. No statistical signal in a token stream could carry any of it. But it is why "AI-generated" is about to stop meaning anything useful, covering a one-line prompt and a month of scaffolding with the same flag, and why any policy built on that flag is measuring the wrong quantity.

Where I land

I am in favour of the watermark and against almost everything that will be done with it.

Marking machine output is the correct default. Anthropic shipping it while OpenAI sits on working technology for competitive reasons is, whatever The Register says about compliance theatre, the more defensible position of the two. Weak provenance beats none.

But the gap between what the mark establishes and what people will claim it establishes is enormous, and nobody is closing it. Anthropic documents the caveats carefully in a help article that no head of department will ever read. The mark says the text passed through Claude. It does not say who thought of it, how much survived, or whether the human did the work. Presence is weak evidence. Absence is almost none.

My prediction, and you are welcome to hold me to it: within twelve months someone loses a job or a qualification over a watermark hit on text they substantially shaped themselves. It will be appealed. The appeal will hinge on the sentence in Anthropic's own documentation saying the mark is not conclusive, and everyone will act surprised.

Right, your turn. Pick one of those two camps, or tell me they are both wrong and the question is badly framed, which I suspect is the actual answer. If you use these tools the way I do, I would rather hear what you call yourself than what you call the tool. The comments are open and I read all of them.