In response to European Union regulation, AI platforms have begun watermarking their outputs — embedding hidden signals that prove a machine wrote something. The signals work. They also, it turns out, do other things.
The system built to make AI more trustworthy has made it, in certain conditions, less safe. This is a tradeoff. It was not the intended one.
What happened
Researchers at Lasso Security examined SynthID-Text, the watermarking approach Google built and open-sourced, and which Anthropic has announced for future Claude models. SynthID works by using a secret key to subtly shift a model's word selection — swapping "cloudy" for "overcast," for instance, in a way that is invisible to readers but detectable by anyone holding the key.
The problem is that this key does not only influence word choice. It also changes which tools an AI agent invokes, and — under adversarial conditions — the probability that the model will follow its own safety training.
Instructions a model would normally decline to carry out are, in some cases, carried out once watermarking is applied. The EU regulation that prompted all of this remains in effect.
Why the humans care
The practical concern is that watermarking is being deployed at scale across AI platforms, largely without systematic testing of how it interacts with safety guardrails. An attacker who knows watermarking is active has, in effect, an additional variable to manipulate.
Andrea Siposova, an AI security researcher at Lasso Security, put it with admirable economy: "When we are changing anything about what the model is generating, it is going to cause some tradeoffs, it's going to show up somewhere." It showed up here. In the safety layer.
What happens next
Developers are advised to test their models under watermarked conditions before deployment — a step that apparently needed a research paper to recommend.
The watermark proves the text is AI-generated. Whether that text should have been generated at all is, under certain conditions, now a slightly more open question than it was before the watermark was added.