Anthropic confirmed on August 11, 2026 that Claude models launched on or after August 2, 2026 place an invisible watermark into every piece of text they generate, and attach signed C2PA provenance metadata to files like .svg, .png, and .jpg.
The announcement split people almost immediately. Editors, teachers, and hiring managers have spent three years asking for a reliable way to tell AI writing apart, and this looked like the answer they had been waiting for. The angriest response is from the people who have been using Claude to just proofread their work and now Claude will be watermarking it even when it is their original work.
Forbes covered the case of a radio host who had dropped Grammarly for Claude because it proofread better, and who now finds his own writing carrying a mark that says Claude did the work. Either way, the conversation is worth having.
In the three days after the announcement, a lot of that conversation ran on guesswork, because Anthropic had published the policy without the mechanism. Then on August 14 it published the mechanism in full, and a good share of what had already been written about removal turned out to be describing a different technology entirely.
This guide covers what Anthropic confirmed, how the watermarking works at the level of individual words, what a detected mark can honestly prove, and how much editing it takes before the signal goes away.
Anthropic is running two different marking systems at the same time, and most of the coverage so far has treated them as one thing.
The mark that goes into text is built out of the words Claude picks, while the mark that goes onto a file is a signed note sitting in that file’s metadata, and the two of them behave very differently once the content leaves Claude. This is what the company has put on record about both.
The file credential is much easier to lose than the text watermark, because nothing inside the file itself changes when the credential is attached, which means format conversion, re-saving, and screenshots can all remove it without any effort on the user’s part. The text watermark has no equivalent escape hatch, and that is why almost every argument since the announcement has been about text rather than images.
The one thing still missing is the ability to check any of this yourself, because Anthropic has said a watermark detection API is coming but has not shipped it yet, and until it does, the key stays with Anthropic and nobody else can run the test.
Claude produces text by choosing one word at a time, and at every step it is working from a list of candidates that would each make reasonable sense given everything written before that point.
Anthropic explains the idea using the sentence “the weather today was cold and …. ”, where the next word is very unlikely to be “sugary” and quite likely to be either “overcast” or “grey”, and where a reader would neither notice nor care which of those two the model ends up choosing. In an ordinary generation, that kind of low-stakes choice gets settled by a random number.
What watermarking changes is the source of that randomness rather than the quality of the choice.
Anthropic offers a Monopoly analogy for this that is worth borrowing; the instance is:
Two things follow from building the watermark this way, and between them they explain most of the confusion in the coverage that followed. Nothing is added to the text: there are no hidden characters, invisible spaces, or tags, because the watermark is made up of the word choices themselves.
Because the watermark can only act in places where two different words would serve the sentence equally well, it thins out or disappears entirely wherever the output has to be exact. Anthropic uses the sentence “Isaac Newton’s most famous work was called Principia” to make the point, since there is only one correct next word there and therefore nothing for the watermark to work with, and the company says the nudge simply is not applied in cases like that. This single constraint accounts for almost every exception people have been asking about.
All of which gives the radio host story a fairly anticlimactic ending, because the scenario people were angriest about is the exact case where Anthropic says there is the least for the watermark to hold onto. The more Claude writes, the more decisions it makes and the more room the watermark has to work with, so a piece drafted from scratch will carry a much stronger signal than something you wrote yourself and handed over for a light cleanup.
Anthropic answers this question in a single line, saying that light editing probably will not remove the watermark completely, while a complete rewrite in which every word is replaced will surely do. The logic holds up when you follow it through, because the signal lives in the word choices, so replacing enough of those words removes the evidence, and by the time you have replaced all of them, you have effectively written the piece yourself.
The tools currently marketing themselves as Claude watermark removers are doing something unrelated to any of this, and it is worth being specific about the mismatch.
Watermarking is going to be normal within a year, and Anthropic points out that it was never going to stay specific to Claude, since the other major model developers signed the same Code of Practice and will be rolling out marks of their own. The question of which model touched a given draft will get easier to answer every quarter, while the question of who is accountable for what got published does not change at all, and that second question is the one your clients and your regulator will actually ask.
Most teams reading this will not know which AI tools are currently in use across their organization, who is paying for them, or what is being published from them. Revolgy’s AI Adoption Program starts with that audit and produces an assessment of your current setup and data readiness before anyone talks about deployment.