Invisible Watermark · Anthropic · C2PA · 2026
Anthropic announced Claude will mark everything it generates. I didn't stop at the press release: I opened the terminal and put that mark to the test with one of the most common operations in the world. I didn't hack anything — and it still disappeared.
The verdict
This week Anthropic announced Claude will mark everything it generates, so you can tell if something came from an AI — part of its response to Article 50 of the EU AI Act. The signature they use is cryptographic and solid. But it travels embedded inside the file, which means it can be lost when the file gets transformed. I'm not saying it — Anthropic itself says it, in its own documentation.
It's not a product whim. Since August 2, 2026, Article 50 of the EU AI Act requires providers to include machine-readable mechanisms that allow detection of AI-generated or manipulated content.
AI Act, Article 50 → obligation since Aug 2, 2026
Anthropic → announces C2PA (images) + statistical mark (text)
Coverage → Claude, Claude API, Claude Code, Claude Cowork, Claude Tag
and models served via AWS, Google Cloud and Microsoft FoundryUnder the same name "invisible watermark" there are different technologies, with different guarantees.
A cryptographic manifest embedded in the image: who created it, with what tool, what happened to it afterward. The signature itself is tamper-proof — you can't edit the manifest without validation noticing.
An invisible signal woven into the image itself, designed to survive a resize, recompression, or even a screenshot. It doesn't live in the metadata — it lives in the content.
Every time Claude writes something for you, a statistical bias in the words it chooses gets marked. Invisible to you, measurable only with the right key — and it breaks if you paraphrase, translate, or rewrite the text.
No theory. I generated images in Claude and in ChatGPT, and audited them with the same tools you can use.
Step 1 · Audit
The ChatGPT image carries a valid C2PA manifest: who created it, with what tool, cryptographic signature. The Claude one (across the 3 available models) carries no manifest — consistent with Anthropic just now starting to add it to models released after August 2.
Step 2 · Transform
With ImageMagick, the most common operation in the world: resizing the ChatGPT image. No cryptography broken, nothing hacked — just a resize.
Step 3 · Verify again
c2patool on the resized file responds: "No claim found." The manifest disappeared. The signature itself is still perfect — I didn't attack it, didn't break it. There's simply no signature left to check, because the manifest lives embedded in the file and it's the first thing to fall off when that file passes through the real world: a format conversion, a screenshot, or re-saving it. And I'm not saying it — Anthropic itself warns, in the fine print, that these operations can remove the metadata.
Someone already asked this question before. Since May 2026, OpenAI has combined C2PA with SynthID — Google DeepMind's own watermark.
Same image, after the same resize:
C2PA (embedded metadata) → "No claim found" ❌
SynthID (signal in the pixels) → detected on OpenAI Verify ✅I verified the resized image on OpenAI Verify: the C2PA was dead, but the tool still confirmed "generated using OpenAI tools" — the SynthID signal was still there. Neither OpenAI nor Google claims it's indestructible; they say it holds up much better. That's the difference between having one layer and having two — and it's exactly the second layer that, per Anthropic's documentation today, Claude doesn't have yet.
Next time someone asks you "did an AI make this?", don't just take their word for it — open the terminal and verify.
Reads the C2PA manifest of a file and tells you if there's signed provenance. Open source, from the Content Authenticity Initiative.
Looks at the file's metadata: who made it, with what software, when.
The verifier that detects SynthID in the pixel layer, even after the C2PA has already been stripped.
The C2PA verifier from the Content Authenticity Initiative, for auditing any file.
Once Claude finishes rolling out its file watermark, it will work: you'll be able to prove something was generated by Claude. Until that file goes through a resize, a screenshot, or a format change.
The thesis
A verifiable chain while the file stays intact — it does that very well. The uncomfortable lesson is different: verifiable provenance is not the same as permanent provenance. And a law that requires you to mark content doesn't help much if that mark falls off with the most common operation in the world. The right question isn't "can it be erased?" — it's how you prove something was made by an AI when files change thousands of times a day.
The official sources cited in the video.
Anthropic · 2026
The official support article: what mechanisms Claude uses for images (C2PA) and text, and its stated limitations.
OpenAI · 2026
How OpenAI combines C2PA with SynthID so provenance survives even when the manifest is stripped.
Google DeepMind · 2026
Google's own watermark: invisible in pixels and text, designed to resist common transformations.
Content Authenticity Initiative · 2026
The open source tool to read and audit C2PA manifests from the terminal.
Context on the models and the discipline behind this analysis.
The same 3 models tested in this video (Fable 5, Sonnet 5, Opus 5) — all released before August 2, the date Anthropic starts marking content.
The discipline of building the environment and controls around the model — provenance and watermarking are, at bottom, part of that same harness.
The essentials on Claude's invisible watermark.
It's an open content provenance standard: when a tool creates or edits a file, it attaches a small cryptographically signed manifest telling its story — who created it, with what program, and what was done to it afterward. Cameras, Adobe, OpenAI use it, and now Anthropic is joining in. The signature itself is solid: you can't modify the manifest without validation catching it.
Because the current implementation embeds the C2PA manifest inside the file itself, and that manifest travels attached to the file's exact bytes. Normal real-world operations — a simple resize, re-saving the file, or a screenshot — rewrite those bytes, and the manifest falls off. It's not a hack or a security flaw: Anthropic itself acknowledges this as a known limitation of the standard in its own documentation.
In the image flows tested in this video — Claude.ai, with the three available Claude 5 models (Fable 5, Sonnet 5, and Opus 5) — no C2PA manifest was detected. But that doesn't prove the mark "fails": all three models shipped before August 2, 2026, the date Anthropic starts adding C2PA to its models. It's more likely that marking simply isn't implemented yet on that surface than a real failure.
SynthID is Google DeepMind's own watermark: an invisible signal woven into the image's pixels themselves (or into text), not into the file's metadata. Unlike C2PA, it's designed to survive common transformations like a resize, recompression, or a screenshot. OpenAI has combined both layers since May 2026 — if the C2PA falls off, SynthID is still detectable.
With three free tools: c2patool to read the C2PA manifest from the terminal, exiftool to check the file's general metadata, and OpenAI's verifier (openai.com/verify) to detect SynthID in the pixel layer, even when every other signal has already fallen off.
Since August 2, 2026, it requires AI system providers to include machine-readable mechanisms that allow detection of AI-generated or manipulated content. It's the reason behind Anthropic's announcement — and why Claude is going to mark both images (C2PA) and text (a statistical mark in the words it chooses).
Not easily. The mark in text isn't a hidden character you can search for — it's a statistical bias in the words the model chooses, measurable only with the right key. An open implementation of this kind of watermarking exists, but it isn't one-click — Google's public detector doesn't accept pasted text directly, and Anthropic's hasn't shipped yet. On top of that, paraphrasing, translating, or rewriting the text breaks the mark.
Community
If you want to keep learning how to build, understand and audit AI systems — not just talk about them. Free access to the community; full courses live in the Premium tier.
Join Agentic Engineers →YouTube channel
@NicolasNeiraGarcia
ADK · A2A · Claude Code · Automation · Infrastructure