Claude Now Marks AI-Generated Text, Code and Files

Anthropic has started changing a basic assumption about AI-generated text: that once you copy it out of the chat window, its origin disappears.

Supported Claude models will embed an imperceptible, machine-readable watermark into generated text. Anthropic says the mark can travel with copied text and may survive some editing. Supported generated files can carry signed provenance metadata using C2PA instead.[1]

That sounds like a clean answer to a messy problem. It is not.

A detected watermark can show that supported Claude systems processed the text. It cannot, by itself, tell you who had the original idea, who wrote the first draft, whether Claude only corrected grammar, or whether a human reviewed every line. A missing watermark does not prove human authorship either.

That distinction matters for writers, developers and teams building AI agents. Provenance is useful evidence. It is not an authorship verdict.

What Anthropic is introducing

Anthropic describes two related marking systems.

For text, a supported Claude model embeds a machine-readable watermark directly into its output. The mark is designed to be invisible to readers and not change the meaning, quality or readability of the response. Because it is part of the text, it can move with copied and pasted content.[1]

For supported files, Anthropic uses digitally signed provenance metadata based on C2PA. C2PA provides a framework for attaching claims about an asset’s origin and editing history to a signed manifest. That is different from an invisible text watermark. It is metadata attached to a file, with cryptographic machinery that lets a verifier check whether the manifest is valid.[1][3]

Anthropic says the text marking applies at the model level across supported Claude surfaces. Its help material names Claude, Claude Code, Claude Cowork, Claude Platform and supported deployments through cloud providers. Models launched in the EU on or after 2 August 2026 are expected to support machine-readable marking at launch, with Anthropic working to extend support to earlier models.[1]

The timing is tied to the EU AI Act’s transparency rules. The European Commission’s Code of Practice is intended to help providers comply with obligations around marking and labelling AI-generated content.[2]

This is not a small interface badge. It is infrastructure inside the output path.

The watermark is a provenance signal, not an AI detector

Most AI-writing detectors work backwards. They examine finished text and estimate whether its statistical patterns resemble machine-generated writing. That approach has produced false positives and a lot of misplaced confidence.

Anthropic’s system takes a different route. The model places a signal into its own output, and a compatible detector looks for that signal later. Instead of guessing from style, the verifier checks for a mark deliberately added by the provider.

That is a better defined claim, but still a narrow one.

If the mark is detected, the safe conclusion is that a supported Claude model processed the marked text. Anthropic explicitly warns that the person may have written the material and used Claude only to proofread, translate, summarise or reformat it.[1]

The reverse is also true. If a detector finds no mark, that does not prove the text was written without AI. The output may have come from an older or unsupported model. It may be too short. Heavy editing, paraphrasing, translation or mixing with other text may weaken or remove the signal. Other models will not necessarily use Anthropic’s system.[1]

So the result should not be reduced to two buttons labelled HUMAN and AI.

A better evidence model is:

Detector result	What it can support	What it cannot prove
Claude mark detected	A supported Claude system processed the marked text	Claude originated the ideas or wrote the first draft
No Claude mark detected	No supported Claude mark was found	The text is human-written or AI-free
Valid C2PA credentials	The signed provenance claims validate for that file	Every statement inside the file is true
Missing file credentials	No usable signed manifest is present	The file never passed through an AI system

This is evidence about process, not truth or ownership.

What this means for Claude Code

The coding angle is where the policy becomes operational.

If watermarking applies to supported Claude Code output at the model layer, generated code and surrounding text may carry the signal when copied into source files, documentation, tests, issue comments or pull-request descriptions.[1]

But code is hostile terrain for text watermarking.

Developers rename variables, run formatters, remove comments, extract small functions, combine suggestions from several tools and rewrite sections during review. Build tools also normalise whitespace and line endings. Anthropic has not publicly described the technical embedding method in enough detail to calculate how well the mark survives those transformations.

That missing detail should stay visible. We should not claim the system uses hidden Unicode characters, altered whitespace, token probabilities or any specific encoding until Anthropic publishes the mechanism. “Invisible” does not automatically mean zero-width characters.

For engineering teams, the practical response is not to hunt for secret symbols in every commit. It is to improve the evidence already under their control:

Record which model and tool were used for a task.
Keep the human reviewer and approval decision attached to the change.
Store test results and security checks with the pull request.
Distinguish generated code from accepted code. Generation is an event. Acceptance is a human or governed system decision.
Treat watermark detection as one signal in an audit trail, not the audit trail itself.

A watermark may help answer, “Did supported Claude processing touch this text?” It does not answer, “Is this code correct, safe, licensed appropriately and approved for production?”

The harness-era threat model

The risk becomes more serious when Claude is not answering one prompt in a chat window but operating inside an agent harness.

A harness can ask the model to inspect a repository, edit several files, run commands, generate tests and prepare a pull request. One model may produce the plan, implementation, documentation and review summary. If the same system generates the work and judges its own work, the audit trail can look complete while sharing one failure mode.

Watermarking does not create that risk, but it makes model involvement easier to trace. The operational response should be independent verification.

For consequential development work, I would route the final review through another model or a deterministic verifier before continuing with Claude-generated changes. That does not mean a second model is automatically correct. It means the reviewer should not inherit exactly the same context, assumptions and incentives as the generator.

Useful scenarios include:

personal projects that handle credentials, payments or private data;
autonomous refactors that touch many files;
generated migrations, infrastructure changes or deployment scripts;
client work where provenance and disclosure matter;
articles, reports or documentation that require a clear account of AI assistance.

The second pass should inspect the diff, tests, source evidence and task contract independently. High-risk changes still need deterministic tests and human approval. Model diversity is a control layer, not a substitute for engineering evidence.

The hard policy problem is attribution

Schools, publishers and employers may be tempted to use watermark detection as an enforcement shortcut. That would repeat the biggest mistake made with probabilistic AI detectors: turning limited evidence into a disciplinary verdict.

Consider three cases.

A writer drafts an article and asks Claude to fix spelling. A detector later finds the mark.

A developer asks Claude for a function, rewrites most of it, tests it and takes responsibility for the final change. The mark survives in part of the file.

A student generates an essay with an unsupported model, paraphrases it and submits it without a detectable Claude mark.

The first two could produce a positive signal despite substantial human authorship. The third could produce no Claude signal despite extensive AI generation.

Policies need to define what they regulate: model involvement, undisclosed assistance, delegation of authorship, or prohibited use. Those are different rules. A provenance tool cannot choose the policy for you.

Why this still matters

The limitations do not make watermarking pointless.

Machine-readable provenance gives platforms and investigators something more concrete than stylistic suspicion. It can support disclosure workflows, content labelling and forensic analysis. Signed file credentials can also help preserve a verifiable chain of claims about an asset’s origin and edits when the metadata survives.[3]

The bigger shift is architectural. AI systems are beginning to emit not only content, but evidence about how that content was produced.

For agent builders, that should feel familiar. The output is not enough. We also need receipts: the model used, tools called, sources retrieved, approvals granted, tests run and final state verified.

Claude’s watermark can become one receipt in that chain. It should not become the judge.

My take

I support provider-level provenance, especially when it is open to third-party verification and described with honest limits. It is more useful than pretending an external classifier can reliably read authorship from prose style.

But the phrase “AI-generated” will cause trouble if organisations treat it as a complete account of how work was made. A model can generate, edit, translate, reformat or merely touch a piece of text. Those actions should not all collapse into the same accusation.

The standard we need is not “find the hidden mark and punish someone.” It is “preserve enough evidence to understand the workflow.”

That is the useful version of provenance. It tells us where to investigate without pretending the investigation is already over.

Sources

[1] Anthropic, “How Claude marks AI-generated content” - https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content

[2] European Commission, “Code of Practice on Transparency of AI-generated Content” - https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content

[3] Coalition for Content Provenance and Authenticity, “C2PA Technical Specification 2.2” - https://c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html

[4] TechStartups, contemporary reporting that reproduces and contextualises Anthropic’s announcement - https://techstartups.com/2026/08/10/anthropic-is-adding-invisible-watermarks-to-claudes-ai-generated-text-that-can-be-detected-even-after-you-copy-and-paste-it/