Since 2026-08-14, supported Claude outputs carry an invisible watermark. The mechanism is elegant. It also survives exactly until the text meets a second model.
The Notice
It arrived in my terminal, appended to the output of a routine command in a Claude Code session: under the EU Code of Practice on Transparency of AI-Generated Content, Claude models released after 2026-08-02 add an imperceptible watermark to text outputs. No effect on quality, it says. A detection API in private preview, it says - for organizations that qualify.
Article 50 of the EU AI Act requires providers to mark synthetic content in machine-readable form, with fines up to €15 million or 3% of global turnover. Anthropic signed that Code in July 2026 and switched the mark on worldwide - by its own account because it has no durable way to scope it by region. Models released before 2026-08-02 are in a transition period, with coverage required by 2026-12-02.
How It Works
A language model writes one token at a time, and at many of those steps several candidates are nearly equally good - quick or fast, shows or demonstrates. Normally the sampler settles those ties with random numbers.
The watermark replaces the randomness. Anthropic describes its mark as a version of SynthID-Text, the approach Google DeepMind published in Nature in 2024: the tie is settled by a key and the few words that came before. Each choice still looks random. Across a few hundred words, the choices line up with the key in a way a detector can score - and detection requires that key, which Anthropic holds. Nothing is added to the text - no hidden characters, no extra tokens. I took the paper itself apart separately.
One property falls straight out of that mechanism, and it is the one that matters.
The watermark lives in the word choices, so it lasts only as long as the word choices do.
One Rewrite
Take the finished text from the strongest closed model. Hand it to a second model with one instruction: rewrite this.
Every word is picked again - by a sampler that holds no key. The original watermark signal collapses. Anthropic’s own announcement says it in one sentence: light editing probably won’t remove the watermark completely, a complete rewrite where every word is replaced will. Its documentation lists heavily edited, paraphrased, translated among the reasons a mark goes missing. The quality stays, because the second model is nearly as good as the first.
This takes one API call and no expertise. Open-weight models are not the loophole, only its cleanest example: the watermark lives in the sampler, not in the weights, and nobody can centrally force someone else’s sampling loop to preserve another provider’s mark. The second model does not need to know how to remove the mark. It only needs not to preserve it. Anyone already running agents adds it to the pipeline once and never thinks about it again.
The real problem sits one level down. Provenance is being encoded in statistical token choices, and natural-language text is inherently transformable: the meaning survives a full rewording, the statistics do not.
I have not run this against Anthropic’s detector - it is in private preview, and I do not qualify. But the failure mode follows directly from the mechanism Anthropic describes.
It is not even a new craft. SEO content farms were doing it in 2010 and called it article spinning. The oldest trick in content farming is now a state-of-the-art watermark remover.
Who Still Carries the Mark
Everyone with a reason to hide machine text takes the one step. So look at who is left.
Anthropic’s own documentation says a detected mark tells you the content may have been processed by Claude - it does not, on its own, confirm provenance, and Claude may not be the original author. Wrote it, translated it, proofread it down to a comma splice - the mark cannot tell the difference. A human essay that Claude proofread can carry the mark of the machine. An absent mark proves even less: an older model, an unsupported platform, a short passage, heavy editing, one rewrite.
And the key lives with Anthropic. Detection is in private preview, for eligible organizations - regulators, law enforcement, media, educators. The professor or the editor who gets in receives a score from someone else’s detector, and has to remember all of these caveats on their own.
The law asked for a mark on synthetic content. It got one - on the people who were never going to lie about it.