Every Sentence Claude Writes Now Carries a Signature

On August 11, 2026, Anthropic confirmed it is embedding an imperceptible watermark into text generated by Claude, applied at the model level, worldwide. Every model launched from August 2, 2026 onward carries it. Generated files in supported formats — including common image types — additionally receive signed provenance metadata under the C2PA standard.

Users will not see the mark while reading. It travels with copied text. Anthropic says it may survive some editing without changing the response's meaning, quality, or readability.

The trigger is regulatory: the EU AI Act's Code of Practice on Transparency of AI-Generated Content, whose core obligations began enforcement on August 2, 2026. Anthropic's decision was to apply the marking globally rather than geofence it to European users.

That choice — a Brussels requirement shipped to everyone — is the part worth thinking about.

How text watermarking actually works, and why it's fragile

Image watermarking is comparatively easy. An image is millions of pixels; you can perturb them in ways invisible to a human and robust to compression.

Text has no such redundancy. A paragraph is a few hundred tokens, and every one of them is visible. The standard approach works at sampling time: at each step the model splits its vocabulary into pseudo-random "green" and "red" lists seeded by preceding tokens, then biases selection toward green. Any single choice is unremarkable. Across a long passage, the statistical skew toward green tokens becomes detectable by anyone with the key — while a reader sees only fluent prose.

The consequences of that mechanism are structural, and Anthropic states them plainly. Detection may fail on short passages (not enough tokens for the signal to clear noise), heavy editing or paraphrasing (each rewritten token is a coin flip against the pattern), translation (an entirely new token stream), and metadata stripping or unsupported platforms for the file-based C2PA layer.

And the load-bearing caveat, in Anthropic's own framing: the absence of a mark does not prove content is human-made.

That single sentence defines the tool's real utility. This is not a detector. It is a positive-signal system: a hit tells you something true, a miss tells you nothing.

Which makes it useless for the thing people will want it for

The demand for AI-text detection comes overwhelmingly from adversarial contexts — a professor grading an essay, an editor screening a submission, a hiring manager reading a cover letter, a platform moderating spam.

Every one of those is a setting where the person submitting the text is motivated to remove the mark, and where removal is trivial. Paraphrase it. Run it through a second model. Translate to Spanish and back. Retype the first sentence of each paragraph. The watermark survives some editing; it does not survive someone who knows it's there and doesn't want it there.

Meanwhile the false-negative rate lands on the honest. A student who wrote their essay unaided has no mark, which proves nothing, and now sits in the same evidentiary bucket as a student who laundered a generated draft. Existing AI-detection tools have already caused real damage in exactly this pattern; a watermark that only fires positively doesn't fix the asymmetry, it formalizes it.

Where the system does work is the non-adversarial middle: an organization auditing its own content pipeline, a publisher checking whether a contractor used AI when the contract said not to, a platform separating obvious bulk-generated content from the rest. Those are genuine uses. They are also much smaller than the discourse around "AI detection" implies.

The Brussels effect, executing on schedule

The more consequential story is jurisdictional.

The EU AI Act's transparency obligations apply to providers serving the European market. Anthropic could have implemented marking for EU traffic only. It chose global application — matching what Google, OpenAI, and Meta have each done with various provenance commitments over the past two years.

The reason is operational, not idealistic. Maintaining two model behaviors keyed to user geography means two inference paths, two evaluation suites, two sets of edge cases at the routing layer, and a permanent compliance question about whether a Frankfurt VPN changes what the model does. It is cheaper to build one product that satisfies the strictest regulator.

That is the Brussels effect in its purest form, and it is now the operating reality of frontier AI: the EU sets a rule, the labs implement globally, and users in jurisdictions that debated and declined similar requirements get them anyway. The GDPR cookie banner is the version everyone has seen. This one is invisible by design.

Worth noting what the marking does not do. It does not identify which user generated the text, or when, or under what account — it identifies that a Claude model produced it. That is a meaningfully narrower disclosure than most people assume when they hear "watermark," and it is the right scope. A per-user signal would be a surveillance capability wearing a provenance costume.

What this is actually for

Read the whole design and a coherent purpose emerges, and it is not catching students.

It is building an audit substrate for a world where most text passing through most systems has been touched by a model. Provenance metadata, signed at generation, that mostly survives ordinary handling and can be checked by whoever holds the key. Not proof of human authorship — proof of machine authorship, at scale, for the fraction of content nobody bothered to launder.

The honest framing is that this is infrastructure for institutions, not a shield for individuals. Courts, publishers, regulators, and platforms will get a tool that works often enough to be procedurally useful. Everyone else gets a mark in their text and a caveat that its absence means nothing.

The EU asked for transparency and got a watermark. Whether those are the same thing is the question the next two years will answer.