Last updated: September 2026
Key Takeaways
- Text generated by Claude Fable 5.1 carries an invisible statistical watermark on every platform where the model runs. It is the first Claude model launched after the EU's August 2, 2026 cutoff, and Anthropic applies the mark worldwide.
- The mark can estimate whether Claude was involved in a passage. It cannot identify you, your account, or your conversation, and it is weak on code, short text, factual passages, and lightly edited drafts.
- Only key holders can check for it: Anthropic, and organizations in a private-preview detection API. The only way to remove it is to rewrite every word, and the only rewrite with no key involved runs on hardware you control.
Yes. Text generated by Claude Fable 5.1, released September 1, 2026, carries Anthropic's statistical text watermark, and the mark applies everywhere the model is offered, not only inside the European Union. What it can prove is narrower than the word suggests, it can be removed only by rewriting the text, and the only rewrite guaranteed to involve no key at all is one on your own hardware. What it cannot prove is where the useful answer lives, so that is where this guide spends its time.
Every earlier control layer on Fable stayed on Anthropic's side of the wire. The watermark is the first that travels with you, inside the text you paste into a resume, a blog post, or a pull request, which is why it gets the full treatment here and the benchmarks get a paragraph.
What Anthropic shipped on September 1
Claude Fable 5.1 and Claude Mythos 5.1 are one model with two safeguard settings. Anthropic's launch announcement lists the API model as claude-fable-5-1, keeps input and output pricing where Fable 5 left it, and cuts cache-read pricing by 75 percent. The platform documentation lists a release date of September 1, 2026 and carries a short section labeled content provenance, stating that text generated by Fable 5.1 and Mythos 5.1 carries Anthropic's statistical text watermark on every platform where the model is available. The What's new page is the primary source for everything below.
Why is 5.1 the first? Anthropic's marking policy covers Claude models launched on or after August 2, 2026, when the EU AI Act's transparency obligations took effect. Opus 5 (July 24), Sonnet 5, and Fable 5 (June 9) all predate the cutoff, and Anthropic says marking will reach them over the coming months.
How the text watermark works
The watermark changes where the model's randomness comes from, not what the model writes. Often several next-word candidates are equally good, and a random number settles the choice. Under watermarking, a secret key plus the preceding few words settles it instead, so anyone holding the key can test a passage and assign a probability that Claude was involved. Anthropic's August 14 explainer describes the method as a version of SynthID-Text, which Google DeepMind published in Nature in 2024.
Nothing is added to the text and there are no hidden characters, so copying and retyping preserve the mark at no extra token cost. The nudge only touches choices that were already equally good. Detection is probabilistic: the longer the passage, the higher a key holder's confidence.
Files work differently: supported image types get a signed C2PA content credential in their metadata, readable by any C2PA-aware tool and, per Euronews, stripped by converting, re-saving, or screenshotting the file.
What the watermark can prove, and what it cannot
| Question | Can the watermark answer it? | Why |
|---|---|---|
| Was Claude involved in a long passage? | Likely, as a probability | Every free word choice encodes the pattern; confidence rises with length. |
| Which person or account produced it? | No | Anthropic states neither key nor mark carries user, organization, or chat information. |
| Which conversation it came from? | No | One key covers all Claude output; there is no per-session variant. |
| Was it written by a human, or by a different AI? | No | A negative result proves nothing; other providers use different keys or methods. |
| Text Claude only proofread? | Mostly no | The mark lives only in words Claude chose; a few corrections are too little to register. |
| Source code? | Mostly no | Exact tokens leave no free choices. Comments, docstrings, and READMEs can carry it. |
| Short text? | Unreliable | Too few choices. The EU Code of Practice does not require marking free-form text under 200 tokens, roughly 150 words. |
| A translation? | Yes | Every word of a translation is Claude's choice. |
| Fully rewritten text? | No | Replace every word and the pattern is gone. Light edits leave most of it intact. |
A positive result means Claude processed the text, not that Claude authored it. A negative result does not prove a human wrote it. Sources: Anthropic's explainer and help center; Search Engine Journal on the 200-token threshold.
Who can actually check for it
Anthropic holds the key, and for now that is close to the whole list. The launch announcement says a detection API is in private preview for organizations the EU law entitles to it: regulators, law enforcement, media, fact-checkers, researchers, educators, civil society groups, and enterprises with their own Article 50 obligations. There is no consumer-facing checker today.
Third-party detectors in the Pangram class do not have Anthropic's key, so they cannot test for the watermark; they look for stylistic tells. A detector score is an opinion about style; a watermark check is a test against a key. Confusing the two is how a student or an employee ends up accused on no evidence.
Can you remove the Claude watermark?
Yes, and Anthropic says so: the mark is the text, so the only removal is replacing the words. Rewrite every sentence, by hand or with another model, and nothing is left for the key to read. Two cautions. No "humanizer" can prove it removed Claude's mark, because there is no public detector to check against; a tool that promises removal is selling a test it cannot run. And rewriting through another cloud model swaps one provider's provenance for another's. Google, Meta, Microsoft, Mistral, and OpenAI signed the same Code as Anthropic. The hosted Kimi service shows this holds outside the EU framework too: Moonshot's terms describe identifiers it adds to generated content by default, in a different form from Anthropic's, and no published documentation we could find says whether ordinary Kimi text carries a statistical mark. A hosted API sits behind whatever marking policy its operator runs, and that policy can change without notice.
The only rewrite with no key involved is one on hardware you control. Kimi K3's weights have been downloadable since July 27 under Moonshot's license; Qwen, DeepSeek, and Gemma are covered by tier in our VRAM guide below. The larger point is that removal buys nothing the mark takes. It carries no identity, so there is no privacy to recover, only the claim that a person wrote what a model wrote. Where that claim matters, disclose. Where control matters, generate under no key to begin with.
Why every frontier lab is doing this
This is regulation, not an Anthropic product decision. Article 50 of the EU AI Act requires providers to mark AI-generated output in a machine-readable way. In July 2026 Anthropic signed the accompanying Code of Practice alongside roughly 190 other signatories. Euronews reported fines of up to EUR 15 million or 3 percent of global turnover for non-compliance.
Anthropic applies the mark worldwide because, it says, it has no durable way to scope it by region yet. Two readings deserve equal weight. One is that this is a compliance floor Anthropic reached first and every signatory will follow. The other is that provenance marking is becoming permanent industry infrastructure, with Google marking since 2023 and, per Forbes, OpenAI holding a text capability it has not shipped while xAI has not signed. John Gruber argued at Daring Fireball that choosing words for marking rather than precision compromises the writing; Anthropic cites DeepMind's Nature study, which found no measurable rating difference on live Gemini traffic. Neither is verifiable from outside.
What else Fable 5.1 changed for you
Retention is an exception, not a tier. Anthropic's developer documentation states that Fable 5.1 and Mythos 5.1 carry 30-day data retention and are not available under zero data retention unless expressly authorized by Anthropic. Cursor's model page corroborates: Anthropic stores input and output for harm-prevention review regardless of the app's privacy mode, does not train on it, and deletes it after 30 days. Enterprise Frontier Safeguards, which move that data onto customer-controlled storage, begin phased rollout this fall. For an individual on claude.ai, nothing changed since our Fable 5 coverage: 30 days.
Safeguards were rebalanced, and the fallback stays visible. Anthropic says its cyber safeguards now intervene about 60 percent less often per Claude Code session and permit vulnerability discovery, while penetration testing, exploit generation, and binary scanning still route to Opus. Biology safeguards fire 85 percent less on benign questions. On the API, a declined request returns a refusal stop reason with Opus 4.8 and Opus 5 as fallback targets. That is the visible fallback adopted after the episode in our silent-safeguards analysis, and it changes the arithmetic behind the "is Fable nerfed" question: fewer intercepted tasks means fewer benchmark zeros.
The default effort is not the same everywhere. Fable 5.1 defaults to High effort in Claude Code and on the API but to Medium on claude.ai and in Cowork. Anthropic's own charts put Low and Medium effort near Fable 5's results, with the headline gains at the top of the dial. In the consumer app, the effort selector is where the model you read about lives.
Anti-distillation now constrains the API. For API accounts created on or after August 31, 2026, editing anything earlier in a conversation invalidates Fable 5.1's thinking blocks. Anthropic says this closes a documented distillation technique; Mythos 5.1 does not run the check. On subscriptions, Anthropic's help center as of July 20 includes Fable 5 on Max and Team Premium up to 50 percent of weekly limits and meters it on Pro through usage credits; separate 5.1 terms were unpublished at press time, so check the plan article.
The local-first read
The watermark is applied at generation time, in the sampling step, on the infrastructure that runs the model. That detail decides who controls it. In Google's reference implementation and in Hugging Face Transformers, SynthID-Text is a logits processor that runs only when the operator passes a watermarking configuration to the generate call. Nothing is baked into the weights, so an open-weight model on your own machine carries no third-party key unless you add one. Research exists on training a watermark into weights; no major open-weight release ships that way as of this writing.
The honest caveat is the one our local models by VRAM guide states up front: nothing you can run at home matches Fable 5.1 on the hardest long-horizon work. What the local path buys is control: no key in your text, no 30-day copy of your conversation on someone else's servers, and no terms that can change underneath you by policy update or government order, as Fable 5's 18-day June suspension showed.
What to do with this
If you publish long Claude prose, treat it as detectable by a key holder. Code is largely unmarked, but comments, docstrings, and documentation are ordinary prose and can carry the pattern. If your concern is privacy rather than provenance, keep the two exposures separate: the watermark carries no identity, while the 30-day retention carries your entire conversation and is read by automated systems and, in flagged cases, by people. The second is the larger exposure for most readers. Where control over either matters, run the model yourself for the tasks that fit your hardware, and rent the frontier for the rest.
Frequently Asked Questions
Is Claude Fable 5.1 watermarked?
Yes. Anthropic's platform documentation states that text generated by Claude Fable 5.1 and Claude Mythos 5.1 carries Anthropic's statistical text watermark on every platform where the model is available. It is the first Claude model launched after the August 2, 2026 cutoff, so it is the first to ship with the mark on from launch.
Can the Claude watermark identify me?
No. Anthropic states that neither the watermark nor the key used to detect it contains any information about the user, their organization, or their conversation. A detection result can only estimate the likelihood that Claude was involved in a passage. It cannot say who prompted it or where it came from.
Does the watermark apply outside the EU?
Yes. Anthropic applies the watermark worldwide, across claude.ai, the API, Claude Code, Cowork, and the AWS, Google Cloud, and Microsoft Foundry deployments. Anthropic says it has no durable way to scope marking by region yet, so a US user's output is marked exactly as an EU user's.
Does Claude Code output carry the watermark?
Claude Code is on Anthropic's coverage list, but source code is a poor host for a statistical watermark because exact tokens leave no free choices to encode, and Anthropic says code carries less marking than prose. Comments, docstrings, commit messages, and README text are ordinary language and can carry the pattern.
Can I turn off or remove the Claude watermark?
There is no opt-out on any plan; Forbes noted Anthropic's help page mentions none. Removal means rewriting every word, since the mark is the text itself. A rewrite through another hosted model may carry that provider's own marks, and no tool can prove removal while the detector stays private. A rewrite on an open-weight model running on your own hardware involves no key at all.
Do older Claude models watermark text?
Not yet. Claude Opus 5, Sonnet 5, Fable 5, and earlier models launched before the August 2, 2026 cutoff and fall under a transition period in the EU law. Anthropic says marking will roll out to them over the coming months, so the answer for a given older model can change; check Anthropic's help center for the current list.
Do local AI models watermark their output?
Not unless you enable it. SynthID-Text and similar schemes run as a logits processor at generation time, switched on by the operator through a configuration passed to the generate call. Open weights on your own machine use your sampler, so no key is present unless you add one, and Anthropic's key is never involved in text your own hardware produced.
