Anthropic confirmed on August 11, 2026 that every Claude model launched on or after August 2 embeds an invisible statistical watermark in the text it generates, and that supported image files carry a C2PA signed manifest on top of that. The part that matters if you ship software is the one that got the least coverage: there is no opt out. No API parameter, no plan tier, no enterprise setting, and no regional carve out. If your product calls Claude through the platform API, through Bedrock, through Vertex or through Microsoft Foundry, the text your users receive is marked, and you are the one who has to decide whether to tell them.
The short answer
Anthropic confirmed on August 11, 2026 that Claude embeds an invisible statistical watermark in generated text, applied globally and across the platform API, claude.ai, Claude Code, Claude Cowork and Claude Tag, including Claude models served through AWS, Google Cloud and Microsoft Foundry. Supported file outputs also carry a C2PA signed manifest. There is no opt out for users or for developers, a public detection API is still in development, and the company acknowledges the mark can be lost to editing, paraphrasing or translation.
Most model provider announcements change what you can build. This one changes what leaves your product, which is a different kind of problem and lands on a different team.
What is being marked
Anthropic said on August 11 that text generated by any Claude model launched on or after August 2, 2026 carries an embedded statistical watermark, and that older models will get the capability too. The mark is described as part of the text rather than metadata wrapped around it, which is why the company says it travels through copy and paste and can survive a certain amount of editing.
Files are handled separately. For supported formats, including .svg, .png and .jpg, Anthropic attaches a signed provenance manifest using the C2PA standard. That is a different mechanism with different properties: a manifest is a container level signature, so it is verifiable and tamper evident, and also trivially removed by anything that re-encodes the file without preserving metadata.
The surface named at announcement is wide. Claude platform API, claude.ai, Claude Code, Claude Cowork and Claude Tag, plus Claude models reached through AWS, Google Cloud and Microsoft Foundry. In other words, the marking follows the model, not the storefront.
The line that matters: no opt out
There is no setting.
Not a request parameter, not an enterprise plan feature, not a regional toggle. Forbes reported on August 11 that Claude users cannot opt out, and nothing in the developer surface contradicts that. For a team building on the API, this converts a provider policy into a product question you now own.
Consider the ordinary case. You run a support assistant, a documentation generator or a code review bot on top of Claude. Your users never see the word Claude. They see your product. From August, the text those users copy out of your product carries a mark that identifies it as having passed through a Claude model. Whether you disclose that is your call. Whether it is detectable is no longer your call.
The second order effect is worth naming. Article 50 of the EU AI Act, which became applicable on August 2, places obligations on deployers as well as providers. Anthropic marking the output satisfies the provider half. The half about telling a person they are reading synthetic text still sits with whoever put the interface in front of them.
The detection gap
A watermark nobody can read is a promise, not a control.
Anthropic confirmed on August 12 that a publicly callable text detection API is in development. Until it exists, the situation is asymmetric: the mark is present in output worldwide, and verification is available to exactly one party. For newsrooms, universities and platform trust teams who were told marking would help them, that is a gap measured in months.
When the detection endpoint does arrive it brings a known problem with it. Tech Times reported on August 12 that a public verification API doubles as an evasion oracle, because anything that tells you whether a mark is present also tells an automated loop when it has succeeded in removing one, at a cost per pass reported in single digit cents. This is not a flaw specific to Anthropic. It is the structural tension in every statistical watermarking scheme: verifiability and robustness pull in opposite directions, and you cannot maximise both.
Anthropic is upfront about the softer limits too. Heavy editing, paraphrasing, translation, or mixing Claude output with your own prose can push the signal below detection.
The inference nobody should draw
Here is the part we expect to cause real damage, and it has nothing to do with cryptography.
A great many people use Claude to proofread an email, translate a paragraph, tighten a paper or clean up commit messages. In every one of those cases the text originated with a human and passed through the model on its way out. It is now marked. If a university, an employer or an open source project treats watermark detection as proof of machine authorship, they will be wrong about a large and sympathetic set of cases, and they will be wrong in a direction that punishes people for using an editing tool.
The mark supports one claim: this text was processed by Claude at some point. It does not support the claim anyone actually wants to make. Kernel maintainers have already spent this cycle working out what AI assisted contribution means for review policy, and the lesson that generalises is that provenance signals are inputs to a judgement, never a verdict.
What we would do this week
Map it before you argue about it. Find every path in your stack where Claude output reaches a person outside your company, including the indirect ones through a cloud reseller, and write the list down. That list is your disclosure surface and it is probably longer than you think.
Then handle the easy compliance question while it is cheap. If you deploy a system that generates text for people in the EU, decide now whether your interface says so, because the obligation does not wait for the detection API to ship.
And go read any internal policy that says the words AI detection. If it treats a positive result as proof that a human did not write something, it needs rewording before the tooling arrives and makes it enforceable.
Sources and further reading
- Anthropic says it will watermark text generated by its AI models, TechCrunch, August 11, 2026
- Claude Users Can't Opt Out Of New Watermarks, Forbes, August 11, 2026
- Anthropic adding watermarks to Claude AI generated text and images, Quartz, August 11, 2026
- Claude Now Watermarks Text Everywhere: Mark Proves Processing, Not Authorship, Tech Times, August 11, 2026
- Anthropic Detection API Confirms Evasion Oracle, Tech Times, August 12, 2026
- Anthropic plans to add an invisible mark to AI text, Fortune, August 11, 2026
Frequently asked questions
What exactly did Anthropic announce?
That text produced by any Claude model launched on or after August 2, 2026 carries an embedded statistical watermark, applied globally rather than only in regulated markets. The mark rides inside the text itself, so it survives copy and paste into another application and may survive some editing. Anthropic also said it will extend the capability to older models. For supported file outputs, the company attaches a signed provenance manifest following the C2PA standard, covering formats such as .svg, .png and .jpg. The scope named at announcement covers the Claude platform API, claude.ai, Claude Code, Claude Cowork and Claude Tag, and Claude models served through AWS, Google Cloud and Microsoft Foundry.
Can developers or enterprise customers turn it off?
No. As of the announcement there is no API parameter, no plan tier and no account setting that disables watermarking, and the policy applies regardless of where the user is. That is the detail with the most operational weight. A third party product that passes Claude output through to its own users ships marked text whether or not that product discloses the model behind it, which turns a vendor decision into a disclosure question for every downstream team.
Why now, and why worldwide?
Article 50 of the EU AI Act became applicable on August 2, 2026, and its transparency code requires providers to mark synthetic output in a machine readable way. Anthropic is not alone in signing up: Google, Meta, Microsoft, OpenAI, Black Forest Labs and Synthesia have all committed to the same code. Applying one global behaviour rather than a geofenced one is the cheaper engineering answer, because detecting a user's jurisdiction reliably at inference time is harder than simply marking everything.
Is there a way to check whether a piece of text is watermarked?
Not publicly yet. Anthropic confirmed on August 12 that a publicly callable text detection API is in development. Until it ships, the mark exists but nobody outside the company can query it, which is an awkward interval for anyone building editorial or academic workflows around provenance.
How robust is the watermark in practice?
Weaker than the announcement implies, and Anthropic says so. Heavy editing, paraphrasing, translating, or blending Claude output with other writing can make the mark undetectable. Tech Times reported on August 12 that a public detection endpoint also works as an evasion oracle, with a cost per stripping pass measured in single digit cents. There is a second and more interesting failure mode: because people use Claude to proofread, translate and tidy their own writing, a detected watermark says the text passed through Claude, not that Claude wrote it. Provenance and authorship are different claims, and only the first one is being measured.
What should we change in our own stack?
Three things, in order of cost. Write down where Claude output reaches an end user, because that list is your disclosure surface. Decide whether your terms and your UI say so, since Article 50 puts the obligation on the deployer as well as the provider. And stop treating a watermark hit as evidence of machine authorship in any internal policy, whether that policy is about contributions, plagiarism or hiring, because the mark cannot support that conclusion.