AI CONTENT · AI AGENTS · 7 MIN

AI watermarks are now part of your agent's risk surface

SEP 25, 2026

Filed under Agent Skills

Anthropic watermarks every Claude response now, and a new study shows the mark changes agent behavior: tool calls, arguments, even refusals under attack.

A watermark is supposed to identify content, not alter it. That assumption stopped holding this month. On September 17, security firm Lasso published "The Provenance Tax", a paired-run study showing that SynthID-Text, the watermark Anthropic now applies to Claude output and Google DeepMind built for Gemini, measurably changes which tools an agent calls, with which arguments, and when it refuses a harmful request. Lasso sells agent security, so read the vendor framing accordingly. The methodology is harder to wave away: same model, same seed, same prompts, watermark on versus off, on standard benchmarks, with bootstrap intervals.

If your marketing automation calls an LLM API that does anything with the answer, this study has an ops section you should care about. It isn't the section everyone has been arguing about.

What the study actually found

Anthropic announced in August that Claude output now carries an invisible watermark, based on Google DeepMind's SynthID-Text, applied at the model level across the API and cloud providers. The trigger is Article 50(2) of the EU AI Act, which requires providers of synthetic text systems to mark output as machine-readable and detectable. Most major providers signed the EU's voluntary code of practice on transparency of AI-generated content. Watermarking is becoming the default, not a toggle.

SynthID works during generation, not after. It biases token sampling through what the DeepMind paper calls tournament sampling. "Non-distortionary" means the token distribution holds in expectation across many runs; any single run under a fixed watermark key can still pick different tokens than the same run without it. Lasso calls that behavioral difference sampling drift, and they measured it in two places agents actually live.

Tool calling. On BFCL v4 single-turn items where a call is expected, watermarking reduced accuracy on six of seven models, significantly on four. The aggregate number understates the problem, because calls flipping correct-to-wrong and wrong-to-correct cancel out. Their churn metric, the share of items whose verdict differs between watermarked and unwatermarked runs, averaged 6.5% across 21 model-temperature combinations, and at temperature 1.0 phi-4 hit 16.8% churn against a net accuracy loss of only 2.87 points. The nastiest failure mode is a well-formed call to the right tool with a wrong argument: wrong recipient, wrong path, wrong amount. It executes successfully and does the wrong thing.

Refusal under prompt injection. Watermarking barely moved refusal rates on bare harmful requests. Under a fixed prompt-injection technique it moved them a lot: gemma-3-27b's refusal-to-compliance churn went from 6.0% to 23.5%, with net compliance up 12.5 points. On four of six models, watermark-induced churn exceeded what they saw from changing temperature, the drift source most teams already treat as noise.

Two caveats the authors themselves flag. The effect depends on the watermark key, so a provider rotating keys can change your agent's behavior without touching the model. And Lasso never tested the combined failure, a weakened refusal inside an agent with live tools, which is precisely the configuration marketing automation runs.

The part with ad spend attached

Meanwhile provenance stopped being a content-policy topic and became a media-buying requirement. On September 14, Microsoft Advertising published dedicated rules for AI-generated ads: preserve watermarks and metadata, disclose synthetic content close to the asset, embed disclosures directly into image and video creative. Ads can be rejected or pulled for interfering with machine-readable provenance information. Microsoft's own AI tools stamp output with provenance data and imperceptible watermarks, and the guidance is explicit that those signals aren't necessarily visible to consumers, so advertisers still owe their own disclosures.

Here is the operational collision nobody has written up: a compliance mechanism built for content provenance is now also a performance variable inside your automation. If your pipeline compresses images, strips EXIF during resizing, or re-encodes video, you may be destroying provenance metadata on the way to the ad platform. That's not a hypothetical. Metadata stripping in image optimization is a decade-old best practice for page speed, and every DAM, compressor, and CDN transform in a typical workflow does it silently.

The deliverability side of the same collision has been building since we covered AI content and the spam problem in email. Search Engine Land has documented platforms building anti-slop systems that detect low-value AI content, and the EU's machine-readable marking requirement gives every intermediary in the chain, ESPs included, a cheap signal to filter on. Whether mailbox providers actually downrank watermarked text is unknown, and Anthropic itself warns a watermark can't confirm authorship or rule out AI use. But when a detection signal exists and is free to read, someone will build a filter around it. Marketing's exposure isn't the detection; it's what you did with the content pipeline while assuming the watermark was inert.

What to change in your stack this quarter

Treat the watermark as part of the deployed configuration, not as packaging. Concretely:

Pin and test, don't assume. If you run agents on Claude or Gemini APIs, re-run your eval suite against the watermarked production path rather than a local unwatermarked model. Lasso's core recommendation is paired comparison on the same inputs, and it costs you one extra column in the eval spreadsheet you should already have. Re-run whenever the provider changes models, because key and config changes are invisible to you and can flip individual tool calls while aggregate accuracy stays flat.

Fence the blast radius. The churn numbers land hardest on the argument we made in the if/then post: anything with a wrong-recipient, wrong-amount failure mode should not depend on an LLM's sampled judgment at all. Email sends, budget changes, and CRM writes belong behind deterministic validation, the kind of approval step we covered in the guardrails Google won't ship. A 6.5% average churn on tool-call verdicts is an argument for schema validation on every agent output, not for switching providers.

Audit metadata handling in creative pipelines. Find every step between asset generation and ad upload, DAM exports, image optimizers, video transcoders, CDN transforms, and check whether it strips provenance metadata or watermarks. Under Microsoft's new rules, interference can get the ad rejected, and you won't learn that from your analytics dashboard.

Stop treating "AI-generated" as a binary label in content ops. Watermark detection will produce false positives on human text and paraphrase washes out signals, as the SEO coverage of Anthropic's rollout keeps repeating. The durable position is the one from our deliverability piece: content that earns its place survives whatever filter ships next. Content that exists to fill a calendar won't.

The provenance tax is real, but the invoice is split. Platforms pay it in compliance engineering, publishers in detection risk, and marketing ops pays in nondeterminism we didn't order and can't pin. The teams that handle it best will be the ones already treating every agent output as untrusted input: validated schemas, human approval on anything that moves money or sends mail, and evals rerun when the ground shifts. If you're assembling that control layer in n8n, the pattern is the same as everything else we cover there, and the tool page has the workflow recipes. More agent coverage lives under the agent skills category.