Anthropic's watermark ships: Fable 5.1, code, detection

On September 1, 2026, Anthropic shipped the thing it had described in August: Claude Fable 5.1 and Claude Mythos 5.1 are the first models to launch with the company’s statistical text watermark applied at the model level, worldwide, with no opt-out and no disable parameter. The platform docs state it flatly: “Text generated by Claude Fable 5.1 and Claude Mythos 5.1 carries Anthropic’s statistical text watermark on every platform where the model is available.” That includes the Claude API, Claude Code, AWS Bedrock, Google Cloud, and Microsoft Foundry.

The same day, Anthropic opened its watermark detection API in private preview. Access goes to a gated list: “regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, and EU civil society groups,” plus enterprises with their own EU AI Act compliance obligations. Everyone else can only wonder whether their text carries the mark, because no third party holds the detection key.

The reaction was immediate and it was not about model quality. Justin Schroeder, the FormKit creator and Standard Agents co-founder, posted on September 1: “Beware. Fable 5.1 watermarks all your text output and most code as having come from Anthropic.” The post drew 67,800 views and a follow-up that became the quote of the day: “fwiw, i find this incredibly dystopian.”

View this post on X →

What actually shipped

The watermark changes the source of randomness used to pick among candidate tokens. Anthropic’s explainer uses a Monopoly analogy: replace the dice with the digits of pi. Every roll still looks random, the game plays identically, but someone who knows the sequence can tell the dice are not fair. Nothing is added to the text: “It adds no tokens or hidden characters, carries no information about you or your organization, and needs no changes to your requests or responses.”

The scope is wider than the announcement suggested:

Every surface: API, Claude app, Claude Code, Claude Cowork, Claude Tag, and all three hyperscaler platforms. Anthropic applies it “at the model level,” so no product, plan, or API parameter turns it off.
Every region. Anthropic’s stated reason for the global scope is logistics, not philosophy: “we don’t yet have a durable way to scope it by region.” A US developer writing a private note gets the same marked text as a German publisher.
Files too, differently. Images and videos Claude produces through the code execution tool carry signed C2PA Content Credentials when retrieved through the Files API. Anthropic’s free Claude Content Checker verifies those credentials; there is no equivalent public tool for the text watermark.
Older models get marked “during a legal transition period,” per the help center. Anthropic has not published which models, when, or whether backfilled marks are detectable by the same detector.

September 1 also brought unrelated breaking changes worth knowing before you migrate: forced tool use (tool_choice set to any or tool) now returns a 400 because adaptive thinking is always on, thinking blocks are model-bound so earlier models cannot read Fable 5.1’s reasoning, and accounts created on or after August 31, 2026 cannot manually edit prior turns without invalidating later thinking blocks - an anti-distillation measure.

The model underneath the watermark

Fable 5.1 is a frontier release, not a compliance vehicle. Anthropic’s vendor-reported numbers: Terminal-Bench 4.0 at 55.8 percent (Mythos 5.1: 60.9 percent) against Fable 5’s 42.0, HLE 65.0 percent with tools, and CursorBench 3.2.0 at 73.4 percent, which Anthropic calls the most capable model it has run on that benchmark. Pricing holds at $10/$50 per million tokens, with cache reads cut 75 percent to $0.25 per million.

Artificial Analysis measured it as the strongest model they have tested: an Intelligence Index of 66 at max effort, ahead of Claude Opus 5 (63), Fable 5 (62), and GPT-5.6 Sol (61), with the highest HLE score they have recorded (59.1 percent) and the highest Terminal-Bench v2.1 result (91.4 percent). Their cost analysis cuts the other way: “Fable 5.1 (max) costs $3.76 per Intelligence Index task, 20% more than Fable 5 (max),” driven by roughly 1.7 times the output tokens - so the 75 percent cache cut is real, but the cost per task still went up. Output speed is about 60 tokens per second, slower than the frontier average.

One disclosure matters for anyone benchmarking agentic work: Anthropic says its safety interventions caused zero scores on some OSWorld and AutomationBench tasks, and Artificial Analysis observed roughly 4 percent of output tokens served via the fallback path to Opus models when the safety classifier intercepted dual-use requests.

Three weeks of backlash, then launch

The launch is the second act. The first was August 11, when Anthropic announced it would watermark text to comply with the EU AI Act’s transparency code, and the pushback ran for three weeks before a single watermarked model shipped.

TechCrunch reported users angry that the watermark would catch them using Claude “at their jobs, classes.” Business Insider followed with users canceling subscriptions over the watermark specifically. On r/ClaudeAI, the FAQ announcement thread produced reactions from “a big ol’ ‘yikes’” to users calling the mark “a scarlet letter” for professional work, alongside users who pointed out that Gemini’s SynthID had shipped to far less controversy.

The sharpest criticism came from John Gruber at Daring Fireball, whose piece titled Anthropic’s system “a perversion of writing.” His two load-bearing lines: “My error was believing Anthropic that their system wouldn’t adulterate and corrupt the semantics,” and “The idea that anything other than my needs should factor into the generation of text for me is patently offensive.” Gruber’s technical premise - that no two synonyms carry exactly the same meaning, so nudging word choice for a watermark is not semantically free - is also the premise of the distortion-free watermarking literature, which Anthropic’s design does not implement. Gruber also flagged the geo-scope claim: a company near a reported $2 trillion IPO valuation saying it cannot restrict a watermark to Europe, while the mark rides along in private conversations no third party will ever read.

Scott Aaronson, who designed the scheme lineage Anthropic’s watermark descends from and built OpenAI’s shelved version, wrote about Anthropic’s rollout on August 31 - a notably more sympathetic take from the person with the most standing to criticize it.

From OpenAI shelving its watermark in 2024 to Anthropic shipping one in 2026: the marking timeline across labs and regulators. China’s rules are the only ones mandating a hidden label; the EU requires machine-readable marking; no US rule covers text.

How the mark works, and where it breaks

The technique is a version of Google DeepMind’s SynthID-Text, published in Nature in October 2024, tracing back to Scott Aaronson’s 2022 Gumbel-sampling proposal. The model splits candidate tokens using a pseudorandom function keyed to the preceding context and a secret held by the provider, then biases the choice among near-equivalent options. The detector, holding the key, checks whether the chosen tokens align with the expected pattern more than chance would allow.

Persistence, in Anthropic’s own words: “Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will.” The mark “will travel with the text when it’s copied and pasted elsewhere, and may persist through some editing.” Translation does not remove it, because Claude picks every word in the translation too.

Three documented weaknesses:

Short text. Detection “doesn’t work well on small samples.” Google’s published SynthID-Text figures are true-positive rates of roughly 67-75 percent at a 1 percent false-positive rate around 200 tokens, degrading steeply below that. An independent test of the open-source SynthID implementation found a blind 4B-parameter paraphraser drove detection down to the false-positive floor.
Factual, constrained text. Anthropic’s own example: after “Principia,” only “Mathematica” follows correctly, so “the watermark would have nothing to act on.” Legal boilerplate, API references, and spec-conformant text are low-entropy by nature.
Paraphrase. The DIPPER paraphrasing model drops watermark detection from roughly 90 percent true-positive rate to 12.5-37 percent in the published literature. Anthropic’s 2023 public comment to the US NTIA made the same point more bluntly: watermarking “would be fairly easy to defeat by malicious actors.” That comment is still on Anthropic’s own site.

Anthropic says its internal testing found no impact on “meaning, quality, or readability.” No sample sizes, metrics, or model versions accompany that claim, and no Anthropic-authored paper on the watermark’s detection statistics exists. The published detection numbers all trace to Google’s A/B testing on Gemma and Mistral models, not Claude.

The code question: can you even watermark code?

Schroeder’s post said “most code,” and that overstates it. Anthropic’s explainer is more precise: code “has generally less watermarking than some other forms of text,” because code “in very many cases has to be exact,” and where exactness is required the watermark is not applied. Arbitrary choices - comments, naming among near-equivalent options - can still carry the mark, but Anthropic concedes it will have “a negligible effect on the actual code produced.”

The research says the surviving trace is fragile. A University of Illinois study (arXiv:2403.17983) tested token-level watermarks on generated code and found semantic-preserving transformations strip them almost completely: dead-code insertion drove detection from a 0.72 true-positive rate to 0.03, and a handful of AST-level edits - variable renames, wrapping a block in a try-catch - took it to 0.01. Newer schemes built for code (SWEET, STONE, ACW) do better on renaming attacks, and an information-theoretic result published in 2026 concludes no post-hoc syntactic watermark survives a full rewrite by another model.

What that means in practice:

Shipped software keeps nothing. The mark lives in source tokens, not program semantics. Compiled bytecode contains no watermark, and classical binary watermarking is a separate technology no LLM vendor applies.
Refactored source loses it. Variable renames and dead-code insertion are the cheapest edits in any editor, and they reduce detectable signal to near zero.
“Clean this up in my style” is an eraser. Asking a different model to rewrite code is precisely the paraphrase attack the literature measures, and it works even better on code than on written text.
Git history carries nothing. The mark is not in commit metadata. Any commit that rewrites a file through a non-Claude model destroys whatever trace existed.
Nobody but Anthropic can check anyway. John Wang’s audit of 7.2 million characters of Claude output found no hidden Unicode or whitespace characters. Detection requires the provider’s key, so “watermarked code” is unverifiable by any third party today - a maintainer merging a pull request has no tool that could tell.

The New Stack called the code path “a blind spot developers can’t ignore,” and the direction of the blind spot is the interesting part: written text carries a detectable mark, while the artifact developers actually ship can be effectively untraceable.

Token-level watermarks on generated code under semantic-preserving edits, from the UIUC robustness study: dead-code insertion drops detection from 0.72 to 0.03 true-positive rate, and a few AST edits take it to 0.01.

Who can actually check, and what a check would prove

The detection API’s gating is narrower than the rollout coverage suggested. TNW had reported the tool would be broadly available; the shipped private preview limits it to EU-law-obligated organizations and the listed civil-society categories. Thresholds, return format, and false-positive calibration are undisclosed. Anthropic says access “will expand over time.”

What detection would prove is limited even for the people holding the key. Anthropic’s help center is explicit on both edges: detection “cannot distinguish ‘Claude wrote this’ from ‘Claude heavily edited this,’” and the absence of a mark proves nothing, because editing, translation through another model, or low-entropy text all remove or suppress it. Presence confirms Claude processed the text; it does not establish authorship.

That gap between what the mark can prove and what institutions want it to prove is where the false-positive literature lives. The original Kirchenbauer watermark paper reported roughly 50 percent false-positive rates on essays by non-native English speakers at stricter thresholds - a result documented in the paper’s own footnote and in the ensuing controversy over the study’s sample. Stanford’s monitoring study found detectors flag non-native writers’ exam essays at far higher rates than native writing, because lower-perplexity text sits closer to the model distribution the green-list scheme acts on. Google’s production SynthID-Text numbers - true-positive rates of 67-75 percent at 1 percent false-positive on 200-token samples - are the best case, measured on models Anthropic does not use, with no published Claude-equivalent. Anthropic has disclosed no false-positive rate at all.

Turnitin’s AI detector is the cautionary arithmetic: a sub-1 percent false-positive claim over 200 million papers still implies thousands of wrongly flagged students, and Vanderbilt, Michigan State, and Western Washington disabled the feature. Educational organizations are in the detection API’s approved list, which makes that arithmetic newly relevant.

Why now: the regulatory map nobody voted on

Anthropic’s stated rationale is one sentence: “We’re implementing watermarking to comply with the EU AI Act.” The company signed the EU’s Code of Practice on Transparency of AI-Generated Content in July 2026, alongside OpenAI, Google, Meta, Microsoft, and Mistral - roughly 190 signatories in total. Article 50’s obligations took effect August 2, 2026, requiring generative systems to mark outputs “in a machine-readable format and detectable as artificially generated.”

The part worth noticing: for text, the Code of Practice treats watermarking as mainly an image, video, and audio instrument, and allows fingerprinting or logging as the text fallback. Anthropic’s text watermark exceeds what the instrument it signed asks for. No US jurisdiction requires text watermarking - California’s SB 942, in force since January 2026, mandates detection tools and latent signals for image, audio, and video but excludes text. China’s GB 45438-2025 rules, live since September 2025, are the only regime mandating a hidden identifier, and theirs is metadata in file headers, not a statistical mark in the token stream.

The industry split is as informative as the rules. OpenAI built a watermark it measured at 99.9 percent effectiveness and shelved it after an internal survey found nearly 30 percent of loyal users would use ChatGPT less if rivals didn’t match - an internal note obtained by The Verge read: “Our ability to defend our lack of text watermarking is weak now that we know it doesn’t degrade outputs.” Google ships SynthID-Text in Gemini by default, 1.5 billion-plus responses watermarked, with its detector portal still on a waitlist. Meta, Mistral, and DeepSeek ship open weights, where self-hosters control the sampler and no provider-side mark can exist. xAI did not sign the code. Anthropic is the first major lab to make the mark unavoidable.

What each regime requires for generated text: the EU demands machine-readable marking, China mandates a hidden identifier in metadata, California covers media but not text, and no US federal rule exists. Anthropic’s text watermark exceeds every requirement that applies to it.

What it means if you build on Claude

The watermark does not change ownership. Anthropic’s help center addresses the question directly: it “doesn’t say anything about ownership or authorship, and doesn’t change a user’s rights under our terms.” Commercial terms still assign outputs to the customer. A watermarked deliverable is still your deliverable.

The new exposure is evidentiary. The Artificial Lawyer flagged that detectable AI fingerprints “could matter where contracts ban AI use or during fee negotiations” - not because the watermark proves who wrote what, but because a discovery request for a provider’s detection result is now a plausible litigation step, and the mark’s presence or absence becomes discoverable evidence about process. Legal commentary has been consistent on the limits: the provider’s mark does not discharge a deployer’s own disclosure duties, and an invisible watermark is not a substitute for visible disclosure or documented human review under Article 50.

For the local-AI reader, the structural point is the old one: an open-weight model running on hardware you control has no provider-side sampler to bias, so no provider can mark its output. That is not a compliance strategy - Article 50 obligations follow deployment into the EU regardless of whose model ran - but it is the reason the open-weight ecosystem and the watermarking frontier are pulling apart. The models you cannot self-host are now the ones that mark your text; the models you can, don’t.

Open questions

No published false-positive rate. Anthropic ships a detection API without disclosing its calibration. SynthID-Text’s published figures come from other models. When Anthropic publishes Claude’s numbers, this piece will cite them.
No third-party verification. Every detection claim, positive or negative, is unverifiable without Anthropic’s key. Independent evaluation of the detector’s false positives on non-native text cannot happen until access expands.
The backfill question. Which pre-August models get marked, when, and whether the marks are detector-compatible with the launch scheme is unpublished.
The geo-scope claim. Anthropic says it cannot scope the watermark by region “durably.” Whether that survives contact with the EU’s own data-localization expectations - or with a regulator asking why the mark is in private conversations - is untested.
Detection scope. The approved-user list starts with EU-obligated institutions. The help center says it will expand; the criteria for expansion are not stated.
The code gap. Anthropic ships a provenance story with a documented hole exactly where its developer customers operate. Whether enterprise buyers treat that as a feature or a defect will show up in procurement language within the year.

This article is not legal advice. Provider terms, help-center text, and regulatory obligations are quoted as published on the dates given; all of them change without notice. Read the current documents and talk to counsel before relying on anything here.

Sources

Primary documents: Anthropic: Fable 5.1 and Mythos 5.1 launch · Platform docs: What’s new in Claude Fable 5.1 · Help Center: How Claude marks AI-generated content · Anthropic: How Claude’s text watermark works · Anthropic 2023 NTIA comment on watermark fragility · EU Code of Practice on Transparency of AI-Generated Content · EU AI Act Article 50 FAQ · China GB 45438-2025 labeling standard · California SB 942.

Research and benchmarks: SynthID-Text, Dathathri et al., Nature 2024 · Kirchenbauer et al., A Watermark for Large Language Models · UIUC: Is the Watermarking of LLM-Generated Code Robust? · DIPPER paraphrase evasion, Krishna et al. · Stanford: Monitoring AI-modified Content at Scale, Liang et al. · SynthID-Text open-source implementation · Independent SynthID testing, xlr8harder · Artificial Analysis: Claude Fable 5.1 · John Wang: 7.2M character audit of Claude output · Scott Aaronson on Anthropic’s watermark.

Coverage and reaction: TechCrunch, Aug 11: Anthropic will watermark text · TechCrunch, Aug 12: users object · Business Insider: subscription cancellations · Daring Fireball: a perversion of writing · The New Stack: the developer blind spot · TNW: detection API private preview · The Decoder: detection access opens · The Verge, 2024: OpenAI shelved its watermark · Nature news: researchers remain sceptical · Artificial Lawyer: legal-sector impact · Voice of the Law: discovery risk.

Anthropic ships a text watermark on its newest models, and code mostly escapes it