Claude now stamps everything you write and won't say who can read the stamp

Since August, every paragraph Claude writes for you carries a signal you cannot see and have no way to check. That covers the API, the apps, Claude Code, Cowork, and Claude served through AWS, Google Cloud and Microsoft Foundry. Anthropic built it on Google DeepMind’s SynthID-Text. For each word slot, the model samples a small pool of candidates and pits them against one another in elimination rounds. A pseudorandom score decides who advances, computed by mixing a secret key with the last few tokens written. Across a few hundred words the text leans towards high-scoring tokens. You read “large” where the model might have written “big”, and the keyholder reads a fingerprint.

I expected to be irritated by the EU. I ended up irritated by Anthropic’s disclosure. It has explained the mechanism in some detail, yet in everything I have read from it I found no measured detection rate, no false-positive rate and no list of who holds the detector. OpenAI, which shelved text watermarking in September 2024 after a survey found almost 30% of ChatGPT users would use it less, has at least published a figure: 95% accuracy on 400-token passages. Google published the effect on user satisfaction across roughly 20 million Gemini responses, a 0.01% difference in thumbs-up rate. Anthropic has published how the scheme works and none of its own test results.

Anthropic says the mark carries nothing about your account, and I believe that is how the scheme is designed. It still tracks you in the way that matters, because the text travels with your name on it: the email you sent, the essay you submitted, the pull request you opened. And Anthropic is applying it worldwide, saying it lacks a durable way to scope the feature by region. Plenty of users outside the EU are now shipping an EU compliance artefact in their commit messages without anyone having asked them.

As for who reads the mark, Anthropic says the detection API is in private preview for eligible organisations: regulators, law enforcement, media, fact-checkers, independent researchers, educational organisations, EU civil society groups, and enterprises with their own compliance obligations. Those are categories. I would like names. An educational organisation running coursework through a detector is a very different proposition from a fact-checker auditing a viral post, and Engadget reports Anthropic conceding that the method cannot tell whether Claude wrote a text or merely edited it. Translations get marked too. A student who had Claude rework a draft they wrote themselves comes out flagged as Claude-involved, which a marking committee may treat as a confession.

Error rates are where this gets ugly. A July 2026 arXiv audit labelled SynthID “Not ready” for forensic use, recording a 5.4% false-positive rate with 80% of results landing as uncertain. Before any attack, its false-negative rate was already 80%. In 846 valid paraphrase runs, 98.3% of initially detected SynthID texts lost the mark after paraphrasing, and earlier work cited by the same authors saw its true positive rate fall from 0.998 on clean text to 0.498 under moderate paraphrasing. A single ChatGPT paraphrase pass pushed every tested method below 30% detection. Anyone who wants to evade the detector can do it with one prompt to a rival model. So in practice the detector flags people who pasted Claude’s output unchanged, and those are usually people with no reason to hide it.

Those numbers come from researchers’ configurations, and Claude’s deployment may perform better. I would happily accept that, if Anthropic published its own figures.

The defence I take most seriously is legal. The Commission says that although signing the Code is voluntary, the Article 50 transparency duties are binding law, and the Code is an accepted way to meet them. ETH Zurich researchers also found SynthID-Text hard to spoof, so nobody can easily plant a Claude mark on your own writing to frame you. I agree with both points and neither answers my complaint. The Code permits providers to restrict text detection to verified experts; I can find nothing in it forbidding a provider from publishing how often its detector is wrong. Resistance to spoofing protects you from a forger. It does nothing about the detector misfiring on human prose near the 200-token threshold the Code sets for marking, and that misfire is the case a student or job applicant will actually meet.

About 190 signatories have committed to making their watermarks interoperable by 2 February 2027. Before that date widens what any detector holder can check, Anthropic should publish its measured false-positive rate at 200 and 400 tokens and the named organisations with detection access. If you hold an enterprise contract with Anthropic, ask for both in writing at your next renewal, and treat a refusal as information about how the detector will be used on your staff.

Prompted by The Latest Anthropic Claude Models Contain AI Text Watermarks: What Does This Mean for You?, O’Reilly Media.