Is an AI watermark harmful, or harmless?

From 2 August 2026, text produced by newly released Claude models carries an invisible watermark. Anthropic published how it works, the EU AI Act made it more or less compulsory, and a large number of people reacted the way people generally react to being marked: badly.

That reaction is worth sitting with rather than talking anyone out of. Marking has a long and mostly unpleasant history. A mark you cannot see, applied to words you thought were yours, read by a key you do not have, is going to feel like surveillance whatever the engineering underneath says. Dismissing that as technical illiteracy is both rude and wrong.

What is actually happening to the text

A language model picks each word from a ranked set of candidates, and where several are near enough to equivalent it uses a random number to break the tie. The watermark does not change the candidates and does not push the model toward particular words. It changes where the randomness comes from: instead of an arbitrary source, the choice is settled by a key plus the few words already written.

The consequence is that the same word can be chosen in one sentence and rejected in the next, so no vocabulary fingerprint builds up that a reader could notice. Over enough text, though, the pattern of those tie-break decisions is statistically detectable by anyone holding the key. The approach is a version of SynthID-Text, published by Google DeepMind in Nature in 2024, and the underlying idea goes back to a proposal from Scott Aaronson in 2022.

So nothing is inserted, nothing is hidden in the characters, and the prose is not degraded to make room for a signal. That is a genuinely well-behaved piece of engineering, and it deserves to be described accurately before anyone argues about it.

The asymmetry nobody mentions

Here is the part that changes how you should think about all of this. A watermark can tell you that text came from a marked model. It cannot tell you that text did not.

Anthropic is explicit about the limits. The signal is thin in short passages, because there were fewer choices to encode it in. It is thin in factual writing, where precision leaves little room for alternatives. A complete rewrite removes it. Models released before the cut-off do not carry it yet, and other companies' models are not covered at all.

Finding the mark tells you something. Not finding it tells you almost nothing.

This matters because the way institutions actually use tools like this is rarely the way they were designed to be used. A detector built to confirm provenance becomes, in a university office or an HR process, a machine for accusing people. And in that use the failure mode runs entirely one way: the student who wrote their own essay has no watermark to show, and no watermark is exactly what the tool produces for everyone it cannot identify.

So: harmful or harmless?

The mechanism is close to harmless. It does not read you, does not phone home, does not make the writing worse, and does not follow you between documents. On the merits it is a modest, careful piece of work.

The harm, where it exists, is downstream and human. It is in who gets the detection key and on what terms; in whether a detector result is treated as evidence or as proof; in whether anyone is ever asked to prove a negative. Anthropic has said a detection API is coming and that the details are still being worked out. Those details are the whole story, and they are not written yet.

Our own view, from a company whose software is signed so that strangers can check who made it: marking where something came from is not the problem. Marking is how trust survives scale. The problem is always the same one, and it is never in the mark. It is in what people are permitted to conclude from it.