Anthropic has just made the first concrete compliance move by a major AI lab under the EU AI Act — and a prominent developer says it is built on an unsolvable engineering problem. Starting August 2, 2026, every Claude model launched in the EU will embed invisible watermarks in all generated text, including code, at the model level, with signed C2PA provenance metadata attached to generated files. That means the marks appear whether the text comes from the API, the Claude app, Claude Code, or enterprise clouds. But according to Theo, the developer behind the T3 stack, speaking on Theo – t3.gg, the plan is “a very scary change and I have a feeling it’s not going to do what is intended.”
Anthropic got there first, but the fine print already concedes a lot
The EU’s transparency machinery turns on Article 50 of the AI Act and the Code of Practice drawn up by independent experts. Providers must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Anthropic’s response is the most detailed plan any lab has published so far.
Obligation under Article 50 / Code of PracticeAnthropic’s stated implementationTimingMachine-readable marking of AI outputsWatermark embedded in all Claude-generated text, including code, at model levelClaude models launched in the EU on or after Aug 2, 2026Marks present across product surfacesModel-level embedding covers API, Claude platform, Claude Code, Claude Cowork, and Claude TagAt launchVerifiable markingSigned C2PA provenance metadata on generated files, plus a planned text detection APIDetails promised in forthcoming documentationCoverage of existing modelsLegacy models will also receive markingNot specified
Anthropic’s own published limitations read like a confession. A detected mark does not establish authorship, because Claude is routinely used to proofread, translate, summarize, or convert human work. Heavy editing, paraphrasing, translation, or mixing with other writing breaks the mark. Short passages carry no reliable signal. Converted, re-saved, or screenshotted files lose their metadata. The company also acknowledges that the absence of a detectable mark does not mean content is human-made.
There are carveouts too. AI performing an “assistive function for standard editing” — autocorrect, grammar cleanup, touch-ups that do not substantially alter the input — is exempt from the same marking burden. An LLM rewriting an essay from scratch is in scope; an LLM proofreading a human draft may not be. That boundary matters more than it appears, because it undermines the public’s intuitive question: does this mark mean AI wrote the text?
An image watermark lives in the gap between data and what humans see
To understand why text watermarking is so hard, Theo first shows why image watermarking is seductively easy — and why that ease is an illusion. His exhibit is a 623-kilobyte PNG of an AI-generated photo and a JPEG version that look identical while sharing not a single byte. The gap between what a file contains and what a human perceives is the entire playground for image watermarking, and it is exactly what compression destroys.
A watermarker can change one pixel’s RGB or HSL value by a single step every few pixels, encoding real data no human can see. But every compression scheme normalizes areas of similar color, flattening subtle variations to save bits. A pattern living in plus-or-minus-one-value pixel differences is precisely what gets flattened. Theo describes red teaming he has done against Google’s SynthID and similar overlays OpenAI applies to GPT image outputs.
BypassVisible changeWatermark outcomePNG to JPEG re-exportNonePattern flattened by compressionRoughly 1% sharpen filterNone at normal zoomEvery byte re-encoded, pattern goneBlur, then unblurSubtlePattern destroyedResize canvas up and downNoticeable only on deep zoomPattern blurred beyond detectionScreenshot or screen captureMinorMetadata and pattern lost
SynthID and its analogues apply identifying noise at roughly 0.1 to 1 percent opacity on top of the image — invisible to humans, but removable by any operation that re-encodes the file. The practical result is that platforms flag AI images only when users copy-paste them directly from a generator; any intermediate step defeats the tag.
Text has almost no gap to hide in
Text is the much harder problem, and Theo’s argument is that it may not be solvable at all. He frames it through an analysis by Sean Godc: “It’s basically a steganography problem concealing a secret code made more difficult because the plain text cannot be arbitrarily manipulated. Any changes you make to apply the watermark will compromise the quality of the output.”
The scale argument makes this vivid. Change one pixel in a four-pixel image and a human notices. Change one pixel in four million and no one does. Text sits at the wrong end of that spectrum.
“Unlike images, text is very compressed already. You cannot make any changes to a sentence that a human won’t notice with one exception which we’ll get to later,” Theo said.
That compressed space is where every watermarking technique lives. The most sophisticated production approach is SynthID-style token scoring. An LLM draws from a vocabulary of roughly 100,000 tokens at each generation step. Google’s SynthID text watermark biases sampling among the top five most likely tokens toward those with a hidden favorable score. Detection is cheap: aggregate the scores across a block of text and check whether they are suspiciously high. But the pattern is a statistical fingerprint, not a keyword list.
The cruder techniques hide bits in unicode space variants and homoglyphs — characters that render as spaces or as identical-looking letters. Detection is a trivial string scan. Theo cites two precedents: Vercel’s content editor, which hid row identifiers in unicode spaces inside paragraphs, and Godc’s report that Claude Code has used such spaces in the past to tag suspicious requests.
TechniqueEmbedding costDetection costPrimary weaknessSynthID-style token scoringBaked into samplingCheap aggregate scoreParaphrasing destroys itUnicode space variantsTrivialTrivial string scanNormalizing spaces removes itHomoglyphsTrivialTrivial string scanCanonicalization removes itFull model re-run verificationNone at generation timeVery expensive per checkFalse positives; cannot scale to free citizen checksNaive constraint, such as every fifth letter is EGeneration-time constraintCheapDegrades output to unusable
The false-positive problem is not academic. If verification means re-running a model and measuring how closely its predictions match a candidate text, then humans who naturally write like LLMs get flagged. “It’s way more likely for a human to accidentally write like Claude than it is for a human to accidentally reproduce a watermark,” Theo noted.
Against this backdrop, Theo states the central dilemma: “I just cannot fathom any method where you can watermark text that isn’t either incredibly expensive to detect or incredibly cheap to work around.”
The EU’s public detector becomes the attacker’s best tool
The Act does not just require watermarks. It requires labs to give every EU citizen free access to detection. Theo argues that this turns the detector into an oracle for attackers. Generate text, check it, tweak it, and re-check until the output comes back unmarked.
Paraphrase attacks are the simplest weapon. A SynthID-style watermark lives in subtle vocabulary choices. Rephrasing removes it. “If you have access to even a relatively weak unwatermarked LLM, you can strip out the SynthID watermarks by asking the LLM to paraphrase the text content,” Theo said. Hand-editing also works — at which point, he concedes, it is arguably no longer original AI content anyway.
The removal economy already exists. Theo points to a published open-source repository that ships an agent skill plus a Python script that strips multi-vendor AI provenance marks from text and files. It covers unicode text hygiene, statistical rewrite hooks, and C2PA metadata removal from PNG, JPEG, SVG, PDF, DOCX, HTML, and Markdown. The punchline: “you can literally ask Claude to remove the watermark from Claude’s outputs, which is hilarious.”
The structural problem is that the Act demands interoperability — publishing the marking scheme and standardizing across vendors — which directly contradicts the security-by-obscurity that text watermarking depends on. “You can’t be obscure in how you implement it to hide it, but also give all of these tools,” Theo said.
C2PA is the one direction that works — until plain text breaks it
One component survives Theo’s skepticism: C2PA, the Coalition for Content Provenance and Authenticity standard. C2PA content credentials attach cryptographically signed metadata recording how a file was produced and processed. The decisive property is asymmetry: you can strip the metadata, but you cannot forge it.
“The thing that makes C2PA strong isn’t that it’s flagging AI gen content. It’s that it provides standards to identify human generated content,” Theo said.
That reframes the entire game. A camera chip signing the photo it captures verifies known hardware and a known process. An AI-generated image carries a mark that any re-encode destroys. The durable endpoint is positive attestation of human origin, not negative detection of fakes.
But C2PA has a hole at its center. It only works on data formats that support metadata — images, video, audio, or containerized text. A plain-text string from a chat tool or agent cannot carry the signature. Theo flags the unresolved boundary: does Claude Code have to C2PA-sign every HTML or PDF file it generates? For the most common AI artifact of all, an unadorned text string, the standard has nothing to say.
What the watermark regime will actually catch
Theo scores the plausible goals against the technical reality.
GoalWill watermarking achieve it?Flag zero-effort copy-paste from ChatGPT or Claude, such as spam bots and lazy repliesYes — the one use case the mark survivesDeter high-school essay cheatingPartially, for students who copy without editingBlock AI-driven propaganda or coordinated deceptive campaigns by governmentsNo — serious actors will use open-weight models, paraphrase, or accept false negativesGive the public a reliable way to know whether a given text is AI-generatedNo — absence proves nothing; presence proves only that Claude touched the text
The last row cuts against public intuition. Claude frequently proofreads or summarizes human work, so a human-authored document can carry a Claude mark. Conversely, heavily edited or paraphrased AI text carries no mark. A mark is a signal, not a verdict.
“The harsh reality here is that this is only ever going to catch the lowest effort people. If you put any effort in or do even the most basic of grammatical pass or changes to the text that comes out, this will be trivial to break,” Theo said.
His forecast extends beyond Anthropic. Technical users will strip watermarks at will, and a flood of tools for non-technical users will do the same. Other AI labs will likely adopt similar watermarking and ship their own text detection APIs, making this an industry-wide compliance trend rather than an Anthropic-only move. But the core failure remains: any hidden pattern in text is either too expensive to detect or too cheap to remove, and the Act mandates cheap detection.
The deeper lesson is regulatory. The EU Act demands robustness, interoperability, and free public detection all at once. Robustness requires hidden design. Interoperability requires publishing the design. Free detection turns every citizen’s device into a testing oracle for bypasses. No scheme can satisfy all three. The honest boundary, as Anthropic’s own documentation admits, is that a watermark is weak evidence of model contact, not proof of AI authorship. What the public needs long term, Theo argues, is positive attestation for human content and education about what an “AI mark” can and cannot prove — because the current watermarking phase may simply pass, leaving the slop problem exactly where it started.