Claude Now Watermarks Every Text Output, Worldwide and With No Opt-Out

AI 요약

• Text from Claude models released after August 2 carries a machine-readable mark.
• It covers every channel including the API, and there is no way to turn it off.
• No public detector exists yet, and a detected mark is not proof of authorship.

Text that Claude writes for you now carries a signal that no human eye can see but a program can read. The word watermark usually means a translucent logo stamped into the corner of a photo. This is a different thing. Nothing is added to what you see on screen. Schemes of this kind normally nudge the probability of each word choice by a tiny amount, leaving a statistical trace across the whole passage. Query that trace later and you get a verdict: this text may have passed through Claude.

Anthropic disclosed the plan in a support article, How Claude marks AI-generated content. Its opening line says the company signed the Code of Practice on Transparency of AI-generated Content under Article 50(2) of the EU AI Act. The compliance date for that code was August 2, 2026, and from that date new models launched in the EU support marking from launch.

Regulation is the trigger, but the scope does not stop at Europe. The article states that marking applies "wherever Claude is offered, worldwide." For developers and knowledge workers using Claude in Seoul, Bangalore, or São Paulo, this is in effect today.

Woven into text, attached to files

Anthropic uses two mechanisms, and they behave differently.

Text gets a watermark woven in. When a supported model generates prose, the article says it weaves an imperceptible watermark into the text itself. Because the mark is part of the text, it travels when you copy and paste, and it may persist through some editing. Anthropic states plainly that this happens at the model level. Whichever product or surface the text comes out of, the mark is there.

Files get signed provenance metadata attached. Supported file formats such as .svg, .png, and .jpg receive signed metadata following the C2PA standard. Unlike the text watermark, this also lets you check whether a file has been tampered with. But metadata falls off with a format conversion, a re-save, or a single screenshot.

The support article splits coverage into four categories.

The row developers should read first is Products. Claude Platform (the API), Claude, Claude Code, Claude Cowork, and Claude Tag are all listed, and the article says all generated text is watermarked. Reaching the models through AWS, Google Cloud, or Microsoft Foundry does not strip the text watermark. A cloud partner is not a route around it.

Nowhere in the article is there a way to turn it off. No request parameter is offered for unmarked output. Any company building a product on Claude has to design around the fact that Anthropic's mark ships inside the text their own service emits.

What applies to your account today

Here are the conditions in one place, all confirmed against Anthropic's support article.

The marks are already going out, but the only party that can currently read them is Anthropic. The support article says the company is working to enable users and third parties to detect the embedded watermarks, without committing to a schedule. Right now the only thing a reader can verify independently is the C2PA metadata on files. There is no way to check the text watermark.

Anthropic also narrows what a detected mark means. A detected mark signals that the content may have passed through Claude. It is not proof of authorship. The article gives the reason: people routinely use Claude to proofread, translate, summarize, and convert files. Run a draft you wrote through Claude for a cleanup pass and the output carries a mark, but the substance is yours. The reverse holds too. Absence of a mark does not mean a human wrote it. Short passages, heavy rewrites, and older models without marking support all come back clean.

Does it survive one paraphrase?

How durable the mark is, Anthropic has not quantified. The algorithm is undisclosed. That leaves published measurements of comparable schemes as the only evidence available.

A paper posted to arXiv on July 17, AI Watermark Evidence Fails Forensic Readiness, ran those measurements. Saifur Rahman Tamim and Amir Labib Khan took three well-known text watermarking schemes, KGW, Unigram, and the MarkLLM implementation of SynthID-Text, and attacked them with meaning-preserving paraphrase. That is, asking another LLM to say the same thing in different words. Anyone can do it.

Across 846 valid runs, the results were these.

All three collapsed under a single paraphrase pass. Even before any attack, detection missed the mark on unmodified output at rates of 70% for KGW, 83% for Unigram, and 80% for SynthID, and SynthID flagged 5.4% of a human-written-then-paraphrased control group as AI-generated. The authors found all three schemes failed two of the five Daubert factors that govern scientific evidence in US courts, concluding that they do not meet the evidentiary bar courts require.

The paper did not test Claude. Anthropic's scheme may well be more robust. But until the company publishes evidence, measurements of comparable public schemes are the only reference point available.

Developer Theo reached the same conclusion right after the announcement. He pointed out that handing the text to a weaker LLM with no watermark of its own and asking for a paraphrase is enough to erase the mark, adding that you can ask Claude to remove the watermark from Claude's own output. The people the mark actually catches are the ones who paste output through untouched.

The public detector Anthropic promised may make this worse rather than better. The same tool that checks whether a mark is present checks equally well whether a mark has been removed. Paraphrase, test, repeat, and you can polish until it passes. Open detection for free and evasion gets easy; put it behind a gate and independent verification is blocked.

In Korea, this mark does not discharge your obligation

If you serve Claude-generated output to users in Korea, you need your own label regardless of Anthropic's watermark. The basis is Article 31 of the Framework Act on the Development of AI and Establishment of a Foundation of Trust. It took effect on January 22, 2026, and the January 20 amendment has applied since July 21.

The article splits three ways. Paragraph 1 requires advance notice to users that a product or service is built on generative AI. Paragraph 2 requires labeling output as generated by generative AI. Paragraph 3 covers audio, images, and video that are hard to distinguish from the real thing, meaning deepfakes, and requires disclosure or labeling in a form users can clearly perceive.

Guidelines published by Korea's Ministry of Science and ICT on January 21, one day before the law took effect, split labeling methods in two. There are explicit labels a person can see, such as captions, logos, and visible watermarks, and implicit labels a machine reads, such as metadata. Output that stays inside a service can be handled flexibly with on-screen indicators or logos, but output that leaves the service faces a stricter bar. Even when only implicit labeling is used, the service must give a separate notice at least once at download time.

Anthropic's text watermark falls under implicit labeling in that taxonomy. Beyond that, the mark signals that Claude touched the content, not that your service used generative AI. The party bound by Article 31 is the AI business operator providing the product or service to Korean users, which is you. Anthropic's support article says the same thing in its closing section: if you deploy Claude in your own product, you have to determine independently what Article 50 requires of that product.

The penalty structure differs sharply between the two laws. Article 43 lists violations of Article 31 paragraph 1 (advance notice) as subject to an administrative fine of up to KRW 30 million, and does not list paragraph 2 (generation labeling) at all. A missing label does not trigger a fine on its own. The government has also stated a grace period of at least one year, so corrective requests come first for now. An EU Article 50 violation, by contrast, reaches up to EUR 15 million or 3% of worldwide turnover. Teams shipping into the EU market should read this alongside the EU AI Act GPAI penalties that started on August 2.

For anyone using Claude as a personal tool, almost nothing changes. The mark is already there, it cannot be turned off, and a detected mark does not change the fact that the substance of your writing is yours. The work lands on teams shipping Claude output through their own products. Pick one place where that output reaches a user's screen and check this week whether a notice saying it was generated with AI is actually visible there. If you serve Korean users, check the advance-notice screen at service entry too. Anthropic's watermark does not stand in for it.