Anthropic is watermarking Claude's text — and 1,922 court cases show what that can't fix

On August 11, 2026, Anthropic started watermarking the text Claude writes, and three days later published a plain-language FAQ explaining how it works. The trigger is not mysterious: Article 50 of the EU AI Act, which requires providers to mark machine-generated output in a machine-readable way, began applying on August 2.

So a real capability just landed. A large share of the AI-written text now in circulation carries a signal that can, under the right conditions, be traced back to the model that produced it.

Here is the part worth sitting with. On the same day that mark shipped, a public database of court decisions involving AI-hallucinated content stood at 1,922 cases. Not one was a watermarking failure. Every one was a verification failure — someone filed, published or billed for model output without checking whether the things it asserted existed. A watermark would have detected all of them and prevented none. This post is about that gap: how the marking works in plain terms, what a detection result actually proves, and what it cannot prove no matter how good it gets.

TL;DR:

• Nothing is added to the text. The model biases which of several equally-good next words it picks, using a secret key. No hidden characters, no metadata, no speed or cost penalty — and it applies to everyone everywhere.
• A hit is weak evidence and a miss is almost none. Anthropic says the mark cannot distinguish "Claude wrote this" from "Claude heavily edited this," is weak on short samples, code and factual passages, and is erased by a rewrite. Researchers showed in 2024 that under $50 buys the ability to both strip these marks and fake them onto text a human wrote.
• Provenance is not verification. The mark tells you which model handled the text. It never tells you whether the case, the citation or the book it names exists.

Image: Jon Rawlinson, Wikimedia Commons, CC BY 2.0. A page full of authenticity marks. Each proves a border was crossed. None says a word about whether the traveller told the truth.

What Anthropic actually changed, and what it didn't

Start with the mechanism, because nearly every misunderstanding downstream comes from getting this wrong.

When a language model writes, it produces one word at a time, and at most positions there is no single correct choice. "The meeting was productive" and "The meeting was useful" are both fine. The model holds a list of acceptable next words and picks using a random draw — which is why the same prompt gives you slightly different answers twice.

A text watermark replaces that random draw with a pseudo-random one driven by a secret key. The model still only ever chooses among words it already judged equally good, so quality is untouched. But across a few hundred words, the pattern of which acceptable word won each time stops looking like coincidence, and anyone holding the key can measure it.

Anthropic's own framing heads off the two most common wrong guesses: "nothing is added to the text, no hidden characters." No invisible Unicode, no zero-width spaces, no metadata blob you could strip by pasting into a text editor. No cost or speed change either. And it is on globally — Anthropic says it has no durable way yet to scope the behaviour by region, so a user in São Paulo gets the same treatment as one in Stockholm.

None of this is new science. Scott Aaronson proposed it in 2022, Kirchenbauer and colleagues published a working scheme at ICML in 2023, and Google DeepMind published SynthID-Text in Nature in October 2024 — Anthropic's implementation is a version of that. Google has run it in Gemini since 2024, reporting roughly 20 million live responses with no detectable quality difference, and claims more than 10 billion pieces of content watermarked since.

Which brings up what has not shipped. Anthropic says a detection API is coming "soon." It is not available. Pricing, false-positive rates and which models are covered are all not yet published, and Google's public SynthID detector portal, announced in May 2025, still runs on a waitlist. The mark exists in billions of documents; the ability to check one is, for practically everybody reading this, still a promise.

The mark survives a copy-paste. It does not survive a rewrite.

The signal lives in which words were chosen, so anything preserving the word choices preserves it and anything replacing them destroys it. Anthropic states the ceiling bluntly: "a complete rewrite where every word is replaced will" remove it. Two cases break that pattern in ways that catch people out.

Short and factual text carry almost nothing. The watermark needs choices to hide in. A sentence or two does not offer enough decisions to form a pattern, and heavily factual content may offer no real choice at all — Anthropic's example is that after "Newton's Principia," the next word is going to be "Mathematica," and no key gets a vote. The same logic weakens code, where syntax dictates most tokens, and proofreading, where the model changes too few words to leave a signal.

Translation carries a full watermark. This runs against instinct. Ask Claude to translate a document into Japanese and the Japanese text is newly generated by Claude, word by word, with the usual freedom to choose — so it comes out fully marked, even though the ideas came from an unmarked human original. That is the opposite of what the DeepMind researchers describe in Nature, where translating watermarked text into another language greatly reduces detection confidence. Both are true, because they are different scenarios: translating marked text elsewhere washes the mark out, while having the model do the translating stamps a fresh one on.

Survival behaviour as stated by Anthropic in its August 14, 2026 FAQ and by the SynthID-Text authors in Nature, October 2024.

A hit is weak evidence. A miss is almost none.

Someone runs a detector over a document and gets a result. What have they learned?

If it is positive: that some of this text passed through that vendor's model. That is the whole of it. Anthropic states plainly that the mark cannot distinguish "Claude wrote this" from "Claude heavily edited this," it says nothing about whether a single claim is true, and it cannot recognise text from some other AI, because it only ever knows its own key.

If it is negative, they have learned close to nothing. A clean read is exactly what you also get from a paraphrase, a short excerpt, a code block, a competitor's model, or an open-weight model running on someone's laptop with no marking at all.

Every cell here is a limit the vendors published themselves. Sources: Anthropic's watermark FAQ (August 14, 2026); Dathathri et al., Nature (October 2024); Jovanović, Staab and Vechev, ICML 2024.

The attack nobody budgets for runs in reverse

Scrubbing is the risk everyone imagines: someone launders AI text to hide its origin. There is a second attack pointing the other way, and it is the one that should worry you.

Spoofing means making text a human wrote carry someone else's watermark. Nobody is hiding anything; they are planting something. The target is a person who then gets accused of using AI, or a vendor blamed for output it never produced.

At ICML in 2024, Jovanović, Staab and Vechev demonstrated both attacks against state-of-the-art schemes with more than 80% success, for under $50 of compute. The DeepMind authors concede the same ground in their own Nature paper: watermarks "do not offer a complete solution," they require the model provider's cooperation to exist at all, they are unenforceable on open-weight models anyone can run unmodified, and they are "vulnerable to stealing, spoofing and scrubbing attacks." That last clause is the whole argument, published by the team that built the technology.

We already ran the "detect the AI" experiment. It flunked the wrong students.

Detection tools already exist, and they are a different technology with a documented history of harm. A watermark is planted at generation time by the model's owner, using a key. A classifier guesses after the fact, from features of the writing itself: how predictable the word choices are, how varied the vocabulary is. The first knows something. The second pattern-matches on style. That is the difference between measuring and profiling.

OpenAI launched an AI Text Classifier on January 31, 2023 and killed it on July 20 the same year "due to its low rate of accuracy." Its own numbers: 26% of AI text caught, 9% of human text falsely flagged.

Then Liang and colleagues published in Patterns in July 2023 the finding that should have ended the category. Across seven detectors run on TOEFL essays by non-native English speakers, the average false-positive rate was 61.3%; one detector flagged 97.8% of them. Prompting the same essays to use richer vocabulary dropped that to 11.6%. The detectors were never measuring authorship — they were measuring fluency, and penalising anyone whose English was simpler.

Institutions did the arithmetic. On August 16, 2023 — three years ago today — Vanderbilt University disabled Turnitin's AI detector, reasoning that a claimed 1% false-positive rate across 75,000 papers a year means roughly 750 students wrongly accused every year.

Watermarks are genuinely better than this; they are not guessing. But notice what carries over. The failure mode of a detection system is never a clean "unknown" — it is a confident answer about a specific person. Watermarks improve the accuracy of positives. Given spoofing, they do not eliminate the false accusation so much as industrialise the ability to manufacture one.

Regulation arrived before the tools did

All of this is landing in one fortnight because lawmakers moved first.

The EU AI Act splits the duty in two. Article 50(2) binds providers: whoever builds a generative system must mark its output machine-readably, text included. Article 50(4) binds you: a deployer publishing AI-generated text "informing the public on matters of public interest" must disclose it.

That second one carries an exemption which is, for most readers, the practical heart of the regime. It does not apply where the content has undergone human review or editorial control and a person holds editorial responsibility for it. Read that twice. Europe's answer to AI-generated text is not a detector. It is a named human who reviewed the thing and is accountable for it.

Labeling obligations landed on a schedule; usable detection did not. Sources: the EU AI Act and its application dates, the EU transparency code of practice (July 2026), China's labeling measures and GB 45438-2025, Korea's AI Basic Act, and Anthropic's announcement.

The rest of the calendar is short. The EU's transparency code of practice was deemed adequate on July 8–9, 2026 and drew around 190 signatories, including Anthropic, Google, Meta, Microsoft, Mistral and OpenAI. December 2, 2026 ends the grace period, extending the marking duty to systems placed on the market before August 2; February 2, 2027 is when detection interoperability is due. China's labeling measures took effect September 1, 2025, requiring both visible and embedded labels under standard GB 45438-2025, with Article 10 barring anyone from removing or forging a label. Korea's AI Basic Act came into force January 22, 2026 with labeling duties and fines up to KRW 30 million. The United States has no federal text-marking mandate at all — worth stating plainly, because a rule a large share of the market's models ignore is not a global rule.

One absence belongs here too. The Wall Street Journal reported in 2024 that OpenAI had built a text watermarking method described internally as around 99.9% accurate. Treat that as a report, not a fact: it has never been independently verified and OpenAI has never shipped text marking. Its own June 11, 2026 post on EU compliance documents image provenance only, and concedes the general limit in its own words — "metadata can be removed, watermarks can degrade."

Every one of these would have passed the watermark check

Damien Charlotin maintains a public database of court decisions worldwide in which a judge had to address AI-generated content containing hallucinations. Fetched on August 16, 2026, it stood at 1,922 decisions: roughly 200 in mid-2025, 719 by January 2026, 1,227 by April, 1,598 on June 9, and 1,922 today — 324 added in the last ten weeks alone.

Every point on this curve would have carried a valid watermark. Source: Damien Charlotin's AI Hallucination Cases database, fetched August 16, 2026.

The archetype is Mata v. Avianca, decided in the Southern District of New York on June 22, 2023: a brief citing six judicial decisions that did not exist, and a $5,000 sanction.

The example that should carry the most weight belongs to Anthropic. In May 2025, in Concord Music v. Anthropic, the company's own lawyers filed an expert declaration citing a study that Claude had hallucinated. A manual check missed it; counsel apologised to the court. The company now shipping a text watermark was itself burned by uncritical citation — of its own model's output, in its own litigation, with its own lawyers reviewing. A watermark on that declaration would have returned a clean, confident positive and changed nothing.

It generalises past law. Deloitte Australia agreed in October 2025 to partially refund a A$440,000 government report containing non-existent references and a fabricated quote from a judgment. On May 18, 2025, the Chicago Sun-Times and the Philadelphia Inquirer ran a syndicated summer reading list in which only five of the fifteen books were real. Liang and colleagues, analysing 950,965 papers in arXiv:2404.01268, found LLM-modified content reaching 17.5% of computer science abstracts against 6.3% or less in mathematics and the Nature portfolio.

The volume question deserves an honest number rather than an alarming one. A Graphite analysis of Common Crawl published in October 2025 found roughly 51.7% of sampled new articles were AI-written in May 2025 — and Axios, reporting it, added the caveat that matters: the share plateaued near parity rather than climbing. This is not a flood. It is a new normal.

Here's the point. Nothing on that list is a watermarking failure. In every case the provenance was never in doubt — everyone knew a model was involved, or would have accepted it instantly. What failed was that no human opened the citation and checked whether the case, the study or the book existed.

The bottom line: provenance is not verification

Call it the postmark fallacy. A postmark proves which office handled the letter. It has never had an opinion about whether the letter is true. We have just spent a great deal of engineering effort building a very good postmark, and a certain amount of public conversation is about to mistake it for a fact-checker.

Hold three things at once. A positive detection is weak evidence: it establishes a route, not an author, and never a fact. A negative detection is almost no evidence at all. And the coverage is structurally incomplete by design — it depends on each vendor volunteering, each holding its own key, and open-weight models, which anyone can download and run unmodified, participating in nothing. For now the ability to check is not even in your hands; it is behind a waitlist and a "soon."

What survives scrutiny is not a mark on the output. It is a record you can re-derive from its source: a recording that still exists, a timestamped transcript you can jump back into, a line attributed to the person who said it, a claim traced to a primary document you can open. We have argued this before about live translation, where the reviewable note matters more than the fluent output, and about police interview transcription, where the record has to hold up when someone contests it. The watermark era sharpens that argument rather than changing it: once marking is universal, "AI was involved" stops discriminating between anything.

Watermarks answer where text came from. Nobody has built the thing that answers whether it is true, because that thing is not a detector. It is a source you can go back to.

---

Where Telli.sh fits: we build the source you can go back to. Telli.sh records the meeting, produces a timestamped transcript with speakers attributed, and keeps the summary anchored to the audio it came from — so any line in your notes traces back to the second someone said it, months later. That is not a claim about detecting AI. It is the other half of the problem: when a summary asserts something, you can check it against the recording instead of trusting the sentence.

Start a live AI note

Sources

• Anthropic, "How Claude's text watermark works" (August 2026)
• Dathathri et al., "Scalable watermarking for identifying large language model outputs," Nature (October 2024)
• Kirchenbauer et al., "A Watermark for Large Language Models," ICML 2023
• Jovanović, Staab & Vechev, "Watermark Stealing in Large Language Models," ICML 2024
• Liang et al., "GPT detectors are biased against non-native English writers," Patterns (July 2023)
• Liang et al., "Mapping the Increasing Use of LLMs in Scientific Papers," arXiv:2404.01268
• Damien Charlotin, AI Hallucination Cases database
• EU AI Act, Article 50 — transparency obligations
• Wikimedia Commons image page