It's getting harder to prove you're human — and this 'solution' is only making it worse

Anthropic has started marking text generated by its newest Claude models with an invisible watermark that can travel with the text after it leaves the chatbot. Copy a Claude response into a document, paste it into a website, drop it into a codebase, and the mark may still be there. Anthropic says models launched on or after August 2 support machine-readable marking at launch, and the company is applying those markings wherever Claude is offered worldwide, while it is adding support to older models as well.

There is a perfectly defensible reason for doing this. The internet is filling up with synthetic text, images, audio, and video, and some method of establishing where that material came from could be useful. Anthropic also deserves credit for attempting something more sophisticated than the current generation of AI detectors, which mostly look at finished prose and make an educated guess about whether a machine wrote it.

American users who never asked for it are getting it anyway.

Unfortunately, Anthropic's solution comes with a fairly spectacular collection of problems. The watermark does not necessarily prove Claude wrote the material carrying it. Anthropic acknowledges that aggressive rewriting can remove it. And rather than confining the system to the European market that created the requirement in the first place, Anthropic is rolling it out across Claude worldwide, including Claude Code.

That last part is especially strange. Europe demanded a way to identify AI-generated text, and an American developer using Claude to write software in Tennessee now gets his code fingerprinted too.

Brussels writes the rule

This is not a case of Anthropic inventing a bizarre new restriction all by itself. Article 50 of the European Union's AI Act requires providers of generative AI systems, including general-purpose systems, to mark AI-generated text, audio, images, and video in a machine-readable form so that it can be detected as artificial. Those requirements took effect August 2, 2026, while the EU's accompanying voluntary Code of Practice lays out practical steps companies can use to comply.

The underlying concern is reasonable enough. Deepfakes are becoming more convincing, AI-generated propaganda is becoming cheaper, and fraudsters have an increasingly powerful collection of tools for impersonating real people. If someone generates a fake recording of a politician declaring war or a fake video of a CEO announcing a bankruptcy, having some reliable way to determine that the material came from an AI system could be genuinely useful.

RELATED: Now they’re saying the AIs built ‘secret civilizations’ — the truth is far worse

Ole_CNX/Getty Images

But Anthropic is not limiting its response to Europe. According to the company's own documentation, marking applies to output from supported models "wherever Claude is offered, worldwide," including Claude itself, the API, Claude Code, and Claude delivered through AWS, Google Cloud, and Microsoft Foundry.

Political scientists call this the Brussels effect. The EU controls a market too large for multinational companies to ignore, so regulations written in Brussels can wind up shaping products and business practices far outside Europe. Companies often find it easier to build one product that satisfies the strictest major jurisdiction than to maintain entirely separate versions for everyone else. The concept was itself modeled on the older California effect, in which regulations imposed by America's largest state, particularly automobile emissions rules, influenced products and policies far beyond California.

Anthropic’s explanation gives us a remarkably clear example of the Brussels effect at work. The company says it is imposing the watermark globally because it doesn’t yet "have a durable way to scope it by region.” The EU imposed the requirement, Anthropic cannot reliably fence it off to Europe, so everyone gets it.

Anyone who uses the modern web has already experienced one version of the Brussels effect. European privacy rules helped produce the thicket of cookie banners, consent forms, and tracking pop-ups that now greet users on countless websites, including users nowhere near Europe. California has pulled the same trick domestically with privacy and automobile regulation. A government does not necessarily have to persuade the rest of the world to pass the same law if the market is large enough to persuade companies to impose its preferred standard voluntarily.

Maybe that will prove harmless, but the regulatory chain is pretty clear: Europe demanded the feature, Anthropic globalized it, and American users got it too. European regulators demanded a particular feature from an American AI company, and American users who never asked for it are getting it anyway.

What exactly is Claude putting in your text?

Anthropic says Claude’s watermark is based on Google DeepMind’s SynthID-Text, which does not hide metadata or invisible characters inside the output. Instead, the watermark is created during generation by slightly changing the odds that Claude will pick one acceptable token over another.

A language model usually has several plausible choices for the next word. Google gives the example of assigning different probability scores to possible next tokens and then adjusting those scores slightly to create a detectable pattern. Over a long enough passage, those tiny choices add up to a statistical signature that can be recognized later. Google says the process does not measurably affect the quality, accuracy, creativity, or speed of the output.

Anthropic says Claude uses the same basic approach, with an important limitation: The model needs some freedom to choose among acceptable tokens. If only one answer will preserve a fact, satisfy a constraint, or keep a piece of code working, there may be little or nothing for the watermark to manipulate. Anthropic says factual answers and code therefore tend to carry less watermark signal than open-ended prose.

Because the watermark only operates where Claude has room to choose, Anthropic says it should not sacrifice accuracy or produce broken code merely to preserve the mark. The trade-off is that highly constrained output can carry a weaker signal and may be harder to identify later.

Anthropic also says its watermark carries no identifying information and cannot be traced to a particular person, company, or conversation. If Anthropic is to be believed, Claude is not quietly slipping your account ID into every paragraph you generate. However, researchers have already demonstrated multi-bit watermarks that can carry provenance data such as a user ID, timestamp, and model ID. That means a text watermark can do more than answer, “Was this probably generated by AI?” It can potentially carry information about who generated it, when, and with which model.

Once a company starts deliberately shaping generated text so that it can carry a hidden machine-readable signal, users have a legitimate interest in knowing exactly what that signal contains, who can read it, and whether the system could change later.

Claude's fingerprint does not prove Claude wrote it

Anthropic's own explanation puts some hard limits on what the watermark can actually prove.

Anthropic warns that detecting a Claude watermark means only that the material may have been processed by Claude. Claude might have generated the text from scratch, but it also might merely have proofread something written entirely by a human, translated it, summarized it, reformatted it, or otherwise transformed it.

That sounds like a technical distinction until you imagine how the detector will actually be used. A professor finds a Claude watermark in a student's paper. An editor finds one in a freelancer's submission. An employer detects one in a report. A company finds one in source code supplied by a contractor. In each case, the obvious conclusion will be that Claude wrote the work, even though Anthropic itself says that conclusion may be false.

Anthropic then manages to make the opposite case equally murky. Failure to detect a watermark does not mean Claude did not write the material either. The company warns that heavy editing, paraphrasing, translation, mixing Claude-generated material with other text, or simply using too short a passage can make the signal disappear or become unreliable.

The translation example is especially funny. Ask Claude to translate your human-written text, and Anthropic says the result may acquire a Claude mark. Take Claude-generated text and translate or paraphrase it aggressively enough afterward, and the mark may disappear. The same basic transformation can therefore help create the evidence on one side of the process and destroy it on the other.

This doesn’t make the watermark completely worthless. A positive signal may still be useful evidence when interpreted alongside other facts. But Anthropic is building a system that institutions will be sorely tempted to treat as a yes-or-no answer even though the company itself says it is nothing of the sort.

RELATED: Bill Gates is freaking out over AI — so why did he just spend hundreds of millions on this?

KENT NISHIMURA/Getty Images

As I wrote recently for Blaze News about Substack's integration of the Pangram AI detector, even an unusually sophisticated detector can put genuine human writers in the position of having to prove that they wrote their own words. Pangram falsely flagged a passage by Freddie deBoer as completely AI-written, only to classify the same material as human when it was submitted with more surrounding text. Technology journalist Taylor Lorenz was also falsely flagged before Pangram's CEO investigated and acknowledged the mistake.

The problem is broader than Pangram. Vanderbilt University disabled Turnitin's AI detector after calculating that even Turnitin's claimed 1% false-positive rate could translate into hundreds of incorrectly flagged papers at the university's submission volume. Turnitin itself warns that its AI score should not be used as the sole basis for adverse action against a student, because the system can misidentify human and AI-generated writing.

Claude's watermark is technically different and potentially more reliable because the model itself inserts the signal. But the institutional temptation will be exactly the same: Somebody in authority sees a red warning light and treats it as proof, while the caveats buried in Anthropic's documentation disappear from the conversation.

The people trying to cheat can just wash the mark off

There is also a more practical problem: People who actually want to hide their AI use may be able to remove the mark.

Anthropic acknowledges that heavy paraphrasing and other transformations can make the mark disappear, and academic research on text watermarking has repeatedly found the same problem. A 2025 paper describing the Self-Information Rewrite Attack tested an automated rewriting method against seven recent watermarking schemes and reported nearly 100% attack success, without requiring access to the watermark algorithm or the watermarked model.

That does not prove the attack works against Claude. Anthropic has not disclosed enough about its system for anyone outside the company to know how robust it is, and Claude's watermark could turn out to be substantially stronger than the experimental schemes researchers tested.

But Anthropic has already conceded the important point: Sufficiently aggressive rewriting can break detection.

The incentives are therefore almost backward. Someone who uses Claude openly, copies the result into a document, and makes ordinary edits may leave the watermark intact. Someone who actually intends to conceal his use of AI has an obvious extra step available: paste Claude's work into a different model and order it to rewrite everything aggressively while preserving the meaning.

The EU wanted to make AI-generated work easier to identify. What it may have helped create instead is an incentive to launder AI prose through multiple models.

That is not some exotic hypothetical attack involving a team of computer scientists. Anyone serious about concealing AI use is already motivated to rewrite generated text because untouched chatbot prose has recognizable habits of its own. Now Anthropic has given that same user another reason to do it.

Claude is not the only model leaving fingerprints

Anthropic is not the first major AI company to watermark text. Google has been doing it through SynthID in Gemini since 2024. Unlike Anthropic, Google has publicly explained at least the basic mechanism: SynthID changes the probability scores used during token selection, creating a statistical watermark without attaching conventional metadata to the finished text.

OpenAI has taken a different public approach so far. It has embraced provenance and watermarking for generated media and currently uses SynthID for supported images and audio, alongside C2PA metadata for generated images. Its public provenance materials do not describe a comparable watermark being embedded in ordinary ChatGPT text. That may not last. OpenAI says its goal is to expand provenance signals to all modalities, including text, as it works to comply with the EU's Code of Practice.

Claude users are not choosing simply between "watermarked AI" and writing everything themselves. They are choosing among competing models whose providers have made different decisions about whether generated prose and code should carry a persistent vendor signal.

The bigger question is what happens when the rest of the industry complies. If Brussels gets its way, invisible fingerprints in AI-generated prose may soon become the norm rather than an Anthropic oddity.

Claude Code is where this starts looking suicidal

The stakes look different once the watermark reaches software.

Claude Code exists because developers want an AI agent that can write useful code directly into real projects. If Claude generates 200 lines that work correctly, there is no reason a programmer should have to rewrite those 200 lines merely to put his personal stylistic stamp on them. Accepting useful machine-generated code with minimal changes is the product.

And Anthropic says its marking system applies to Claude Code, although code generally carries less watermarking than prose because programming often leaves the model with only one correct choice. The mark is more likely to show up where Claude has some freedom, such as comments or interchangeable names and terms. That makes the commercial risk harder to quantify, but it does not eliminate it.

That potentially leaves Claude's signature in private company repositories, open-source projects, contractor deliverables, student assignments, and commercial software. Some organizations will not care at all. Plenty of software companies openly encourage AI-assisted coding and may regard provenance as useful rather than threatening.

But some companies restrict which AI tools employees may use because of confidentiality concerns. Some clients expect contractors to disclose AI assistance. Some schools ban AI-generated code. Some open-source maintainers are nervous about provenance and licensing. A developer may also simply prefer not to have his source code carry an invisible identifier tied to a particular vendor.

That leaves Anthropic in a strange competitive position. The AI coding market is viciously competitive, and programmers have no shortage of alternatives. If two coding agents perform roughly the same job but only one deliberately leaves a detectable fingerprint inside the output, there will be users who choose the other one for that reason alone.

Anthropic appears to be betting that the benefits of provenance will outweigh that concern. Maybe they will. But fingerprinting Claude Code worldwide to comply with a regulatory regime centered in Europe is an extraordinary way to test the theory.

Could Anthropic use the watermark to claim your code?

One obvious fear is that Anthropic could eventually find its mark in a program and claim ownership of the code. Under the company's current commercial terms, that is not a strong concern.

RELATED: This top school says AI has shredded college — and every university is next

Prostock-Studio/Getty Images

Anthropic says its commercial customers own their outputs, while U.S. copyright law creates another obstacle because purely machine-generated material may lack copyright protection altogether. The U.S. Copyright Office's current position is that copyright still requires sufficient human authorship; prompts alone generally do not provide enough human control over the expressive elements of generated material, although human selection, arrangement, modification, and other creative contributions can be protected.

So the current watermark should not be understood as Anthropic secretly stamping its property claim onto your work.

Traceability is the more plausible concern. There is no evidence that Anthropic is putting account IDs, timestamps, prompts, session identifiers, or other personally identifying information into Claude's watermark today. Anthropic has not claimed to do so, and there is no basis for accusing it of secretly doing it.

But the technology makes a few obvious questions unavoidable. What exactly does Claude's current watermark encode? Is the mark identical for every user? Can it identify a particular model or generation system? Could Anthropic later add a timestamp or account-specific identifier? Would users know if it did?

Those questions are not conspiracy theories. Once a company announces that it is invisibly embedding machine-readable information directly into the prose and code its customers produce, asking what information is being encoded is about as basic as asking what information a website stores in a cookie.

AI provenance may be useful. This is still a mess.

As AI-generated material becomes harder to distinguish from human work, provenance will matter more, not less. A reliable method for establishing that a piece of media came from a particular system could help expose fraud, propaganda, impersonation, and manipulated evidence.

But Claude's watermark illustrates how quickly that seemingly simple goal becomes complicated once it reaches ordinary text. Anthropic is now altering output so that it carries a hidden signal that users cannot see. It is doing so worldwide in response to European regulation. The signal may survive normal editing but can apparently be destroyed by sufficiently aggressive rewriting. Finding it does not prove Claude authored the work, while failing to find it does not prove Claude did not.

Anthropic has explained the basic mechanism and says the watermark contains no identifying information, but outsiders still cannot independently inspect the hidden signal or verify exactly how the system behaves in practice.

The result may punish the least-deceptive users most. Someone who treats Claude as an ordinary work tool, accepts useful output, and moves on may carry Claude's fingerprint into whatever he publishes or ships. Someone determined to pass AI work off as entirely human has a fairly straightforward workaround: He can ask another AI to wash the fingerprints off.