Anthropic's watermark is not in Claude's words. It is in which word got picked

A watermark you could see would be a watermark you could delete. So Anthropic put one where there is nothing to delete: not in the text, but in the coin toss that produced it.

How it works

At every step a language model has several words that would serve equally well, and it picks among them with a random number. Anthropic's change, described in an explainer published on 14 August 2026, replaces the source of that randomness with one derived from a secret key and the handful of words already written. The words stay the words. What carries the signal is the pattern of which ones won — invisible to a reader, invisible to any test, and legible only to someone holding the key.

The method is a variant of SynthID-Text, published by Google DeepMind in Nature in 2024, and the underlying idea goes back to a proposal by Scott Aaronson in 2022. Anthropic's stated position is that it changes nothing about the content, the creativity or the readability of the output.

Where it applies

Everywhere, and from 2 August 2026. Every model launched on or after that date carries it — Fable 5.1 and Mythos 5.1 to begin with — and earlier models are being brought in over the following months. It covers the API, the Claude apps, Claude Code, Claude Cowork and Claude Tag, and the same models served through AWS, Google Cloud and Microsoft Foundry. There is no setting to turn it off, and it applies worldwide rather than in the jurisdiction that asked for it. Images and vector files — .png, .jpg, .svg — get something different: signed provenance metadata to the C2PA standard, which is a file header and travels only as long as the file does.

The half that is not open

Detection is in private preview. The list of who may apply is regulators, law enforcement, media, fact-checkers, independent researchers, educational organisations, EU civil society groups, and companies with their own compliance obligations. Everyone else is holding marked text and no way to read the mark.

That asymmetry is the design, not an oversight. A public detector is a public oracle: anyone wanting to launder a text could edit, test, edit again, and stop the moment the light goes green. Keeping the key closed makes the mark durable and makes it useless to the general reader at the same time, and there is no version of the scheme that gives you both.

What it does not do

It does not prove authorship. Anthropic's own wording is that a detected mark means the text may have been processed by Claude. The signal is sparse where the model had few equivalent choices to make — dense factual passages, code — and a very short passage carries too little of it to read at all. It survives copy-and-paste and some editing; a translation, a thorough paraphrase or a rewrite takes it away. For files, a screenshot or a format conversion strips the credentials entirely.