Claude Watermarks Everything You Generate Now

0:00 Every word Claude writes for you is about to carry a mark you cannot see, cannot switch off, and did not agree to. It lives inside the text itself. Copy the answer into a dock, an email, a poll

0:12 request, and the mark travels with it. Anthropic put the page up on August 10th. By the next morning, the developers had arrived and they were not pleased. 434 points on Hacker News,

0:23 close to 400 comments, and the top of the thread was not applause. The cause is one article of European law and a deadline that has already passed. It went by on August 2nd, but that law

0:34 never asked for any of this outside Europe. Anthropic is applying it everywhere Claude is sold, and the same law leaves source code out of it entirely. Anthropic's own list of

0:43 covered products names Claude code. So, the question is not what the mark is. It is why the marking reaches further than the rule that caused it. three candidates, Brussels, user tracking or

0:54 the distillation fight Anthropic has been running since February. One of those Anthropic says out loud, one has no evidence behind it, one it has been arguing for in public for months. There

1:04 is also a date buried in that page and it decides whether any of this is switched on for you today. The page itself is short and specific. When a supported Claude model generates text,

1:14 it weaves an imperceptible watermark directly into the text itself, not a header, not a file attribute. The words are the carrier. Files work the other way around. Images and other supported

1:25 formats get signed provenence metadata under the C too. PA open standard. The content credential system cameras and editing tools already use. That half is ordinary industry practice. The text

1:37 mark is what is new at this scale. Anthropic says it survives copy and paste, may persist through some editing, and weakens under paraphrasing or translation. It also says the mark does

1:48 not change the meaning, quality or readability of your answer. That last promise is the one nobody can check. Coverage runs the whole product line. The API, the claude apps, claude code,

1:59 claude co-work, claude tag, and claude served through Amazon Web Services, Google Cloud, and Microsoft Foundry. The phrase on the page is wherever Claude is offered worldwide. There is no opt out

2:10 on any plan or any product. It is applied at the model level which means there is no setting to find and nothing to switch at your end either. Then comes the detail marking covers models

2:21 launched on or after August 2nd. The newest Claude model Opus 5 shipped on July 24th, 9 days before the line. Sonnet 5 landed in June. Fable 5 before that. So the model you are working in

2:34 right now is almost certainly not marked. What was announced is a rule for the next model plus a retrofit of the current ones and the European transition period gives that retrofit until

2:44 December 2nd. Therefore, the date that matters is December and it comes from article 50 of the European Union's AI act whose transparency obligations became applicable on August 2nd. It says

2:55 providers whose systems generate synthetic content must mark that content in a machine readable format and make it detectable as artificially generated. The ceiling on getting it wrong is 15

3:06 million or 3% of worldwide annual turnover, whichever is higher. Beside the act sits a voluntary code of practice on transparency of AI generated content published in June and assessed

3:18 adequate by the commission in July. Signing it buys a presumption of conformity which tilts the burden of proof toward the regulator instead of you. About 190 organizations had signed

3:28 by the end of July. Anthropic is one of them. So are Google, Meta, Microsoft, OpenAI, Synthesia, and Black Forest Labs. This is an industry position, not one labs idea. The commission's guidance

3:41 also lists what does not have to be marked. Very short strings, machine-to-achine output, no human ever sees, and source code, programming, scripting, markup, query, and

3:52 configuration languages, naming SQL, infrastructure as code, YAML, and JSON. Hold that carve out next to Anthropics product list. Brussels exempted your repository. Anthropic covered surfaces

4:03 include the coding agent that writes into it and the page does not draw the boundary. So if the law that triggered all of this leaves code alone, why is the coding tool in scope and why is a

4:13 developer in Bangalore or Boise inside a European transparency rule at all? Anthropic stated answer is compliance and nothing else. The page cites the code of practice it signed and stops. It

4:25 does not mention tracking and it does not mention the other fight it has been in all year. On February 23rd, Anthropic published a public accusation. Three Chinese labs, Deepseek, Moonshot AI, and

4:37 Miniax had run what it called industrialcale distillation attacks against Claude, around 24,000 fraudulent accounts, more than 16 million exchanges. Miniax, over 13 million of

4:48 those, Moonshot more than 3 million. Deepseek about 150,000. In June, it escalated, telling two United States senators that operators tied to Alibaba's Quinn Lab had run the largest

5:00 campaign yet, close to 29 million exchanges through about 25,000 accounts over 6 weeks. Alibaba says it does not train on other models outputs. That February post ends with counter measures

5:12 and one line in it reads differently today. Product API and model level safeguards designed to reduce the efficacy of model outputs for illicit distillation. model level. Under six

5:23 months later, a model level mark ships. Enthropic has not joined those two sentences, and this video is not going to join them either. But the research literature has a word for why they would

5:33 fit together. Watermarks are radioactive. Train a student model on marked text and the student inherits the mark. So, a compliant signal doubles as evidence of whose outputs your training

5:43 set was built from. And on July 27th, Dario Ammoday wrote that Anthropic has not argued for banning openweight models while naming a crackdown on industrial scale distillation as one of the three

5:55 fixes it does want. Therefore, the tidy story would be anti- theftwearing transparency's clothes. Except the published answer says it would not hold. A 2025 paper by Pan and colleagues

6:06 tested it. paraphrase the training data or neutralize the mark at inference and the inherited watermark comes out which leaves the uncomfortable reading. Whoever this stops, it is not the

6:16 operation running 25,000 fake accounts. It is the person typing into the box. Start with what the mark proves because anthropic is straight about this. A detected mark does not mean Claude wrote

6:26 the thing. Claude edits, translates, and summarizes human writing and that output carries the mark too. So the false positive is not a flaw in the detector. is the shape of the design. You write

6:38 the paragraph, Claude tightens it, and the artifact reports that a clawed model touched this without reporting how much. The reverse is just as weak. Heavy editing, a translation, a screenshot, or

6:49 an older model, and the same text comes back clean. An outside anthropic, nobody can check either direction yet. Detection tooling is forthcoming. Technical documentation is forthcoming.

7:00 John Gruber called the explanation infuriatingly opaque and signed off with this is all so stupid. Developers went at the quality question instead. If sampling is nudged toward one word over

7:10 an equally good one that is invisible in an email and a coin flip in code where choosing total over result costs nothing until the name is part of an interface somebody else depends on. The sharpest

7:21 version on that thread ran like this. It would be impressive to identify with perfect accuracy the tokens that do not matter. Most likely they are not perfect and that means the output is worse off

7:32 than without the watermarking logic. Anthropic has published no measurement that answers it and no detector that would let anyone else run one. None of which makes this a first and that is the

7:41 part that outrage keeps skipping. Google has been watermarking Gemini's text with synth I did since May of 2024. Open sourced the method that October and published the technique in nature. At

7:53 its developer conference in May, Google said synth ID had now marked more than 100 billion images and videos. And on the 19th of that month, OpenAI adopted the same watermark for its own images

8:04 alongside content credentials. The gap is text. Open AAI documents provenence for images and audio, not for ordinary writing. Back in 2024, it built a text detector it called about 99.9%

8:17 effective, then shelved it after its own survey found roughly a third of users would leave if it shipped one, while Arrival did not. So, the marking regime is arriving through law rather than

8:27 product decisions. China has required visible labels and hidden metadata on AI generated content since September of last year. And California's transparency law took effect on that same August 2nd,

8:39 covering images, video, and audio rather than text, which is why the hosted Kimmy and Deepseek services already attach identifiers of their own. Switching providers does not take the mark out of

8:50 your workflow. It changes whose mark you are carrying. That leaves one exit that actually clears it. Weights on hardware you control. GLM 5.2 and DeepSeek V4 Pro sit on hugging face under MIT licenses

9:04 today. and Kimmy K3's weights followed in late July. No provider in the path, no marking layer, no page to read, and the irony is exact. The models being recommended as the escape from

9:15 Anthropic's watermark are the models Anthropic accuses of having been trained on Claude in the first place. Here is the call. Marking wins. If AI text is going to be everywhere, machine readable

9:26 providence is the version of honesty that scales and applying it worldwide beats geofencing Europe. For most people, this costs nothing they will notice. The 5% it does cost is

9:36 developers. Your code now sits inside a scheme European guidance exempted by name with no detector to check it, no measurement of what it does to your output and no way to decline.

9:46 Transparency you cannot inspect is just a change to your artifact announced politely. Anthropic says the detector is coming. So the question worthh holding is this. Who gets to run it? You

9:57 checking your own work or the client, the school and the platform checking you.