Since August 2, 2026, Claude embeds a statistical watermark in its text output, and Anthropic's coverage list explicitly includes Claude Code. That fact generated two very different reactions in developer communities: a panic about Anthropic somehow claiming ownership of generated code, and a quieter, more legitimate question about provenance fingerprints sitting in a codebase.
The first concern is unfounded. The second is real but smaller than it sounds. Both are worth working through properly, because the mechanism has specific properties that make code a genuinely bad host for this kind of watermark.
Table of Contents
- Does Claude's watermark apply to code?
- Does this mean Anthropic can prove I used Claude to write this function?
- Will my formatter or linter break the watermark anyway?
- What's the actual risk here?
- If you want a clean pass on Claude-assisted comments or docs
- This is not the same thing as the C2PA file signature
- The practical takeaway
1. Does Claude's watermark apply to code?
Yes. Claude Code output falls under the same watermarking as everything else Claude generates, since it's applied at the model level rather than per-product. But code is a poor carrier for it, and the signal there is substantially weaker than in prose.
The reason is entropy. The watermark works by biasing the model's choice at points where multiple next-tokens are roughly equally good, then accumulating those biased choices into a statistical pattern. That mechanism needs choices to exist. Prose offers many near-equivalent phrasings at every step. Code does not: identifiers have to match their declarations, syntax is rigid, and swapping a token usually breaks something rather than producing an equally valid alternative.
There's public measurement supporting this, though with a caveat worth stating clearly. An open research repo measuring watermark strength across domains found that z-score and entropy move together almost exactly, with a z ratio of roughly 0.45x for code against prose at matched sample length, tracking an entropy ratio of 0.46x. In one run, 3 of 8 code samples fell to or below the detection threshold with no attack applied at all. The tightest sample, a bare algorithm at around 0.2 bits per token, scored 1.7 against a 2.33 threshold, which is a miss on clean, unmodified output.
The caveat: those measurements were run on open-weight models, not Claude. They demonstrate the mechanism's behavior, not Claude's specific numbers. Anthropic has not published a false-positive rate for code, and reasoning from the published mechanism is not the same as confirmed behavior.
One detail from that same research is worth flagging because it's counterintuitive. With extended thinking disabled, a model's pure code output scored z = 4.31 unattacked, barely above threshold. With thinking enabled, the same model in the same domain at the same length reached z = 25.53. The reasoning preamble is ordinary prose, and it carries the mark normally. The watermark isn't really in the code. It's in the text around the code.
That holds for everything Claude Code emits that isn't a diff: plan summaries, commit messages, PR descriptions, and chat explanations are all prose and should mark like any other prose.
2. Does this mean Anthropic can prove I used Claude to write this function?
No. The watermark has the same core limitation in code that it has in prose, and the low signal in code makes it worse rather than better.
Anthropic states directly that the watermark cannot distinguish a case where Claude wrote something from one where Claude heavily edited it. It marks involvement, not authorship. It also carries no identifying information: nothing in the watermark or its key can be traced back to a user, an organization, or a conversation.
Anthropic is equally explicit that the watermark speaks to neither ownership nor authorship, and doesn't change your rights under its terms. Whatever you generate with Claude is yours on exactly the same basis it was before August.
Add the entropy problem and the reliability question gets worse in both directions. A weak signal means more false negatives, because genuinely Claude-generated code can fall below threshold on its own. It also means any threshold tuned for prose is miscalibrated for code, which pushes toward false positives if someone applies a single confidence cutoff across domains without adjusting.
Anthropic's own announcement floated checking whether a PR was generated by Claude Code as a use case. That suggestion is doing more work than the mechanism supports. The PR description is prose and marks well. The diff is low-entropy code where there's little room to encode a signal. Screening contributions this way, before anyone publishes a false-positive rate on code specifically, would be building policy on the weakest application of the technology rather than the strongest.
3. Will my formatter or linter break the watermark anyway?
Probably, in many cases, though this is genuinely unresolved rather than confirmed. The reasoning is straightforward: the watermark lives in exact token sequences, and the entire purpose of a formatter is to rewrite token sequences to a canonical form.
What a normal dev workflow does to whatever signal survived generation:
Formatters rewrite whitespace, line breaks, quote style, and trailing commas. explainx.ai's analysis describes a single Prettier pass as close to an adversarial attack on a token-level watermark, which is a fair characterization given that the tool's job is normalizing exactly the variation the watermark depends on.
Linters and auto-fixers standardize naming conventions and quote characters, which touches the identifier tokens that carry what little entropy code offers.
Refactoring tools replace identifiers in bulk, which is the most destructive of the three for a pattern built on specific token choices in sequence.
Code review rewrites chunks of the diff outright, and those rewritten sections contribute nothing to detection afterward.
Stack those in the normal order, generate, format on save, lint in CI, address review comments, and there's little reason to expect a clean signal at the end. But nobody has published measurements on Claude output specifically through a real toolchain, so treat this as a well-reasoned expectation rather than a settled result. If it matters to a decision you're making, that gap is the thing to note, not paper over.
Worth noting the asymmetry this creates. Your commit messages, PR bodies, and README changes go through no such pipeline. They're prose, they don't get formatted, and they carry the mark fully.
4. What's the actual risk here?
The risk is a provenance fingerprint persisting in your codebase without any organizational policy for what it means. It is not Anthropic claiming your code, and it's worth dismissing that version directly.
The panic version says something like: Anthropic has marked my repo, they can identify me, they have a claim on my work. Every part of that is wrong. The watermark contains no identifying information, doesn't establish authorship, doesn't affect ownership, and the detection API is currently in private preview limited to organizations with legal obligations under EU law. Your employer cannot currently check your commits, and neither can anyone else outside that group.
The real version is more mundane and worth actually planning for. Detection access is expanding over time. At some point, a signal may be checkable across parts of a codebase, and organizations that have never articulated a position on AI-assisted code will be asked to have one reactively, under whatever circumstances prompted the question.
Concretely, the questions worth answering before someone else asks them:
Is AI-assisted code acceptable in this repo, and where? Most teams have an implicit answer and no written one. The implicit answer stops working the moment a specific case is disputed.
Does the answer change by context? Prototypes versus production, internal tools versus client deliverables, your own repos versus code contributed upstream. These plausibly have different answers, and writing them down is cheap.
What do your client contracts actually say? This is the one that bites agencies and contractors. If a contract has an AI clause, a provenance signal in delivered code becomes a contractual question rather than a technical one.
What's your position on contributions? If you maintain an open-source project, decide whether AI-assisted PRs are welcome and say so in CONTRIBUTING.md. Don't leave it to be litigated in a thread.
None of these are new questions. The watermark just removes the ability to keep deferring them.
5. If you want a clean pass on Claude-assisted comments or docs
Walter Writes handles the prose parts of a repo: READMEs, docstrings, code comments, and documentation. It rewrites text, which means the watermark doesn't survive as a byproduct of the rewrite, not because it targets the watermark.
Being precise about scope, since this matters for a developer audience: this applies to prose only. It does nothing to code logic, syntax, or structure, and you should not run it over source files expecting it to. The prose in a repo is where the watermark actually lives anyway, per section 1, so that's also where a rewrite has any effect.
The practical case for it is less about watermarks than about the same thing that motivates rewriting AI-drafted docs generally: generated documentation tends toward a recognizable register, and a rewrite that keeps your technical terms intact while varying the phrasing produces docs that read like your project rather than like any project. If your team has a documentation voice, that's worth preserving.
6. This is not the same thing as the C2PA file signature
Claude applies two different provenance mechanisms, and conflating them causes confusion. The text watermark is statistical and lives inside the word sequence. C2PA content credentials are cryptographic metadata attached to files, using the same open standard camera manufacturers use.
The survivability difference is the practical one. A text watermark survives copy-paste, because copying the text copies the pattern. C2PA metadata is attached rather than embedded, so re-saving, converting, or running a file through a pipeline that strips metadata removes it cleanly. Different mechanism, different failure mode, different implications for anything in your build process.
7. The practical takeaway
Use Claude for the draft, run a rewrite pass on the prose before it ships. That applies to documentation, READMEs, and comments, and it's a claim about text, not about code logic.
On the code itself, the honest summary is that this is a weaker signal than either the announcement or the reaction suggested. Code is low entropy, the mark barely attaches, and standard tooling degrades whatever did. The part of your repo that genuinely carries a watermark is the prose, and that's the part worth thinking about.
The useful move right now is not technical. It's writing down where your team stands on AI-assisted code before the question arrives with a specific case attached to it.
Top comments (0)