Anthropic explained how Claude's text watermark works on 14 August, and said it plans to offer a public detection tool. When that tool arrives, some organisations will use it well and many will use it to accuse people of things.
The whole difference is one asymmetry, and it is worth stating before anything else: a watermark found is evidence. A watermark absent is nothing at all.
The asymmetry, spelled out
Anthropic is explicit about the limits, and they define what a detector can be used for.
A positive result means Claude was likely involved in producing this text. That is real information. It does not distinguish between Claude writing it and Claude heavily editing it, and it says nothing about who asked.
A negative result means one of many things: a human wrote it, a different AI wrote it, Claude wrote it and someone rewrote it substantially, or the sample was too short to detect anything. Detection needs a reasonably sized passage. Those possibilities are not distinguishable, and no future improvement makes them so.
So a detector can support "this was AI-generated" and can never support "this was human-written". Any policy built on the second reading is built on nothing.
What this means for code specifically
Code is essentially unwatermarked, and the reason is structural: the mechanism needs several equally valid word choices, and code does not offer them. Syntax, API calls and logic cannot be varied to carry a signal without breaking. Comments can carry it, because comments are prose.
The practical consequence for engineering teams is short. You cannot use watermark detection to audit how much of your codebase was machine-written, you cannot use it in code review, and you do not need to worry about generated code carrying a vendor signature into your repository.
Where it does reach you is everything around the code: documentation, design notes, commit messages, incident write-ups, the long explanation in a pull request description. That is prose, and prose is marked.
Four questions a policy should answer
Write these down before a detection tool exists, not after somebody has already run one on a colleague's work.
- Where do we require disclosure of AI assistance, and where is it simply assumed? A blanket rule that nobody follows is worse than a narrow one people respect
- Who is allowed to run a detector, on what, and on whose authority? Uncontrolled access to a detector is uncontrolled suspicion
- What happens on a positive result? If the answer is "a conversation", say so. If the answer is disciplinary, you have built an accusation machine on a probabilistic signal
- What do we do about a negative result? The correct answer is nothing, because it means nothing
Never use it punitively
This is the part worth being unequivocal about. A watermark detector applied to employee work is a surveillance tool with a false-negative rate nobody can characterise and a false-positive story you will struggle to explain to the person in front of you.
It also fails at its purported goal. Someone determined to hide AI involvement rewrites the text — Anthropic notes a complete rewrite removes the watermark, and adds the honest observation that at that point it is arguable whether the text can still be called AI-generated. So detection catches the people who were not hiding anything, which is precisely the wrong population.
The legitimate uses are about provenance, not people: verifying a claim about a document's origin, checking submitted external content, meeting a disclosure requirement.
What to prepare now
Three things worth doing before the detector ships, because each is easier to decide calmly than under pressure.
- Decide your disclosure norm and make it narrow enough to actually hold — "AI assistance is assumed in drafts and disclosed in published external material" is a rule people can follow
- Note that the watermark carries no identifying information — it cannot be traced to a user, an organisation or a conversation, so it can never answer "who did this"
- Remember it detects Claude, not AI in general. A policy that says "we detect AI-written text" will be wrong the first time someone uses a different model