OpenAI’s textGrain watermark is coming to ChatGPT and Codex text in the EU. OpenAI announced it on October 5, 2026, and the part every developer should read first is OpenAI’s own editing test. Swap a quarter of the words for synonyms and detection drops from about 92% to 17%.
So this is not an AI detector in the way most people imagine one. It is a compliance mechanism for the EU AI Act, and it has some quiet consequences for anyone shipping Codex output or building on the OpenAI API.
I went through the coverage of OpenAI’s announcement, Anthropic’s August explainer for Claude’s watermark, and Google’s SynthID-Text documentation. Here is how textGrain works, how it compares to what Claude already does, and what changes for developers.
What Is OpenAI textGrain?
textGrain is a statistical watermark that OpenAI’s models write into their word choices. According to BleepingComputer’s report on the launch, the technique slightly shifts which words the model picks so that a detector holding OpenAI’s key can spot the pattern later. Nothing is added to the text. There are no hidden Unicode characters to strip.
The rollout has three parts:
- ChatGPT and Codex in the EU: eligible text output for users on all plans, rolling out “over the coming weeks”
- The API, worldwide: opt-in for select models from October 5, and off by default
- Cloud partners: according to Search Engine Journal, OpenAI is working with cloud providers to add the watermark to its models served through their platforms
The trigger is regulation. Search Engine Journal’s breakdown notes that the EU AI Act’s Article 50 transparency rules began applying on August 2, 2026, and that systems already on the market before that date have until December 2 to meet the marking obligation. The voluntary Code of Practice on Transparency of AI-generated Content had about 190 signatories by the end of July.
OpenAI also published a technical report on the method and, according to ITdaily, plans to release the technology as open source eventually. No date or license was given.
textGrain is a provenance signal for regulators and researchers, not a tool you or your users will run.
How AI Text Watermarking Actually Works
Language models pick each token from a probability distribution, with some randomness. Watermarking replaces part of that randomness with pseudo-random values computed from a secret key and the preceding words.
To a reader, the output looks the same. To a detector with the key, certain word choices show up more often than chance would predict.
This is the same family of ideas behind Google DeepMind’s SynthID-Text. Google’s SynthID documentation describes it as a logits processor that runs after Top-K and Top-P sampling, and it has been open source in Hugging Face Transformers since v4.46.0. Anthropic’s explainer traces the approach back to a 2022 proposal by Scott Aaronson.
The catch is built into the mechanism. The watermark needs freedom in word choice to hide a signal. When there is only one correct answer, there is nothing to nudge.
That is why OpenAI reports weaker detection on math, and why Google’s docs say watermarking is less effective on factual responses. This is the part I find most interesting for developers, because code is the most constrained text most of us generate.
The conclusion for this section: the more creative freedom a passage has, the stronger the watermark; the more deterministic, the weaker.
textGrain Detection Rates: The Numbers OpenAI Published
OpenAI gave more detail than I expected. At a 1% false-positive target, the detector caught about 80% of 200-token psychology passages and about 95% of 400-token passages, per BleepingComputer.
Then came the editing test, on 400-token English passages from the ELI5 dataset:
- No edits 92%
- 10% of words swapped 66%
- 25% of words swapped 17%
Source: OpenAI evaluation via BleepingComputer (Oct 5, 2026)
A 25% synonym swap is not a determined attack. It is what a student does with a thesaurus, or what a second model does when you ask it to “rephrase this in my voice.”
OpenAI is upfront about this. Its post states that “the absence of a detected watermark does not prove human authorship,” and that the detector can produce false positives as well as false negatives, especially on short text and specialised domains.
On quality, 9to5Mac’s write-up lists OpenAI’s watermark-on versus watermark-off benchmarks. Watermarked output scored 56.06% on Terminal-Bench 4.0 against 53.90% without, and 93.94% versus 94.44% on GPQA Diamond. Those gaps look like noise in both directions, which is the point OpenAI is making.
The watermark costs nothing in quality and survives light editing poorly, which is exactly the trade-off you would expect.
OpenAI textGrain vs Claude’s SynthID Watermark
Anthropic got here first. Its explainer, How Claude’s text watermarking works, was published on August 14, 2026 and updated on September 1 with detection API details. The two approaches differ in ways that matter if you use both vendors.
| Watermark | Method | Where it applies | API default | Detector access |
|---|---|---|---|---|
| OpenAI textGrain | OpenAI’s own method | ChatGPT and Codex in the EU only | Off (opt-in) | Approved researchers and expert orgs |
| Claude watermark | Version of Google DeepMind’s SynthID-Text | Supported Claude models, worldwide | On | Private preview API for eligible orgs |
(Source: BleepingComputer, Search Engine Journal, Anthropic, October 2026)
Three differences stand out.
Geography. Anthropic says it has no durable way yet to scope watermarking by region, so it applies globally. OpenAI scoped the consumer rollout to the EU. If your team has EU and non-EU staff on the same ChatGPT plan, Search Engine Journal points out that some of your content will carry the mark and some will not.
API defaults. OpenAI leaves the watermark off in the API unless you opt in. Anthropic’s post describes the watermark as a property of future Claude models, with models launched before August 2, 2026 added over a transition period. It mentions no opt-out.
Published editing data. OpenAI gave numbers. Anthropic’s explainer says light editing probably will not remove the watermark completely and a full rewrite will, but gives no figures. OpenAI also claims textGrain matched or beat other tested methods, SynthID-Text included. That is a vendor-reported comparison and should be read as one.
Anthropic also adds signed C2PA content credentials to file outputs such as .png, .jpg and .svg, which is a separate system from the text watermark.
If you are picking a model on capability and price, the Claude Opus 5.5 vs GPT-6 comparison and the AI model pricing tracker are better guides. Watermark policy should not decide your model choice, but you should know which one you are getting.
Does the Codex Watermark Touch Your Code?
This is the question I care about most, and nobody has a complete answer yet.
OpenAI says eligible Codex “text output” in the EU will be watermarked. None of the coverage I read says whether that includes generated code, commit messages or pull request descriptions, or only the agent’s chat replies.
Anthropic’s explainer is more specific about its own approach. Code is watermarked less than prose, because working code leaves little room for arbitrary choices. An exact output like a calculation result is not watermarked at all. Arbitrary choices such as code comments can be. TechCrunch quoted Anthropic saying the effect on the code itself is negligible.
Applying the same logic to textGrain, my expectation is:
- Function bodies: little signal, because the tokens are dictated by syntax and APIs
- Comments, docstrings, README text: the most likely place for a detectable signal
- PR descriptions and commit messages: prose, so they behave like any other text
That is inference from how the technique works, not something OpenAI has confirmed. If you run Codex Cloud or the Codex CLI from the EU, as covered in the Codex Cloud vs Claude Code on the web comparison, assume the prose around your code can carry the mark.
For code, expect the watermark to live in comments and descriptions, not in logic.
What AI Text Watermarking Means for Developers
Most developers do not need to change anything this week. A few groups do.
API builders serving EU users. If you ship a product built on the OpenAI API and it generates text for people in the EU, Article 50’s marking obligation may apply to you as a provider or deployer. OpenAI’s opt-in gives you a mechanism. Whether you need it is a question for your lawyers, not a blog post, but the December 2 date for existing systems is close.
Teams writing AI policies. Both OpenAI and Anthropic say a watermark does not measure human contribution or establish ownership. Search Engine Journal warns against contract clauses that treat a detection result as proof of authorship. If your AI policy says “no AI-written text” and plans to enforce it with detection, it is built on a tool that neither vendor offers publicly and both say can be wrong.
People worried about false accusations. TechCrunch reported that Business Insider counted dozens of X users saying they cancelled Claude subscriptions over watermarking. The fear is understandable. The practical risk is small while detectors stay restricted to vetted organisations, and both companies say the mark carries no user ID, account or prompt.
Security-minded teams. A watermark is not a defence against anything. It will not stop prompt injection or a malicious package. If AI output in your pipeline worries you, a review step and deterministic guards do far more, and the AI-generated code security checklist is a good place to start. The Claude Code hooks guide covers how to block risky agent actions before they run.
My honest read: textGrain is a reasonable answer to a regulatory requirement, and a poor answer to the question “did an AI write this?” OpenAI has said as much in its own post, which is more candour than most launches get.
The Bottom Line on the OpenAI Watermark
OpenAI’s textGrain watermark arrives in EU ChatGPT and Codex over the coming weeks, with an opt-in for API customers worldwide. It is invisible, does not change benchmark scores in any meaningful way, and fades fast once text is edited.
Claude has carried a SynthID-based watermark on supported models since Anthropic’s August announcement, worldwide and without an API opt-out. Both detectors are closed to the public.
For developers, the actionable points are short. Check whether Article 50 applies to your product before December 2. Do not build workflows that treat detection as proof. Expect any signal in AI-written code to sit in comments and descriptions rather than logic.
Provenance is ultimately a trust problem, and no watermark solves that for a reader. Named sources do, which is why every post here ends with a source list, as the note on why The Vibelog exists explains.
