Text written with Claude carries an invisible watermark, and since 3 November that includes older models. Anthropic's release notes for that day say output from Claude Mythos 5, Claude Opus 4.7 and Claude Sonnet 4.6 now carries the mark, joining newer models that have had it since launch. The watermark exists because of the EU AI Act, but Anthropic applies it worldwide. For anyone writing an AI policy, grading work or checking a suspicious document, the key fact is what Anthropic says about its own limits: a detected mark shows Claude was likely involved, and a missing mark proves nothing.
What changed on 3 November
Anthropic says it signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026. The Next Web reports that the European Commission published the code on 31 July with about 190 signatories. Article 50 of the Act, which requires machine-readable marking of AI output, applied from 2 August. Anthropic's help centre says Claude models launched on or after that date carry the marking at launch, and its August post said older models would follow over the coming months.
The 3 November release notes add three older models to the list. For Sonnet 4.6 there is a caveat: output from requests that change the temperature, top_p or top_k settings might not carry the mark. Anthropic's help centre also says rollout on Amazon Bedrock for some models completes by 10 November.
How the watermark works
Anthropic describes the text watermark as a version of the SynthID-Text approach that Google DeepMind published in Nature in 2024, part of a family of methods that Anthropic traces to a 2022 proposal by the computer scientist Scott Aaronson. Normally, when several next words are about equally good, Claude picks one at random. With the watermark, a secret key and the few words that come before make that choice instead, which leaves a statistical pattern across a passage. Anthropic says nothing is added to the text, so there are no hidden characters, no extra tokens and no information about the user or their organisation, and the meaning and quality of the answer do not change.
Because the mark lives in the word choices, it travels with copied and pasted text and may survive some editing. Files work differently. When Claude creates an image or similar file, Anthropic attaches Content Credentials, an open standard known as C2PA that adds signed metadata to the file.
According to Anthropic, the marks apply across the Claude apps, Claude Code, Claude Cowork, Claude Tag and the API, and when Claude runs on AWS, Google Cloud or Microsoft Foundry. Anthropic says it applies them worldwide because it has no durable way to limit them to one region.
What a match proves, and what it does not
Anthropic's own documentation is careful here. A detected mark "provides a signal that content was processed by Claude, but is not fully conclusive." Claude may have only proofread, translated or summarised the text, and the watermark cannot distinguish writing from heavy editing.
The absence of a mark proves even less. Anthropic lists the reasons a mark may not be found: the text came from a model that predates marking, it was heavily edited, paraphrased, translated or mixed with other writing, the passage was too short for a reliable signal, or file metadata was stripped by a screenshot or re-save. Anthropic says a complete rewrite in which every word is replaced will remove it. It also says the mark is sparse in factual answers, exact outputs and code, where few word choices are equally good, and that light proofreading of human writing may leave too little to detect.
An analysis by the United Nations University's Campus Computing Centre puts it plainly. "A watermark is a provenance signal, not a truth signal." It cites independent work presented at the ICML conference in 2024 and 2025, including research from ETH Zurich, showing that determined attackers can strip text watermarks, or even forge them onto human writing.
Who can check text today
Text detection is in private preview. Anthropic says it is open to eligible organisations, such as regulators, law enforcement, media, fact-checkers, independent researchers, educational organisations and EU civil society groups, and to companies checking their own Claude output, with wider access planned. There is no public tool for checking text. For files, anyone can use the free Claude Content Checker, which reads Content Credentials only.
That means a teacher or manager cannot run a pasted essay through an official Claude detector today. Tools that claim to do so are not Anthropic's.
What it means for AI policies
We think the watermark is useful as one clue among several, and harmful when treated as a verdict. A policy that punishes someone because a mark was found, or clears someone because none was, misreads what the technology can do. The more durable approach is to ask people to disclose AI use, and to judge work on its quality and the person's ability to explain it.
What to do this week
- Read your team's or school's AI policy and remove any line that treats a detection result as proof.
- If you build on Claude Sonnet 4.6 and need the mark, leave temperature, top_p and top_k at their defaults.
- If your organisation qualifies for detection access, such as a newsroom or university, register through Anthropic's help centre.
- Use the free Claude Content Checker for images before you reuse them in public material.
For a plain introduction to Claude's apps and models, start with the Claude course in Learn.