Anthropic marks everything Claude writes. Nobody can mark what it reads.

Anthropic confirmed on 11 August 2026 that every text Claude generates now carries a watermark, and that models launched from 2 August 2026 ship with the marking built in ^[1][2]. That moves provenance marking from a paper topic to default production behaviour on a frontier model, and it does so in one direction only: what comes out of the model is signed, what went in is not ^[12].

The scope is the interesting part. According to the account by developer Carlos Ortet, the mark sits at model level and applies worldwide rather than only in the European Union ^[3], and it covers every surface: the Claude apps, the API, Claude Code, Cowork, Tag, and the model as run inside AWS Bedrock, Google Cloud and Microsoft Foundry ^[4]. No clean-output path and no off switch have been documented ^[5]. For operators that is a procurement fact, not a policy footnote. If your pipeline emits Claude text through Bedrock, it emits marked Claude text.

The legal trigger is the EU Code of Practice on Transparency of AI-Generated Content, which develops article 50(2) of the AI Regulation and which Anthropic signed ^[6]. The Commission found the Code adequate on 8 July 2026, the AI Board on 9 July, and the obligations apply from 2 August ^[7]. The announcement landed nine days after that date ^[13], and the global scope means one jurisdiction's transparency rule has been implemented as a worldwide model property.

What the mark proves is narrower than the headline suggests. Anthropic itself says it indicates only that Claude may have processed the text, not that Claude wrote it and not that the publisher used AI ^[8]. On mechanism, the company has said the mark "is part of the text", that it survives copy and paste, and that it "may persist through some editing" ^[9]. For generated .svg, .png and .jpg files it attaches signed metadata using the open C2PA standard ^[10]. Technical documentation and detection tools were announced but, as of 12 August 2026, had not been published, and TechCrunch's question about how much editing removes the mark went unanswered ^[11]. So the claim is live in production and unverifiable from outside.

Ortet's reading is that the only family that fits "part of the text" and survives copy and paste is generation-time token steering with a secret key, split between the green-list approach of Kirchenbauer et al. at ICML 2023, which nudges logits and raises perplexity, and distortion-free schemes that leave the distribution untouched ^[14][15]. The durability of either is contested: work presented at EACL 2026 forges another model's mark, and a 2025 paper strips watermarks with a 99 per cent success rate and no access to the model ^[16].

The asymmetry is the operator problem. The industry has now solved marking what leaves a model; it has not solved proving what went in ^[12]. If you publish, you still have no equivalent primitive for signing your own corpus before a crawler takes it, and the window to do it closes once a model has read the text ^[17]. Ortet also corrects his own earlier claim that a mark appearing only once is undetectable, citing an ICML 2025 paper showing it can be detected if you act before publishing ^[18].

Watch for three things: the promised documentation and detector, whether earlier Claude models get retrofitted (no date has been announced) ^[2], and whether any cloud reseller documents a way to disable the mark. The first vendor to offer input-side marking with a published verifier will be selling something no one currently has.