In August 2026, Anthropic announced that new Claude models embed a machine readable watermark in the text they generate. The news spread fast, and so did the misinformation. Within days, tools promising to "remove the Claude watermark" appeared, most of them built on a wrong assumption about how the watermark works.
This post explains what was actually announced, how statistical text watermarking works under the hood, what survives editing and what does not, and why the popular "hidden character" theory is a myth.
What Anthropic announced
The facts, without the noise:
- Claude models launched on or after August 2, 2026 carry the text watermark from day one. Older models are not affected.
- It applies wherever Claude runs: the Claude apps, Claude Code, and the API. The rollout is worldwide, not just in the EU.
- Generated files additionally carry digitally signed provenance metadata, separate from the text watermark.
- The trigger is regulatory. Anthropic signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content, joining OpenAI and Google, who have made similar commitments.
- Anthropic has not yet published the detection mechanism. Technical guidance and detection tools are promised separately.
And the one fact that matters most for the rest of this post: Anthropic states explicitly that the watermark is not made of hidden characters. No zero width spaces, no variation selectors, no doubled spaces, no unusual apostrophes.
The hidden character myth
The most common belief about AI watermarks is that models sneak invisible Unicode characters into their output: zero width spaces between words, narrow no break spaces instead of regular ones, soft hyphens inside words. The theory is attractive because such characters genuinely exist, genuinely are invisible, and genuinely do show up in text copied from chat interfaces, PDFs and word processors.
But those characters are formatting artifacts, not watermarks. They come from rendering pipelines, copy and paste behavior and document converters. Stripping them takes one pass of find and replace, which is exactly why no serious provenance system would rely on them. A watermark that dies in Notepad is not a watermark.
If you want to see what invisible Unicode is hiding in your own text, our free watermark checker visualizes every hidden character and gives you a cleaned copy. It is honest about its limits: it cleans formatting artifacts, and it cannot touch the actual watermark, for reasons the next section makes clear.
How statistical watermarking works
A language model writes by repeatedly choosing the next token from a probability distribution. At almost every step, several candidates are nearly interchangeable. The model could write "start" or "begin", "however" or "but", "shows" or "demonstrates", and the text would read equally well either way.
A statistical watermark exploits that freedom. Using a secret key, the system marks a subset of candidate tokens as preferred at each step, and the model leans slightly toward the preferred ones whenever the choice is close. Any single word proves nothing. But across hundreds of words, preferred choices pile up far beyond what chance would produce, and a detector holding the same key can measure that excess and compute how confident it is that the text was watermarked.
This design is not new. Google's SynthID-Text, published and open sourced in 2024, works on the same principle, and the academic literature on it goes back further. What is new is a major lab turning it on by default across all of its products.
Three properties follow directly from the design:
- The watermark lives in which words were chosen, so it travels with the text. Copy and paste cannot shake it off.
- Detection is statistical, so it needs enough text. A sentence or two rarely carries a reliable signal.
- Without the key, you cannot tell which words are the marked ones. Every word in a watermarked text is an ordinary word.
What survives, and what does not
Because the signal is spread across many word choices, its durability is a matter of degree:
- Copying and pasting: survives fully. The words are the watermark.
- Light editing: largely survives. Fixing a few sentences leaves most of the marked choices in place, and Anthropic says it expects some marks to survive editing.
- Heavy editing and paraphrasing: degrades the signal. Every rewritten sentence replaces marked choices with your own.
- Translation: effectively destroys it. Every word gets rechosen in the target language.
- Mixing with human writing: dilutes it. The statistical excess sinks toward the noise floor as unmarked text grows.
Can you remove it, and should you try
No character level tool can remove a statistical watermark, because there is nothing at the character level to remove. Cleaning hidden Unicode, swapping smart quotes for straight ones, or normalizing dashes changes none of the word choices that carry the signal. The only thing that genuinely weakens it is rewriting the text so thoroughly that it is substantially your own writing, at which point calling it AI generated is barely accurate anyway.
The better question is why you would try. The regulatory direction is clear: the EU AI Act requires AI generated content to be identifiable, and platforms are moving the same way. Provenance marks exist so that readers can trust what they read. Working around them is impractical today and a liability tomorrow.
One important distinction: third party "AI detectors" that scan writing style are unrelated to this watermark. They guess, and they are notorious for flagging human writing, especially from non native speakers. A key based watermark detector does not guess. It runs a statistical test that human writing will not trip, because human writing was never biased by the key. If anything, proper watermarking should eventually make the guesswork detectors obsolete.
What this means in practice
If you write with AI assistance: nothing about your workflow breaks. Text you substantially rewrite becomes yours in every sense, including statistically. Text you publish verbatim is identifiable as AI generated, which is exactly what disclosure rules expect of you anyway.
If you publish content at scale: assume provenance is permanent infrastructure, not a passing feature. Build disclosure into your editorial process now and the regulation never surprises you.
If you build on the Claude API: output from models launched after August 2, 2026 carries the watermark, including what your product shows to its users. If your product republishes model output, that is worth knowing and worth disclosing in your own terms. We help teams design exactly these integrations as part of our API integration service.
The short version
- Claude watermarks text by biasing word choices, not by hiding characters.
- The watermark survives copy and paste, weakens under heavy rewriting, and needs enough text to be detectable.
- Hidden Unicode in your text is real, but it is a formatting problem, not a watermark. You can see it and clean it with our free checker.
- Detection tools are not public yet. Claims that a tool "detects the Claude watermark" today deserve skepticism.
