Claude Now Watermarks Every Word It Writes: What It Means, How It Works, and What To Do About It

If you have written anything with Claude in the past few weeks, a CV, a work email, a caption, a cover letter, it now carries something you cannot see. Anthropic, the company behind Claude, has started hiding a signature inside the text its models produce. It survives copy and paste. It travels into a Word document, an email, a LinkedIn post. There is no setting to switch it off.

The internet, predictably, lost its mind. The ground was ready: Merriam-Webster had already made “slop” its word of the year for 2025. Within days there were posts calling it surveillance, a copyright grab and an SEO apocalypse. Within a week there were people selling tools to scrub it out.

Almost all of that is wrong, and the small part that is right is not the part being shouted about.

We have a direct stake in this. Man of Many is a publisher that uses AI in parts of its business. So rather than write a neutral explainer and pretend we are bystanders, this piece does four things: explains what the watermark is, shows exactly how it works, tells you what to do about it, and sets out our own rules, including one that I personally broke a few days ago.

Man of Many is a Supporter of humAIn 2026, Australia’s AI conference for media, marketing and creativity, on 13 and 14 October in Sydney. It is two days on the exact question this piece keeps circling: what remains irreducibly human in the AI era. Our readers get 20% off with the code MOM. Book before 5:30pm on Tuesday 1 September for the biggest saving. We receive logo placement, event acknowledgement and a delegate pass in exchange for promotion, and no money changes hands in either direction.

The Short Answer

If you read nothing else:

• It is real. Anthropic published the technical explanation on 14 August 2026.
• It is not a hidden character. There is nothing in the file to find, delete or search for.
• It cannot prove you did not write something. At best it says Claude was “likely involved”.
• Nobody can read it yet. There is no public detector. Anthropic says a detection API is coming.
• Your images are the live exposure, not your text. Those carry readable metadata today.
• Removal tools are a bad deal. The methods that reliably strip the mark work by making your writing worse.

Now, the detail.

What an AI Text Watermark Actually Is

Start with what it is not. It is not a hidden character. It is not a tag buried in the file. It is not white text, a zero-width space or a Unicode trick. You cannot find it with a search and replace, because there is nothing sitting there to find.

Here is the real mechanism, and it’s stranger than the conspiracy version.

An AI model writes one word at a time. At each step it has a shortlist of words that would all work about equally well. “The weather was cold and grey” or “cold and overcast”. Same meaning, same quality, no reader would notice either way. Normally the model uses a random number to break that tie.

Anthropic has replaced the randomness. In the company’s own description, the model now uses “the key and a few words that come before to settle what word the model should pick”. Any single choice still looks completely ordinary. But across a few hundred words those choices accumulate into a statistical pattern. Anyone holding the key can test a passage and work out whether it matches.

So the watermark is not in the text. The watermark is the text, or more precisely it is the shape of the choices the text is made of.

How AI Text Watermarking Works, Step by Step

1. The model reaches a decision point. It has written “the weather was cold and” and needs the next word.
2. It generates a shortlist with scores. Several candidates score close enough that any of them would read naturally.
3. Normally, it rolls a dice. A random number picks between the near-equal options.
4. Now it consults a secret key instead. The key, combined with the handful of words just written, determines which candidate gets chosen.
5. Repeat, a few hundred times. Each individual choice is unremarkable. The sequence is not.
6. Detection is a statistical test. Someone with the key re-runs the same calculation over your passage and asks how often your text made the choice the key would have made. Far above chance, and the text is flagged.

Anthropic’s own analogy is a game of Monopoly where nobody rolls the dice. Instead everyone reads off the digits of pi, starting from a random point. The game plays out normally and nobody at the table notices anything strange. Later, if you know the trick, you can look back at every move and see that it followed pi.

This is not a new invention. It is a version of an approach called SynthID-Text, published by Google DeepMind in the journal Nature in 2024. Google already does the same thing to text from the Gemini app. In Google’s words, “SynthID adjusts these probability scores to generate a watermark. It’s not noticeable to the human eye, and doesn’t affect the quality of the output.”

So the headline “AI companies are now watermarking text” is roughly two years late.

What It Proves, and the Four Things It Does Not

This is the part that matters, and it is the part the panic skips. Anthropic is unusually blunt about the limits. A watermark, in the company’s own words, “can only determine that Claude was likely involved with the content at some point.”

Involved. Not wrote. That distinction carries an enormous amount of weight, and the company states directly that the watermark “cannot distinguish ‘Claude wrote this’ from ‘Claude heavily edited this.’”

It also says nothing at all about whether the words are correct. Provenance and accuracy are separate problems, and the second one has already reached a courtroom: a Victorian mayor prepared to sue OpenAI over a false ChatGPT claim that he had served time for bribery, in what would have been the first defamation case of its kind. He had in fact been the whistleblower involved in the case. A watermark would not have helped him.

Four things it therefore cannot tell you.

1. Who did the thinking. You can research a piece for a week, form your own argument, write every sentence yourself, then ask Claude to translate it into another language. The translation is fully watermarked, because Claude chose every word in it. The thinking was entirely yours.

2. Whether a human was involved at all. A clean result does not mean a person wrote it. It might just mean a different AI wrote it, or that the passage was too short to carry a signal.

3. Who you are. Anthropic says the watermark “doesn’t include anything that identifies you, your company, or your conversations.” It marks the model, not the user. There is no account ID in there.

4. Whether the work is any good. A watermark is not a quality score and it is not a verdict.

Where the Watermark Does Not Work at All

There are large holes in the coverage, and they are worth knowing because they are where most real writing sits.

• Short text. Detection “doesn’t work well on small samples, where there are fewer word choices”. A caption, a headline or a two-line bio may carry nothing at all.
• Hard factual writing. The mark is “sparser on factual passages where there are fewer choices”. If the sentence is “Isaac Newton’s most famous work was the Principia“, there is no alternative word to choose and therefore no room to hide anything.
• Code. Working code has to be exact, so there is almost no room for the tie-breaks the watermark depends on.
• Light editing. If you write something yourself and ask Claude to fix your commas and put apostrophes in the right place, “those changes might not be enough to make Claude’s involvement detectable.”

One more thing worth knowing, and it undercuts most of the current panic: as of now there is no public detector. Anthropic says it “will soon be offering a watermark detection API” and is “in the process of working out the details of its implementation”. Until that ships, only Anthropic can read Claude’s mark.

Any tool advertising today that it detects AI watermarks is doing something else. Almost always it is guessing from writing style, which is the same unreliable technique that has been (sometimes) falsely accusing students of cheating for three years.

The Bit Almost Nobody Is Talking About: Your Images

Everyone is worrying about their text. The genuinely exposed thing is the pictures.

When Claude produces an image or an SVG file, it does not use the statistical watermark. It attaches provenance data using an open standard called C2PA, the same kind of information a camera writes into a photo file. C2PA needs no secret key. Any tool that understands the standard can read it today, right now, with no waiting for an API.

So if you have been quietly generating hero images, social graphics or diagrams, those files are the ones already carrying a readable label. Your blog post is not.

Screenshotting or re-saving an image strips that metadata, which is exactly why file-based marking is considered weaker than the text approach, and why Anthropic used a different method for words.

That weakness is not academic. Synthetic video is already good enough to move money, as one Hong Kong finance worker found when a fake video call with a digitally altered CFO cost the company HK$200 million, roughly US$25 million, and there is a whole economy of AI-generated models earning real money as if they were people. Metadata that a screenshot removes is thin protection against either.

Why This Is Happening Now

Not ethics. Law. Article 50 of the European Union’s AI Act requires providers of generative AI to mark their output in a machine-readable way so it can be identified as artificially generated. Those transparency obligations started applying on 2 August, 2026. Anthropic signed the EU’s Code of Practice on Transparency of AI-Generated Content in July 2026, alongside roughly 190 other organisations, and published its technical explanation of how the watermark works on 14 August, 2026.

Anthropic turned it on globally rather than building a separate pathway for Europe. This is the same company whose own research on which jobs AI exposes most made headlines earlier this year, and it has been consistent about publishing the uncomfortable parts. Every other lab that signed the same code is on the hook for the same requirement, so expect more of this.

There is a detail in Article 50 that most of the commentary has missed, and it matters a great deal for anyone publishing professionally. The article exempts content that “has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility”. In plain reading, and this is a plain reading rather than legal advice, the law is not actually asking “was a machine involved”. It is asking whether a named human took responsibility. That is the same test we landed on internally, which was reassuring to discover.

Does an AI Watermark Affect Your Google Rankings?

Short answer: there is no evidence that it does, and there is a good structural reason why it probably cannot.

Google’s public position has not moved. Its Search Central documentation says the problem is producing large volumes of unoriginal, low-value content, “no matter how it’s created”. The test is the value of the page, not the tool that made it.

More practically, the watermark is unreadable without Anthropic’s key. There is no indication Google has it, and without the key the mark cannot be read. A signal nobody can see is not a ranking factor.

That does not mean you are safe. It means the risk was never the watermark. If you are publishing large volumes of thin AI-assembled pages, the exposure is the thin pages. Just as it always has been.

Can You Remove It? The Truth About Watermark Removal Tools

This is the question filling the comment sections, and there is now a small industry selling answers to it: humanisers, paraphrasers, “AI detector bypass” services, rewriting tools that promise to strip any trace of a machine from your draft.

Here is the mechanism, which tells you everything about whether they are worth your money.

The watermark lives in the specific sequence of word choices. So the only reliable way to destroy it is to change the word choices. Anthropic’s own account of what removes the mark is “a complete rewrite where every word is replaced”. That is not a loophole, it is the definition of the problem. The methods that reliably strip the signal work by degrading the text, because the words being replaced are the ones the model picked as best.

Which leaves you in one of three places.

Light paraphrasing does not reliably work. Swap a few words and enough of the original sequence survives to keep the statistical signal detectable. You have made your writing slightly worse for nothing.

Heavy machine paraphrasing works by wrecking the prose. Run it through a tool aggressive enough to replace nearly every word and you will destroy the mark. You will also get the flat, oddly synonymed, slightly wrong register that everyone has learned to recognise. Ironically, that is the exact texture that style-guessing “AI detectors” flag hardest. You can defeat a watermark nobody can currently read and fail the detector your client actually uses.

Running it through a second AI may just give you a second AI’s watermark. Google applies SynthID to text from the Gemini app, so the paraphrase route risks swapping one provenance signal for another rather than clearing it. If more labs ship marks under the same EU code, and they are obliged to, that becomes the normal case rather than the exception.

And underneath all three: you are paying to defeat a signal that, right now, nobody but Anthropic can read, in order to conceal something that in most professional contexts is not even a problem to admit.

If you genuinely rewrote the piece in your own words, you do not need a tool. That is the rewrite. If you did not, the tool is not solving your problem, it is hiding it, and hiding it badly.

There is one legitimate version of this concern and it deserves a straight answer. Some people are worried not about hiding AI use, but about being falsely accused, or about a client or university running a blunt tool over honest work. That is a real risk and it is getting worse. The answer is not a removal tool, because a removal tool leaves you with degraded prose and no evidence. The answer is receipts.

What to Actually Do: An Eight-step Checklist

1. Do not buy a watermark removal tool. See above. You would be paying to make your own writing worse in order to defeat a signal that nobody can currently read.

2. Keep your receipts. This is the single highest-value habit. Version history, timestamps, notes, research files, early drafts. If you wrote something and used AI to tidy it, your evidence is the trail of you making it, not an argument about detection. Most of the free Google AI tools worth using log their own history too. Google Docs and Word both keep version history automatically. Turn it on and leave it on.

3. Check your image folder, not your text. The C2PA data on AI-generated images is readable by anyone today. If you have shipped AI-generated graphics for a client who assumes otherwise, that is the conversation to have this week, not next year.

4. Separate the two questions you are actually being asked. “Did a model touch this” and “whose thinking is this” are different questions with different answers. Most disclosure fights happen because people conflate them. Get clear on which one you are answering.

5. Write down where you stand before someone asks. What counts as AI use in your organisation, what gets disclosed, who signs it off. The question is shifting from “did you use AI” to “what did it actually do”, and the second one needs an answer you have prepared rather than improvised under pressure.

6. Put a named human on the end of everything. This is the test the EU AI Act itself reaches for, and it is the one that survives contact with reality. Not “was AI used”, but “who is responsible for this and did they actually read it”.

7. Never let a model near quotes, verdicts or first-hand claims. A quote is a real thing a real person said. The moment a model is generating or paraphrasing one, you have a fabrication problem that no provenance system will catch and no disclosure line will excuse.

8. Check the output against the input, not just against the facts. This is the one I got wrong, and it is the subject of the next section.

Where Man of Many Stands

Here is our position, in plain terms, including the parts that are uncomfortable.

I use AI. Specifically, I use it for social posts and for drafting emails. Not for the articles you read on this site. That distinction is written down and it is the whole point.

Man of Many is one of five member publications of the 100% Human initiative, alongside GadgetGuy, EFTM, Tech Guide and Image Matrix Tech. That membership is a signed promise with seven rules, and the first one is the one that counts: generative AI is never used to write articles that carry an author’s byline. The promise also requires that we never invent fake authors or bylines, that we tell you when generative AI has been used in something published, and that we maintain a public AI policy explaining all of it.

There is a second standard emerging internationally, Proudly Human, which certifies human-made work the way an organic label certifies food. We are not certified by it. We are watching it closely, because we think third-party verification is where this ends up, and a promise you make about yourself is worth less than one somebody else checks.

Underneath the public promise sits our internal AI Usage Policy, version 1.0, which took effect on 10 August 2026 and replaced three older overlapping documents. It is reviewed quarterly, next in November 2026. This is the part of the answer that will keep changing, and we would rather tell you that than pretend we solved it once. The policy has one governing sentence: AI assists, a named human decides, verifies and signs.

In practice that splits our output in two.

Reported journalism, reviews and anything under a personal byline: AI never writes it. No AI first draft, no AI-rewritten copy, no AI-generated review text. Research, transcription and formatting only. Opinions, verdicts, scores, first-hand experience claims and quotes are permanently off limits.

Commercial and programmatic content, meaning sponsored articles that carry a brand or team byline rather than a person’s name, can start from an AI draft. Every one is read and released by a named person before it goes live, and that person owns it.

Our disclosure test is not “did a model touch this at any point”. It is do the model’s words survive into what you read. If an editor rewrites an AI draft so the published sentences are theirs, that is human writing, in the same way a research note or an interview transcript is not co-authorship. If the model’s phrasing survives into the published piece, you get a disclosure line. If most of the body copy publishes substantially as the model produced it, you get a stronger one.

We are still building parts of the machinery that applies those labels automatically. That work is in progress and it is dated.

The Mistake, and Why It Belongs Here

Now the part I would rather not write.

Two weeks ago I posted on LinkedIn about this exact watermarking story. To pull it together, I ran a search to see what people were saying, copied the results into Claude, and asked it to draft me a post. Among those search results was a post by Sarah Evans, who had written about it first and written about it well.

I then fact-checked what came back. I checked it against Anthropic’s own material. What I did not do was check the words themselves against the words I had fed in. A significant amount of Sarah’s phrasing and framing survived into what I published under my own name.

Ben Whitelaw spotted it, put the two posts side by side, and asked me directly and fairly what had happened. He was right. I deleted the post, apologised to Sarah publicly, and I am not going to pretend it was anything other than what it was.

Here is why it belongs in a piece like this rather than in a quiet corner.

A watermark would not have caught it. My post would have been flagged as “Claude was likely involved”. True, and completely beside the point. Claude being involved was not the problem. The problem was that I had put someone else’s thinking into a model, not read the output closely enough, and published the result with no credit. That is a failure of attention and attribution. It is a very old kind of mistake with a very new delivery mechanism, and no provenance signal in the world detects it.

The reverse holds too. If I had done it properly, taken Sarah’s post as one input among many, formed my own view and written my own sentences, the piece would have been honest work. It might still have carried a watermark. Same signal, completely different act.

That gap, between what the mark can see and what actually matters, is the whole story. A watermark tells you a machine was in the room. It cannot tell you whether anybody was thinking.

The tools are not the test. They never were.

humAIn 2026: The Conversation This Article Keeps Circling

Man of Many is a Supporter of humAIn 2026. We receive logo placement, event acknowledgement and one delegate pass. We provide promotion across our site, newsletter and social channels. No money changes hands in either direction.

If this is the conversation you want to be in the room for, humAIn 2026 runs on 13 and 14 October 2026 at The Collider and Stone & Chalk, 477 Pitt Street, Sydney. The theme is exactly the question this piece keeps circling: what remains irreducibly human in the AI era.

Now fully independent, and led by founder Cat McGinn with Belinda Cusack and Denise Fletcher, it is the first two-day edition. Day one is the big argument: keynotes, panels, the return of the AI Upfront and the Great DebAIt, plus the Chatham House Rule roundtables the event is known for, where people say what is actually working and what is not. Day two is hands-on, with practical workshops and demos for teams trying to get from experimenting to shipping.

Confirmed sessions include Lucinda Barlow, Head of International Marketing at Uber, with Ben Cooper, founder of Brainstrust, on why the best brands refuse the first answer; Lou Compagnone, Director of AI at Datacom, on why AI transformations fail; Pip Bingemann on the seduction of output that sounds authoritative; and James Caldwell of BytePlus on the infrastructure behind content production and the algorithm that decides what gets seen.

Man of Many readers get 20% off with the code MOM at humain.au. Book before 5:30pm on Tuesday 1 September for the biggest saving. After that the code still works, at a smaller discount.

Tickets and the full programme are at humain.au.

Disclosures

Man of Many is a Supporter of humAIn 2026. We receive logo placement, event acknowledgement and a delegate pass in exchange for promotion. No payment is involved in either direction.

Our full AI policy is at manofmany.com/ai-policy.