AI Insiders reported yesterday that Anthropic will watermark every response Claude generates from models shipped after August 2, and that the company has not named a public detector anyone outside Anthropic can run to check for the mark. That omission is worth examining on its own terms, because text is a much harder medium to watermark than the images and documents Anthropic also plans to mark. A new post on Daniel Miessler’s blog, written by developer Kai Magnus, maps out exactly where a signal can hide inside prose and why Anthropic’s silence might reflect a real technical constraint rather than simple secrecy.

For files and images, Anthropic uses the C2PA standard, a signed manifest bolted onto the file itself. That signature vanishes the instant a viewer takes a screenshot or exports the file into a different format, since the redundancy carrying the signal sits outside whatever pixels or bytes a reader ends up looking at. Text does not have that luxury. A block of prose offers only its own sequence of word choices as a place to hide anything, not millions of spare pixels.

Miessler had argued publicly that plain ASCII text has no room for a hidden signal at all. Uniform spacing and standard characters, he wrote, leave no place to encode anything. Magnus tested that claim directly, running a script over Claude’s output that checked every character’s code point. He found ordinary printable ASCII throughout, no zero-width characters and no irregular spacing, which rules out the two most obvious hiding places: invisible encoding tricks and formatting quirks like line wrapping. Both disappear the instant text is normalized back to plain ASCII.

What Magnus argues survives that normalization is a third layer, word choice itself. A model given a secret key can lean slightly toward certain words at each step without changing what the sentence says. Anyone holding that key can measure the statistical lean across a long enough passage. This is not a new idea. Two publicly documented implementations already exist: Kirchenbauer’s approach, which biases the model toward a preset list of favored words, and the tournament-style sampling Google deploys inside Gemini. The mechanism Magnus describes is established elsewhere in the field, even though Anthropic has not confirmed it uses anything similar.

That confirmation is exactly what is missing. Anthropic has not said which of these layers its watermark uses, what algorithm drives it, or how strong the signal is. Magnus is explicit that everything past the ASCII test is inference. He treats word choice as only one possibility, and raises a deeper one: a mechanism encoded in meaning itself that could survive a light paraphrase. He also allows that the real method could be something nobody has published at all. He presents both of those deeper possibilities as speculation, not as anything he or anyone outside Anthropic has verified.

The post also lays out how each layer gets defeated. A deterministic pass that rewrites text into normalized, pure ASCII strips anything hidden in encoding or formatting. A full paraphrase, done word by word, erodes the statistical lean a word-choice watermark depends on. Running an AI model to do that paraphrase does not erase a mark, according to Magnus. It swaps Claude’s signal for whatever watermark the rewriting model carries instead.

The piece closes on a limit that matters more than the mechanism itself. A detected watermark shows only that Claude processed the text at some stage, not that Claude wrote it or how much of the final draft is the model’s own words. The absence of a mark is equally uninformative: brief snippets, prose that has been reworked, and text drawn from an earlier model generation can all pass through undetected.

Anyone building a compliance process around Claude’s watermark should treat a clean detection result as inconclusive rather than as proof of human authorship. Until Anthropic publishes a detector that can be checked independently, no product built to police AI-generated text with this mark can be verified from outside the company.

This account is based on an analysis published on Daniel Miessler’s blog on August 11, 2026, written by Kai Magnus.