A Watermark That Fails in Both Directions

Since 2 August 2026, Anthropic marks the output of every Claude model launched on or after that date. Not a visible badge — an imperceptible signature woven into the text itself, plus signed C2PA metadata on generated files. It survives copy-paste. It applies across the API, the Claude apps, Claude Code, Cowork, and Claude Tag, and follows the models onto AWS, Google Cloud, and Microsoft Foundry. Worldwide, not only in the EU.

The date is not incidental: it is the day the transparency obligations in Article 50 of the EU AI Act became applicable. Anthropic disclosed the method on 14 August — a version of SynthID-Text.

The interesting material is not the announcement. It is their own help documentation, which is unusually honest about what the mark does not mean.

Both error directions, admitted upfront

A detected mark does not mean Claude authored anything. Proofread your own writing through Claude, translate your deck, convert a file format — the output carries the mark. Your ideas, your words, someone else's fingerprint on them.

A missing mark does not mean a human wrote it. Heavy editing strips it. Short passages never carry it at all.

So the signal produces false positives on human work that touched a tool, and false negatives on machine work that got edited. Those are not edge cases. They describe the two most common ways professionals actually use these systems: as an editing pass over their own thinking, and as a first draft they then rewrite.

A test that fails in both directions is not a weak test. It is a test whose output cannot update your belief much in either direction — which is a strange property for something being deployed as an authorship signal.

To be fair to Anthropic, this is roughly what the technology can do. Text watermarking is genuinely hard: the signal has to survive normal editing while staying imperceptible, and those two requirements pull against each other. The honesty in the documentation is real and worth crediting. The problem is what happens after the documentation.

Coarse signal, binary consumption

There is a further wrinkle: as of this writing there is no way for you to check. Anthropic has said a detection API is coming but has not shipped it, and verification requires Anthropic's own key. So the mark exists, the caveats are published, and the tooling that would let anyone reason about a specific piece of text carefully does not exist yet. The C2PA file metadata is the exception — that has mature open tooling and can be verified today.

This ships into a world that is already building the enforcement layer. LinkedIn has been testing a "seems like AI slop" control. Substack has wired detection into its stack.

Nobody downstream reads the caveats.

A platform does not surface "this text carries a provenance mark, which is consistent with several workflows including human authorship with tool assistance." It surfaces a flag, or it silently downranks. The nuance that Anthropic documented carefully does not survive the first integration, because integrations need booleans and the underlying reality is a probability distribution over workflows.

That asymmetry — coarse signal, binary consumption — is where the actual harm lives. Not in the watermark. In the second-order systems built on top of it by people who never read the help page.

We settled authorship a long time ago

Nobody watermarks a Pixar frame.

Nobody stamps the Grammarly pass. Nobody credits the Excel formula or the session musician who played on the track. Every one of those is a tool, or a contributor, participating in the production of a work that a human directed and takes responsibility for.

That is the settlement we reached, across every creative and technical discipline, over about a century: tools participate in authorship, and the human takes the credit and the liability. It is not a loophole. It is the only arrangement that makes sense when the alternative is crediting the instrument.

When I ship a client system, it is the product of an architecture I designed, agents I orchestrated, and hundreds of hours of judgment about what to build and what to throw away. Calling that "AI-generated" is like calling a building CAD-generated. The CAD did not decide where the load goes.

Compliance and good design are not the same thing

I understand Article 50. I understand why Anthropic signed.

The EU AI Act requires machine-readable marking of synthetic content, the deadline is real, and no vendor is going to litigate the philosophy of authorship against a regulator. Shipping a watermark is the rational move. I would have shipped it too.

But complying with a rule and designing a good system are different activities, and it is worth naming when they diverge. This one satisfies the regulation while producing a signal that its own creators say proves nothing. That is compliance working as intended and provenance failing as a concept.

If we are going to mark provenance — and we are, that argument is over — mark it honestly. Who directed the work. Who is accountable for it. Not whose tokens happened to pass through it on the way.

That is a harder system to build. It is also the only version that would tell anyone something true.