You Cannot Watermark a Deed

Four agents are working across your terminals. One finished ten minutes ago and left a tidy paragraph explaining what it did. You read the paragraph and skimmed the diff. You have been approving commands by reflex since lunch, because generation runs in parallel and attention does not.

Then comes news that sounds like help: Claude now watermarks its output. In August 2026 Anthropic published an explainer, "How Claude's text watermarking works", and keeps a Help Center article, "How Claude marks AI-generated content". If an agent's words carry a mark, perhaps the mark says something about what the agent did. It does not, and not because of any flaw in the watermark.

What Anthropic says the mark is

The watermark "changes the source of the randomness used to pick among words"; nothing is added to the text and there are no hidden characters. Anthropic says the mark "is a version of the SynthID-Text approach published by Google DeepMind in a Nature paper in 2024", and does not publish the details of its own variant.

The published design is Google DeepMind's (Dathathri et al., Nature 634:818-823, 2024). There, a secret key and a hash of the most recent tokens seed a pseudorandom score for each candidate word, and a multi-layer tournament among candidates favours the higher-scoring one. The paper says the method works better when the model's distribution has more entropy, and that watermarks are weakened by edits.

It applies on the surfaces Anthropic lists, Claude Code among them, for the models its Help Center table marked as supported on 28 October 2026. Several earlier models are not yet on that list. Anthropic has published no date for them and says it is rolling out to earlier models over the coming months.

Where Anthropic says the mark thins

"Where an exact output is required—where there isn't a choice, and something would be factually wrong or a piece of code would break if a different term was chosen—the watermark isn't applied." Code "has generally less watermarking than some other forms of text". Watermarking "is sparser on factual passages". The watermark "only applies to words Claude chooses". Detection "doesn't work well on small samples".

The Help Center adds the other side. A detected mark "is not fully conclusive". Lack of a detected mark "doesn't mean the content wasn't AI-generated or processed". "Claude may not be the original author" of marked text. A detector can only answer "What is the likelihood this was partly written by Claude?" Anthropic describes detection as private preview for eligible organizations.

An inference, labelled as one

The next step is mine, not Anthropic's. What an agent does on your machine is tool calls: a file read, an edit with an exact old and new string, a shell command with its arguments, a structured call whose fields must fit a schema. A different term in a command is not a slightly different sentence. It is a different command.

So I infer that tool calls and structured output sit where the mark thins. That is inference. Anthropic's statements concern exact output and code. I found no mention of tool calls or structured output in the two pages cited above, and I am not reporting them as unmarked. I am reporting that the shape of what an agent executes fits, fairly closely, where Anthropic says the mark does not apply.

The point that needs no data

Set the inference aside. Suppose the mark were perfect: on every token, detectable from a single line. It would tell you that Claude chose these words. It would never tell you that this command ran, that this file changed, or that this credential was read. A watermark is a statistical property of prose. An action is an event in a process. A signal about who wrote a sentence is a different category of thing from a record of what happened on a disk.

That is not a criticism. It is a statement about what kind of evidence a watermark is: a serious, carefully caveated attempt at provenance for text, whose limits Anthropic states plainly. The mistake would be ours, if we let "Claude watermarks its output" stand in for "I know what my agents did."

The account and the act

An agent's account of its work is also output. "I updated the config and ran the tests, all green" is fluent prose. The mark can say Claude probably wrote the sentence. It cannot say whether the tests ran. What an agent says and what it executed can diverge, through a partial run summarised as complete or a step skipped and described anyway, and a mark on the words sits on the wrong side of that gap.

You cannot close the gap from inside the model, and a detector would not close it either: it answers the authorship question, which was never the one you had.

An outside anchor

The other kind of evidence is a record of actions written by the host rather than by the agent. That is what llmsnitch is: a local-only tracer. For Claude Code it installs hooks that fire on tool calls and at the end of a session, and writes each tool call the agent makes, reads, edits, writes, shell commands and so on, as one JSON line in a plain file on your own disk. The hook never blocks the agent and never prints to it; if recording fails, the agent carries on. For Codex it uses no hooks. It reads that harness's own session files after the fact, keeping only usage, lifecycle and error fields and skipping message and tool bodies, so those sessions are recorded per session rather than per tool call.

The files live in a hidden folder in your home directory, readable only by you. Secrets of common shapes, API keys, tokens, JWTs, private-key headers, are redacted before anything is written, and any single stored string is cut at 2,000 characters. The package is Python standard library only, with no dependencies. Its own code opens no network connection; the one outbound fetch is a weekly pull of a published security advisory file, made by calling the system's curl program, and nothing from the record is sent anywhere. From the record it computes a published health number, 100 minus 3 points per failed tool call minus the failure rate in percent, floored at 0, and can exit non-zero over a threshold: a tripwire read afterwards, not a control. It is version 0.1.0, MIT licensed, installed from a clone of its repository.

It observes and records, and the hook never blocks the agent. The record is not tamper-evident: an agent running with your file access could edit it. The honest word is "recorded". The agent's prose is a claim. The recorded call is a fact about what the harness reported.

Two questions, two kinds of evidence

Article 50(2) of Regulation (EU) 2024/1689 says providers of AI systems generating synthetic text "shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated." Under Article 113, Article 50 applies from 2 August 2026. Article 111(4), added by Regulation (EU) 2026/1744, says providers of systems placed on the market before that date "shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026." Anthropic says it signed the European Commission's Code of Practice on Transparency of AI-generated Content, published 10 June 2026, in July 2026, among around 190 signatories. The Code asks for text watermarking with "the exception of very short text", and says that for free-form text longer than 200 tokens watermarking "still needs to be applied, even though it may have lower reliability". That is a threshold for when text is marked, not a minimum length for detection.

None of that is about your terminal. The watermark answers "was Claude involved in writing this?" with a likelihood that Anthropic itself calls not fully conclusive. The recorded call answers "what did the harness report the agent doing?" with a line in a file. Neither answers the other's question. When the fourth agent hands you its tidy paragraph, the mark can vouch for the paragraph. Only something outside the agent can speak to the deed.

Source: research/sources/docs/watermark-is-in-the-word-choice.md