Anthropic now embeds a machine-readable mark in Claude’s output. The obvious next question is how you check for it. The honest answer, as of August 2026, is that Anthropic has committed to supporting detection but hasn’t published the tooling yet. Its help center says technical documentation is coming.
That gap matters, because the demand for a Claude detector is already here and the supply is a field of third-party classifiers that guess. Those are two completely different things, and confusing them is how a student gets accused of cheating over a sentence they wrote themselves.
This piece covers what detection actually means for Claude’s two marking techniques, what you can check today, and the reasoning error that makes most detection workflows unsafe. If you’re wiring provenance checks into an API, Apidog is where you can turn those checks into assertions that run on every build.
Two marks, two detection stories
Claude marks content in two ways, and they behave nothing alike.
| Embedded text watermark | Signed C2PA metadata | |
|---|---|---|
| What it is | A statistical signal woven into generated text | A cryptographically signed manifest attached to a file |
| Applies to | All generated text | Supported file types: .svg, .png, .jpg |
| Survives copy-paste | Yes | No, the file is the container |
| Survives re-encoding | Yes, text is text | No, usually stripped |
| Detectable today | Not publicly. Detection support is promised | Yes, with standard C2PA tooling |
| Tells you | Content may have been processed by Claude | A file was processed by Claude, and whether it was tampered with |
The text watermark is the durable one and the one you can’t currently read. The C2PA manifest is the fragile one and the one you can read right now with off-the-shelf tools.
What you can check today: C2PA manifests
If Claude produced an image or SVG and nothing downstream rewrote the bytes, the manifest is sitting in the file. Three ways to look at it.
In a browser. Drop the file into the Content Credentials verification page. It reads the manifest and reports the signer, the claim, and whether the signature validates.
From the command line. c2patool is the reference CLI from the C2PA project:
# Read the manifest summary
c2patool report.png
# Full JUMBF-level detail, useful when debugging a pipeline
c2patool report.png -d
A file with an intact manifest returns a JSON structure describing the claim generator, the assertions, and the signature status. A file whose manifest was stripped returns nothing at all. A file whose bytes were altered without re-signing returns a validation error, which is the useful middle case: it distinguishes “no provenance” from “provenance that has been broken.”
From your own code. The c2pa libraries wrap the same logic for Rust, Python, JavaScript, and C, so you can run the check inside a request handler or a test. That’s the approach behind building an AI image detector API with C2PA and a classifier, where the manifest gives you a confident answer when it’s present and the classifier takes over when it isn’t.
What you can’t check today: the text watermark
There’s no public reader for Claude’s embedded text watermark. Anthropic has said it will support users and third parties in detecting its marks, as the Code of Practice requires, and that details are coming in future technical documentation. Until that ships:
- No tool can authoritatively tell you a passage carries Claude’s mark.
- Any product claiming to detect “Claude-generated text” today is running a classifier, not reading the official signal.
- Classifiers have well-documented false positive rates, and they misfire hardest on non-native English writers and on formal, structured prose.
Treat this as a “not yet,” not a “never.” When Anthropic publishes the detection mechanism, the sensible pattern is a server-side check you call from your own service, exactly like a C2PA verification step, with the result stored as a signal rather than a verdict.
For contrast, Google took the opposite route with SynthID Text: it open-sourced the implementation with a reference detector, so anyone can run it without requesting access. That’s the one text-marking scheme a third party can verify today, and the gap is laid out in Claude vs ChatGPT vs Gemini watermarking.
The reasoning error that breaks detection workflows
Detection produces an asymmetric result. Most people use it symmetrically, and that’s where the damage happens.
A detected mark is weak positive evidence. It says content may have been processed by Claude. It does not establish authorship, because people routinely use Claude to proofread, translate, summarize, and convert existing work. A researcher’s own 3,000-word draft, run through Claude for a grammar pass, comes back marked. The ideas and the reporting are entirely human. The mark can’t distinguish that from a prompt that said “write me 3,000 words.”
Content also changes after Claude touches it. Marked text gets edited, quoted, and merged into larger documents. Finding a mark in a file tells you something touched part of it at some point.
No detected mark is not evidence of anything. Anthropic lists the cases plainly. Content Claude generated may carry no detectable mark when it came from a model released before marking was supported, when the text was heavily edited, paraphrased, translated, or blended into other writing, when the passage is too short to hold a reliable signal, when a file’s metadata was stripped by format conversion, re-saving, or a screenshot, or when it came through a platform or file type where that marking type isn’t supported.
Read that list and notice how ordinary every item is. A short answer. A translated paragraph. A screenshot of a chart. None of these are evasion; they’re Tuesday.
So the rule is: a positive result narrows things down, a negative result tells you nothing at all. Any policy that punishes people on a negative result is wrong on the technology, before you even get to whether it’s fair. The same asymmetry has already caused problems in image work, which is the argument in why AI image detection fails.
Building detection into a service properly
If you’re adding provenance checks to a product, the design questions are less about the algorithm and more about what you do with a soft signal.
Return a signal, not a verdict. A response body that says {"ai_generated": true} is a claim your API can’t support. A response that says {"provenance": {"c2pa": "verified", "signer": "...", "checked_at": "..."}} is a fact you can defend. Model your schema around what you actually observed.
Record what you checked and when. Provenance results go stale, tooling changes, and trust lists get updated. Store the check result with a timestamp and the tool version, the same way you’d store an antivirus scan result.
Separate “absent” from “broken.” These are different states with different meanings. Absent means no manifest was found, which is uninformative. Broken means a manifest exists but fails validation, which is genuinely interesting. Collapsing them into one boolean throws away your best signal.
Fail open on the check, not on the content. A verification service being down should not silently mark everything unverified with no trace. Surface the difference between “checked and found nothing” and “could not check.”
A minimal shape that holds up:
{
"asset_id": "img_9f2c41",
"provenance": {
"status": "verified",
"standard": "c2pa",
"signer": "Anthropic",
"signature_valid": true,
"checked_at": "2026-08-11T09:14:22Z",
"tool": "c2patool/0.9"
},
"notes": "Provenance indicates the file was processed by Claude. It does not establish authorship."
}
That last field is not decoration. If your API returns provenance data to another team’s code, the caveat needs to live where their code can see it, not in a docs page nobody reads.
Testing the checks so they keep working
Provenance verification is exactly the kind of feature that quietly breaks. Someone adds an image resize step, the manifest disappears, and every asset starts coming back status: "absent". Nothing errors. The dashboard looks fine.
Four assertions worth putting in a test scenario:
- Known-good fixture verifies. Upload a file with a valid manifest, assert
statusisverifiedandsignature_validistrue. - Known-stripped fixture reports absent. Upload the same file with metadata removed, assert
statusisabsent, not an error and notverified. - Tampered fixture reports broken. Alter a byte in a signed file, assert the response distinguishes broken from absent.
- Round trip preserves the manifest. Upload a signed file, fetch it back through your normal delivery path, and assert the manifest is still valid. This is the one that catches CDN and resize regressions, covered in depth in your API is stripping C2PA metadata.
In Apidog you can hold those four as a test scenario with binary file fixtures, assert on the JSON response with standard assertions, and run the scenario from apidog-cli in CI so a pipeline change that eats manifests fails the build. Setting it up alongside your existing suite is the same flow as automating API tests in GitHub Actions. Download Apidog to build it against your own endpoints.
FAQ
Is there an official Claude watermark detector? Not publicly, as of August 2026. Anthropic has committed to supporting detection for users and third parties and says it will share details in forthcoming technical documentation.
Can I use an AI text detector to find Claude’s watermark? No. Those tools are statistical classifiers trained to guess whether text looks machine-written. They are not reading Anthropic’s mark, and their false positives fall hardest on writers with an unusual or highly formal style.
How do I check a file for Claude’s C2PA metadata? Run c2patool <file> locally, or drop the file into the Content Credentials verification page. Both report the signer and whether the signature validates.
If a file has no C2PA manifest, was it human made? No. Manifests are routinely destroyed by resizing, re-encoding, format conversion, screenshots, and image CDNs. Absence proves nothing about origin.
Does the text watermark survive editing? Partially. It travels with copy and paste and may persist through some editing, but heavy paraphrasing, translation, or trimming to a very short excerpt can push it below the detection floor. The detail is in does Claude’s watermark survive copy, paste, and editing.
What should I do until detection ships? Verify C2PA where files are involved, log what you checked, and avoid building any policy that depends on detecting text. Design the interface now so you can drop in an official text check later without changing your response schema.
The takeaway
Right now you can verify Claude’s file provenance with standard C2PA tooling and you can’t verify its text watermark at all. That’s a temporary state, but it should shape what you build today: verification of files, honest signals rather than verdicts, and no policy that treats a clean result as proof of anything.
The mark is a hint about where content has been. Anyone selling it as an authorship test is describing a product that doesn’t exist.
