Anthropic Details How Claude's C2PA Watermarks Work — and What Can Strip Them

Anthropic has shared technical details on how Claude's new C2PA watermarking system actually functions — including the specific conditions under which watermarks survive editing, get stripped, and behave differently for code versus natural language.

Key takeaways

• Claude's watermarks use the C2PA (Coalition for Content Provenance and Authenticity) standard, embedding machine-readable metadata rather than visible marks.
• The watermark is attached to the output at generation time; certain post-generation edits — particularly format conversions and aggressive compression — can break the metadata chain.
• Code outputs are handled differently: Anthropic says the watermark applies to the text of code Claude generates, but execution or compilation of that code does not carry the tag forward.
• The system tags content Claude touched, including lightly edited human text — a scope Charmloop covered when the feature was first announced.
• C2PA metadata can be inspected by any tool that reads Content Credentials, making provenance visible to platforms, employers, and educators.

What the C2PA chain actually records

C2PA works by attaching a signed manifest to a piece of content — a cryptographic record of who produced it and when. For Claude's text outputs, Anthropic embeds this manifest in a way that travels with the file in supported formats. The signature is tied to Anthropic's certificate authority, so any C2PA-aware reader can confirm the content originated from Claude without needing to contact Anthropic's servers at the time of verification.

According to TechCrunch's reporting on the technical briefing, the manifest survives copy-paste into most rich-text environments that preserve metadata, but is lost when content is pasted into a plain-text field, converted between file formats in ways that strip extended metadata, or run through heavy JPEG or lossy compression. That last point matters for AI-art creators who routinely export, re-compress, or batch-process images: a Claude-captioned or Claude-described image asset that gets reprocessed through a compression pipeline may exit that pipeline with no C2PA record intact — which cuts both ways. It removes the attribution signal, but also means the watermark is not as durable as the announcement language implied.

How code outputs are tagged — and why it's narrower than it sounds

Code is the sharpest edge of this policy for technical creators. Anthropic's position is that the C2PA tag applies to the text artifact Claude produces — the source file — not to any compiled binary, running process, or downstream output that code generates. A Python script Claude wrote carries the watermark in its file metadata; the PNG that script renders when run does not inherit the tag automatically.

That distinction matters for anyone using Claude in a generation pipeline — for example, writing a ComfyUI workflow or an image-processing script with Claude's help. The script file itself would be tagged, but images it produces are not automatically flagged as Claude-adjacent. Whether that boundary holds as platforms build C2PA readers into their ingestion pipelines is an open question Anthropic has not answered.

The editing-scope problem hasn't gone away

The detail that generated the most friction when Anthropic first announced this system — that Claude tags content it only lightly edited, not just content it wrote from scratch — remains unchanged. Anthropic's new technical briefing doesn't narrow that scope. As Charmloop reported earlier, Claude's watermark flags human writing Claude only edited, which creates real exposure for creators who use Claude to clean up captions, polish alt text, or refine prompt descriptions before publishing.

For AI-art creators specifically, that means any image metadata, title, or description that passed through Claude — even for a grammar check — could carry a C2PA manifest identifying Anthropic as a content participant. Platforms that ingest C2PA data (Adobe's ecosystem and some stock sites already do) will see that signal.

What's still not independently verified

Anthropics says the watermark is robust against "common editing operations," but that phrase is doing a lot of work. No independent researcher has published a systematic test of which editing chains reliably break or preserve the manifest. The claim that compilation strips the tag from code outputs also comes from Anthropic's own briefing — it hasn't been confirmed by third-party audit. Creators building compliance workflows around C2PA provenance should treat vendor claims here as preliminary until external testing catches up.

For a broader look at how watermarking fits into the shifting content-provenance landscape, the AI tools and model releases section tracks related developments across providers.