Is Claude-generated code watermarked?
By Claude Watermark Research · Updated
Anthropic's marking applies to text output from qualifying models, and code is text — so in principle it is in scope. In practice a distributional watermark needs entropy, meaning genuine freedom to pick between near-equivalent tokens, and code has far less of it than prose. Syntax is fixed, identifiers are constrained by the surrounding codebase, and formatters normalise whatever is left. The less choice the sampler has, the weaker the signal.
Why entropy is the whole story
A distributional watermark works by biasing the choice among candidate next tokens that are roughly equally good. Each such choice carries a fraction of a bit of signal, and detection needs many of them to accumulate into something statistically distinguishable from chance.
Prose offers that constantly — a dozen ways to open a sentence, near-synonyms everywhere. Code does not. After `for (let i = 0; i` there is essentially one continuation. Variable names are dictated by what already exists in the file. Import order is conventional. The sampler is frequently near-deterministic, and a near-deterministic choice carries no signal to bias.
What happens to code after it is generated
Even where a signal exists, normal engineering practice destroys it. Prettier, Black, gofmt and rustfmt rewrite whitespace and line breaks. Linters rename things. Code review edits it. A merge interleaves it with other people's work.
This is the same mechanism Anthropic acknowledges for prose — marks may not survive heavy editing — except that in code the editing is automated and happens on every save.
What this means at work
There is no detector. Detection requires the secret key used at generation, which Anthropic holds and has not published tooling for. No enterprise scanner, linter, CI check or security product can test for this today, and none can be built by a third party while the key is private.
So a strict no-AI policy is still enforced the way it always was: by policy, by review, and by the ordinary tells a human notices — a commit that is too large and too uniform, comment style that does not match the rest of the file, an unfamiliar idiom.
Which models are in scope
Marking applies to Claude models launched on or after 2 August 2026. Sonnet 5, Opus 5, Opus 4.8 and Haiku 4.5 all launched before that date. Anthropic's help centre says earlier models are “in progress” under a transition period, so this is a moving target rather than a switch that flipped.
That means code written with the models most people are using today carries no mark at all, regardless of the entropy question.
Questions
- Can my employer scan our repo for Claude-written code?
- Not for the watermark. No detector exists outside Anthropic. They can, of course, look at commit history and review the code, which is what actually happens in practice.
- Does running the code through a formatter remove the mark?
- Formatting normalises whitespace and layout, which removes some of the token choices a mark would ride on. Nobody outside Anthropic can measure how much survives, so treat confident claims in either direction with suspicion.
- Is a code comment more markable than the code itself?
- Yes, in principle. Comments and docstrings are prose and carry far more entropy than the surrounding syntax, so they are the part of a file where a distributional signal would be strongest.
Check your own text. Free, unlimited, no account, and it runs in your browser so nothing is uploaded.
Open the checker
