Anthropic built a watermark for AI, then published limitation that defeats it

Since 2 August, Anthropic has been marking content produced by Claude with two separate signals: an invisible watermark embedded in generated text, and C2PA Content Credentials attached to generated image files. Claude Fable 5.1 and Mythos 5.1 carry the mark from launch, along with every model released since that date.

The company has also published what defeats it, which is the more useful part of the announcement.

How The Text Mark Works

The approach is more sophisticated than the tricks that preceded it, and the distinction matters.

Earlier attempts at marking AI text relied on things like invisible Unicode characters — trivially removed by anyone who knew to look, and often destroyed accidentally by ordinary copy-paste. Anthropic's watermark lives in the statistical pattern of the tokens the model chose, seeded on a secret key.

There is no character to strip, and no letter substitution touches it. The signal is the sequence of words itself, which is why it survives being copied between applications and, the company says, can survive some editing.

For detecting the straightforward case — text pasted unchanged from Claude into a document — it works.

What Defeats It

Anthropic states the limitation directly: if another model rewrites the text, translates it, or paraphrases it thoroughly, the signal vanishes.

This follows necessarily from the design. The watermark is computed over the specific chain of words the model produced. Replace those words with different words carrying the same meaning and there is nothing left to measure.

The practical consequence is worth stating without euphemism. Defeating this watermark requires pasting the text into a second model and asking it to rewrite the passage. That is not a technical attack. It is one additional step, available to anyone, costing seconds.

The image credentials have a parallel weakness. C2PA metadata is a cryptographically signed note in the file, and it is robust against tampering — but re-saving the file through software that does not preserve the metadata removes it, and stripping metadata is a routine operation.

Why It Is Still Worth Doing

It would be easy to conclude the whole exercise is theatre. That conclusion is too quick.

Most AI text is not laundered by an adversary trying to hide it. It is pasted by a student, an employee or a contractor who has not thought about detection at all, and for that population the watermark works as intended. A measure that catches the careless majority while failing against the motivated minority is still a measure — that describes most security controls in ordinary use.

The provenance infrastructure also has to exist before it can be required. C2PA is the same standard used by camera manufacturers and photo-editing software, and a future regulation mandating disclosure needs something to mandate.

Where The Honesty Runs Out

The risk is not the watermark. It is what people conclude from its absence.

A detector that returns a positive tells you something reliable. A detector that returns nothing tells you almost nothing — the text may be human, or it may be Claude's output passed through one paraphrase. If institutions start treating a negative result as evidence of human authorship, the tool will have made things worse than no tool at all, and it will be the confident users rather than the engineering that caused it.

Anthropic has been clear about this in its own documentation. Whether anyone deploying a checker reads that far is a different question.

What To Watch

Whether other providers adopt compatible marking, since a standard covering one company's output has limited value. Whether paraphrase-resistant approaches emerge, which is an unsolved research problem rather than an engineering gap. And whether institutions build policies around what these tools actually establish — because a watermark that is trusted more than it deserves is the failure mode here.