Anthropic announced that future Claude models will embed an invisible watermark based on Google Deep Mind’s Synth ID-Text. This watermarking, required by Article 50(2) of the EU AI Act for synthetic text, alters the model’s token generation process. At the model level, this can change safety behaviors, such as refusing harmful requests, and make them vulnerable to prompt injection.

At the agent level, the same sampled tokens determine which tool is called and what arguments are passed. This behavioral effect, termed sampling drift, is confirmed in both model refusal behavior and agent tool calling. The effect is model- and key-dependent and can be obscured by aggregate scores.

The article discusses the implications for AI safety and security and what developers should do. Anthropic’s deployment applies the watermark at the model level, covering supported models accessed through the Claude Platform API and cloud providers, making model-level behavioral effects relevant to agents built around these models. Tournament sampling, used by Synth ID-Text, has more opportunity to alter token selection where the model is uncertain, potentially altering arguments that an agent executes.