Anthropic published an explanation on 14 August 2026 of how Claude's text watermark works. The notable thing about it is how much of the post is about what the watermark cannot do.

The mechanism

It uses SynthID-Text, the method published by Google DeepMind. Nothing in the output is visibly altered.

When a model generates text there are usually several equally good next words — "overcast" or "grey". SynthID uses a cryptographic key to bias that choice, so the sequence carries a statistical signature.

Anthropic's description:

the words that Claude picks are still random, but now, one can check the sequence of words and see if it's consistent with the choices Claude would make if it was using the key

The key insight is that the watermark lives in the freedom the model has. Where there is no freedom, there is no watermark.

Which is why the limits fall where they do

Every limitation Anthropic lists follows from that one fact:

Short samples do not work. Detection needs enough choices to become statistically distinguishable from chance. Anthropic: detection "doesn't work well on small samples."

Factual sentences barely carry it. Their example: "Isaac Newton's most famous work was called Principia." There is no alternative wording that is equally correct, so there is nothing to bias.

Code carries less than prose, because exact output is usually required.

Edited human text barely carries it — "nearly all the words are the person's."

A full rewrite removes it. Anthropic's own comment on that is fair: at that point "it's arguable whether the text can any longer be described as AI-generated."

Translation preserves it, because every word in the translation is chosen by Claude.

What it explicitly cannot tell you

[The watermark] cannot distinguish "Claude wrote this" from "Claude heavily edited this."

Nor can it confirm that text was human-written, nor detect other AI systems.

That is the sentence that should govern every downstream use. A watermark detector answers one question — does this text carry Claude's signature — and a negative answer means almost nothing. Not watermarked could be: another model, a human, a rewrite, a short passage, a factual passage, code, or a Claude output someone edited.

Where it applies, and when

Watermarking applies to Claude models launched after 2 August 2026, globally at launch. Older models get it "over the coming months", and Anthropic attributes that phasing to EU law transition periods — which tells you the regulatory driver behind this.

Separately, Claude attaches C2PA content credentials to images (.png, .jpg, .svg) in file metadata, using the open industry standard rather than a bespoke scheme.

The detection API does not exist yet. Anthropic says it plans to offer one and is "in the process of working out the details." No accuracy figure and no false-positive rate have been published.

Why this matters for anyone who might have to rely on it

The obvious application is academic integrity and hiring, and that is where the limits bite hardest.

A student who prompts Claude, then rewrites in their own words, defeats it — and arguably should. A student who submits raw output gets caught. So it catches the laziest case and nothing else, which is a real but narrow win.

The dangerous failure mode is the inverse. A missing watermark is not evidence of human authorship. If an institution treats "not detected" as exculpatory, it will clear people who used a different model. If it treats "not detected" as suspicious, it has no basis for that at all.

And the false-positive question is unanswered because the API is not out. Until Anthropic publishes a false-positive rate, nobody should be making a decision about a person on the strength of this.

The honest read

This is a good-faith implementation of a technique with known limits, shipped on a regulatory timetable, documented candidly including the ways to defeat it.

It is not a solution to AI-generated content detection, and Anthropic does not claim it is. It is provenance signalling for unmodified output — useful for platform-scale filtering, useless for adjudicating an individual case.

Two things to watch: whether the detection API ships with a published false-positive rate, and whether other labs adopt SynthID-Text. A watermark only one vendor applies tells you which model was used, not whether a model was used — and the second question is the one everyone actually wants answered.