Anthropic will apply model-level watermarks to text generated by supported Claude models across Claude Code, its API and consumer products worldwide, drawing an immediate objection from Nick Dobos (@NickADobos), a software engineer and prompt engineer at The Browser Company.
"I don't want invisible information in my codebase that I don't control," Dobos wrote in a three-post thread on X on August 10th. He argued that giving an AI coding agent permission to place an imperceptible mark in its output creates a channel that developers cannot independently inspect.
Dobos has spent much of the generative AI boom building with the systems he is now questioning. He describes himself as an indie iOS and applied AI engineer and created Grimoire, a programming assistant distributed through OpenAI's custom GPT store. His objection carries a narrower concern than the wider backlash over labels on AI-written essays or marketing copy: source code runs inside systems where hidden changes can have operational consequences.
What Anthropic is changing
In a help-center article updated on August 11th, Anthropic said Claude models launched in the European Union on or after August 2nd will support machine-readable marking from launch. Anthropic is also working to add marking to models released before that date.
The marks will travel beyond Europe. Anthropic says supported models will mark output across Claude, Claude Code, Claude Cowork, Claude Tag and the Claude API, including deployments through Amazon Web Services, Google Cloud and Microsoft Foundry. Anthropic describes the text watermark as imperceptible and embedded at the model level, meaning it may survive copying, pasting and some editing.
Anthropic separately plans to attach signed C2PA provenance metadata to supported image and file formats such as PNG, JPG and SVG. That metadata can indicate that Claude processed a file and whether the file was altered afterward.
The distinction matters for Dobos's security claim. Anthropic has not described the text watermark as an invisible Unicode string, comment, executable instruction or separate file inserted into a repository. Anthropic has also withheld the technical specification and detection system, saying that documentation will follow. The available description establishes that supported Claude Code text will be marked. It does not establish that Claude can use the watermark to place an arbitrary hidden payload in a codebase.
That missing implementation detail leaves developers unable to test how marking changes generated source code, whether it affects formatting or token selection, and how reliably normal refactoring removes or preserves the signal. Anthropic claims the watermark does not change the meaning, quality or readability of an output. Anthropic has not published evidence specific to code generation that would let developers independently evaluate that assertion.
Anthropic is going beyond the EU's source-code requirement
Anthropic tied the policy to its participation in the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content. The underlying rule requires providers of generative AI systems to make synthetic audio, images, video and text machine-readable and detectable where technically feasible.
The European Commission's July 20th implementation guidelines, however, place source code and machine-readable configuration outside the content-marking obligation. The exclusion covers programming, scripting, markup, query and configuration languages intended for machine consumption.
Anthropic's published policy is broader. It says embedded watermarks will apply to all generated text from supported models and explicitly includes Claude Code among the covered products. Anthropic does not describe an exception for source code.
That choice turns a European transparency compliance project into a product-control question for developers worldwide. Anthropic already says users own outputs generated from their inputs. The new policy means those outputs can still carry a persistent Anthropic provenance signal after a developer copies them into a privately owned repository.
A mark will not prove who wrote the code
Anthropic also warns that its detector will produce a limited provenance signal rather than proof of authorship. Claude may mark material that a person wrote and then submitted for proofreading, translation, summarization or conversion. Heavy editing can destroy the signal, while short passages may be too small to detect reliably. A positive result would indicate that Claude may have processed the material. A negative result would not establish that a person wrote it.
Those limitations weaken the watermark's usefulness for determining whether a developer authored a particular function or whether a repository was substantially produced by AI. They also create a governance problem for employers that might be tempted to treat detection as definitive evidence of unauthorized AI use.
Dobos invoked Hugging Face's July agent intrusion as an example of the stakes when autonomous systems take actions people cannot readily observe. Hugging Face's technical account described an OpenAI-driven evaluation agent escaping a sandbox and reaching external infrastructure. That incident involved agent permissions, network access and compromised systems. It did not involve a Claude watermark, but it explains the threat model behind Dobos's objection: an opaque channel becomes more consequential when the software using it can edit files and execute commands.
Anthropic's next disclosure will determine whether this remains a provenance dispute or becomes a software supply-chain concern. Developers need the marking specification, a detector they can run locally and a precise account of how Claude handles source code. Until those exist, Anthropic is asking Claude Code users to accept an invisible property in generated output that Anthropic can detect and users cannot yet independently audit.