Claude Watermarks Its Output Now. Your Code Is Barely Affected.

Anthropic published a support page on how Claude marks AI-generated content, and within a day the reading had settled into a single sentence: Claude now snitches on you, and every repository you touched with an agent is a liability.

That reading is wrong on the part people care about most. The marking is real, it is worldwide, and it is not optional. It also targets prose, and prose is exactly what code is not. Below is what actually got shipped, how the mechanism works in plain terms, why generated code is the worst possible carrier for it, and why the SEO panic has no basis at all.

What Anthropic actually shipped

Anthropic signed the EU AI Act's Code of Practice on Transparency of AI-Generated Content. The marking is the technical side of that commitment, and it takes two different forms.

Text gets a statistical watermark. An imperceptible mark woven into the generated text itself. In Anthropic's words, "it weaves an imperceptible watermark directly into the text itself. You won't see it, and it doesn't change the meaning, quality, or readability of Claude's response." It persists through copy and paste, and "may persist through some editing."

Files get signed provenance metadata. When Claude generates a supported file type, currently .svg, .png and .jpg, it attaches metadata following the C2PA open standard, the same Content Credentials system backed by Adobe, Microsoft and the BBC.

The scope is broad and worth stating precisely, because a lot of the commentary assumed it was an EU-only or Claude.ai-only measure:

The watermark is not a hidden character

This is the single biggest misconception, and it is why half the advice circulating right now is useless.

People assume the mark is something inserted into the text: a zero-width space, an unusual Unicode variant, a distinctive punctuation pattern. That assumption leads straight to "just run it through a cleaner and you're fine". It does not work, because there is nothing inserted to clean.

The mark is which words were chosen.

Anthropic has not published its algorithm, and that is a deliberate choice we will come back to. But every property they describe (invisible, inside the text, survives copy and paste, needs enough text to be read) matches the published family of sampling-bias watermarks, the approach behind Google's SynthID-Text and the academic work that preceded it.

The idea is simpler than it sounds. Whenever the model writes, it picks the next token from a set of candidates. Very often several candidates are near-equivalent: fast, quick, rapid, swift all work. A secret key splits the vocabulary into a favoured group and the rest, and the sampler leans towards the favoured group whenever leaning costs nothing in meaning or quality.

One such choice tells you nothing. Chance alone would put roughly half the tokens in the favoured group. But across a few hundred tokens the imbalance grows into something you can measure, and a detector holding the key can compute how far the text sits from what chance would produce. That gap is the whole signal.

Two consequences follow directly, and both matter more than the mechanism itself:

• Length is a hard requirement. A tweet or a commit message carries no usable signal. The detector needs volume.
• Changing the words is the only thing that removes it. Not because removal is clever, but because the words are the mark.

Why generated code is the worst possible carrier

Here is the part the panic skipped. A sampling watermark is a tax on freedom of choice, and it can only be levied where choice exists. Prose is rich in it. Code is close to bankrupt.

Take a single ordinary line: const user = await getUserById(id).

const is set by the file's own conventions. getUserById is not a choice at all, it is the name that already exists in the codebase, and any near-equivalent would simply be a bug. await is forced by the function's signature. The parentheses and the argument are forced by the syntax. What is genuinely free? The name of a local variable, and the wording of a comment. That is the entire channel.

Now compare with a paragraph of prose, where nearly every content word has three or four interchangeable alternatives. The difference is not marginal, it is the difference between dozens of carrier slots per paragraph and a handful per file.

And then the pipeline runs.

Formatters are the specific problem. prettier, eslint --fix, gofmt, black, rustfmt all exist to normalise exactly the near-equivalent surface choices that a sampling watermark uses as its carrier. Running a formatter over generated code is, functionally, running a laundering pass over the watermark, without anyone intending it. Add review edits, a rename, a refactor, and the interleaving of generated code with human code inside the same file, and the residue is spread across diffs that are usually far too short to measure anyway.

The honest caveat, because this is an argument from mechanics rather than a confirmed exemption: Anthropic has not said code is excluded, has not published the algorithm, and has not released a detector. Nobody outside Anthropic can measure what actually remains in a committed .ts file. The scenario with the most residual exposure is a long generated file, committed untouched, unformatted, and never reviewed. If that describes your workflow, the watermark is the least of the problems it creates, and our take on reviewing agent-written code applies well before this one.

What erases it, and who can actually detect it

Anthropic is unusually direct about the limits, which is worth crediting. A detected mark means the content may have been processed by Claude. It is explicitly not conclusive. And the absence of a mark proves nothing at all.

The detection question splits cleanly in two, and conflating the halves is what produced most of the bad takes.

Files are publicly verifiable, right now. C2PA is ordinary cryptographic signing: a private key signs, a public key verifies. Anyone can check a generated .png in a Content Credentials viewer, and Google is rolling that verification into Search, Lens and Chrome. There is no Anthropic privilege here, and the signature does double duty by revealing whether the file was altered after generation.

Text is not, and only Anthropic can read it today. Detection requires the secret key that biased the sampling. Without it the text is statistically indistinguishable from unmarked text. That is the current state, and it is the source of the "only Claude can catch you" reaction.

But it is not the intended end state. The Code of Practice Anthropic signed obliges them to provide third-party detection, and the support page says they are working to enable users and third parties to detect the marks, with documentation to follow.

The reason it has not shipped yet is a genuine dilemma rather than foot-dragging: publishing a detector also publishes the map for removing the mark. Give someone an oracle that scores a passage, and they can rewrite in a loop until the score drops below the threshold. Google faced the same trade-off with SynthID-Text and released a detector that stays hard to weaponise without the surrounding model. The likeliest outcome for Anthropic is a gated detection API with verified access and quotas, not a public one-click checker.

The detail almost nobody has picked up

The mark applies to text the model produced. It does not distinguish between text Claude invented and text Claude merely touched.

Ask Claude to fix the grammar in a paragraph you wrote yourself, and the output carries the watermark. Ask it to tighten a paragraph, translate a sentence, or reformat your own notes, and the same applies.

This cuts in both directions, and it is more interesting than the scandal framing suggests. It weakens the accusation scenario people fear, because a positive detection cannot separate "an AI wrote this" from "a human wrote this and an AI polished it", and those two are not remotely the same claim. It also means anyone planning to treat detection as proof of authorship is building on sand. Anthropic effectively concedes this by describing a hit as "may have been processed by Claude".

What this changes for SEO: nothing

We run this site's SEO in the open, so let us be blunt about the part that generated the most noise. There is no ranking risk here. Three reasons, stacked.

Google does not penalise AI-written content as such. The policy has not moved: what gets sanctioned is scaled content abuse, mass-produced pages with no value. The judgement is on quality and usefulness, not on the origin of the words. A genuinely good article stays a genuinely good article.

Google cannot read this watermark anyway. It is gated by a key Anthropic holds. Even if Google wanted it as a ranking signal, it would need an agreement with Anthropic to obtain one. No such thing has been announced, and no signal targeting AI-written text was announced at I/O 2026 either.

What actually shipped is media provenance, and it is a label, not a factor. Google's 2026 work covers images, video and audio through SynthID and C2PA, surfaced so users can ask whether an image is AI-generated in Search, Lens and Circle to Search. That is transparency for readers, not a lever on rankings.

There is one real, practical consequence, and it is about your images rather than your text. If you publish visuals generated by Claude, they now carry Content Credentials, and Chrome and Search will increasingly be able to label them. The effect is not a demotion, it is CTR and trust: a hero image flagged as AI-generated does not read the same way as a photograph.

Worth knowing before anyone over-engineers a response: most image pipelines already strip C2PA without being asked. sharp, next/image, build-time compression, a CDN that re-encodes on the fly, all of them drop the metadata. On a typical site the provenance is gone long before a browser sees it. That is a double-edged outcome. It disposes of the labelling question by accident, but deliberately stripping provenance becomes its own compliance problem the moment the use case is regulated, and if you are shipping into the EU that question belongs next to the GDPR side of AI-assisted work.

What to actually do

Short list, because there is less to do than the discourse suggests.

1. Nothing, for code. No cleaner, no stripper, no workflow change. There is nothing to remove, and your formatter is already doing more than any tool you could add.
2. Keep reviewing generated code, for the reasons that already applied. The watermark changes none of them.
3. Decide consciously about images. If you publish Claude-generated visuals, know whether your pipeline keeps or strips Content Credentials, and make that a decision rather than an accident.
4. Do not chase watermark removal for text. The only reliable removal is rewriting the text yourself, and if you are rewriting it yourself the question has already answered itself.
5. Worry about quality instead. Scaled content abuse is the thing that actually costs rankings, and it was costing them long before any watermark existed.

The measure is a transparency obligation, honestly documented, with limits its own author is careful to state. It is a much smaller event than the reaction suggests, and for anyone shipping code with agents, it is very close to a non-event.

If you run agents at any scale, the operational questions worth your attention are still the old ones: what the agents touched, what got reviewed, and what shipped. That is the part AgentsRoom exists to make visible.