ChatGPT Now Watermarks Its Text. Can Employers Read It?

As of October 8, 2026, no employer, recruiter, or assessment platform can read OpenAI's new text watermark. The mark is real and it is now being applied, but the detector that reads it is held back to a short list of approved researchers, and the voluntary code OpenAI is working under does not put hiring teams on the list of parties entitled to access. That gap is the whole story for candidates right now — and it is a gap that could close.

This article covers what OpenAI and Anthropic actually turned on, who can verify a mark today, how much the signal survives ordinary editing, and what the mark would and would not establish about a take-home assignment or a written application if a hiring team ever could read it.

What OpenAI turned on, and when

On October 5, 2026, OpenAI said in a blog post that it would add an invisible watermark to text generated by ChatGPT and Codex for eligible users in the European Union, on all plans, rolling out "over the coming weeks" (TechCrunch, October 5, 2026). The method is called textGrain, and OpenAI published a technical report on it co-written with researchers at the University of Pennsylvania and Yale.

The mechanism is not a visible tag or a piece of file metadata. A secret key subtly biases which of several plausible next words the model picks, repeatedly, across a passage. A detector holding the same key estimates whether that statistical pattern is present. Because the signal lives in the word choices themselves, it travels with the text when the text is copied and pasted. OpenAI says the mark does not identify the user and that it saw no meaningful change in model performance.

Outside the EU, the behavior is opt-in rather than automatic. API customers worldwide have been able to enable watermarking for select models since October 5 through a "Text provenance" setting under organization or project data controls, and it is off by default (ActuIA, October 6, 2026). OpenAI did not make text watermarking a global default at launch.

The regulation behind it

Article 50 of the EU AI Act applies from August 2, 2026. It requires providers of systems that generate synthetic audio, image, video, or text to ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated," with marks that are "effective, reliable, robust and interoperable" (European Commission, Article 50 transparency FAQ). Systems already on the market before that date have until December 2, 2026 for the marking obligation specifically.

The same FAQ lists carve-outs, and one of them matters a great deal to technical candidates: source code is exempt from the marking obligation. So is "very short text." Keep both in mind — they come back below.

Anthropic's watermark is wider than the EU

OpenAI is not first here. On August 11, 2026, Anthropic confirmed on a support page that models released after August 2 carry watermarking built in automatically, applied at the model level so that it appears regardless of which Claude surface the text came from — the Claude API, Claude, Claude Code, Claude Cowork, and Claude Tag (TechCrunch, August 11, 2026). Anthropic tied the change to the EU transparency code but did not describe a region-limited rollout, and files are marked using the C2PA standard rather than the text method.

Anthropic has not published detection-accuracy figures or described who can verify a Claude mark. TechCrunch reported that the company said the mark travels with copied and pasted text and "may persist through some editing," without specifying how much editing removes it.

The practical summary as of early October 2026: Claude text is being marked broadly, ChatGPT and Codex text is being marked in the EU and optionally through the API elsewhere, and in neither case is there a verification route a hiring team can use.

Who can actually read the mark

This is the part most coverage skips, and it is the part that decides whether any of this affects you.

OpenAI opened detector applications on October 5 and limited initial access to approved researchers and expert organizations; its help center names partners at Cornell, ETH Zurich, and the Slovak institute KInIT. Even API customers who turn watermarking on must apply separately for detector access. ActuIA's reading of the relevant code of practice is that restricting the detector is permitted for free-form text but must be time-limited, and that the code requires controlled free access for specific groups — regulators, media, fact-checkers — a list that does not include an HR department checking a cover letter.

Two things follow. First, a recruiter today has no sanctioned way to test your submission for an OpenAI mark, and no published way to test for an Anthropic one. Second, "time-limited" is doing real work in that sentence. The current answer is a policy choice about access, not a technical ceiling, and policy choices change. Treat today's situation as the current state rather than a settled one.

What hiring platforms can observe has not changed, and it was never the watermark. Assessment tools lean on paste events, keystroke timing, tab and focus changes, and environment signals — the kinds of telemetry covered in what HackerRank can and cannot infer about ChatGPT use. Those mechanisms are unaffected by any of this.

What the mark would prove, and what it would not

Suppose detector access opened up tomorrow. A positive result would be narrower evidence than it sounds.

OpenAI's own framing is that a watermark shows an OpenAI system generated or processed part of a passage — not how much human effort went into the result, and not who holds authorship. And a negative result establishes almost nothing: OpenAI states plainly that a missing watermark "does not prove human authorship," because the text may be too short, heavily edited, translated, produced by an unsupported or older model, or written by a different company's system entirely.

That asymmetry is important if you are ever on the receiving end of an accusation. A watermark hit is a provenance signal about a tool, not a measurement of your contribution.

Detection falls off quickly with editing

OpenAI's reported evaluations, as summarized by ActuIA from the company's blog post and help center, used a one percent false-positive target on English passages:

Read down that column and the shape of the thing is clear. The watermark is reasonably strong on long, unedited, English prose and degrades fast on everything else. The code of practice treats text under 200 tokens as "very short" and exempt, which is roughly the length of a short-answer screening response. ActuIA also notes that the report's theoretical false-positive rate rests on independence assumptions and that a deployed key needs empirical calibration — so even the headline numbers are lab figures awaiting independent replication.

Code is the open question

For technical candidates this is the gap worth watching. OpenAI named Codex as a covered product, but neither OpenAI nor any coverage reviewed here has published detection figures for source code specifically. Meanwhile the EU obligation that prompted the rollout exempts source code outright.

Those two facts point in opposite directions, and the honest answer is that the status of watermarked Codex output in a take-home repository is currently unresolved. Reasoning from what is published, low-entropy text is the hard case for this family of method — it is why OpenAI reports weaker results on mathematical content — and source code constrains the next-token choice far more tightly than prose does. That is inference, not a published finding, and it should not be mistaken for one.

What is not unresolved is the policy layer. Whether a take-home permits AI assistance, and whether it requires disclosure, is set by the employer and is usually written down somewhere in the instructions; the current landscape is mapped in our guide to AI rules for take-home coding assignments. A watermark changes the evidence available to someone enforcing that rule. It does not change the rule.

Why the detector restriction is defensible

It is worth sitting with the reason access is limited, because candidates have a direct interest in it.

Text detectors have a bad record. In a 2023 study published in Patterns, Liang and colleagues ran seven widely used GPT detectors against TOEFL essays written by non-native English speakers and found an average false-positive rate of 61.22%, with 18 of 91 essays flagged as AI-authored by all seven detectors at once; the same tools misclassified US eighth-grade essays at 5.19% (arXiv:2304.02819). OpenAI retired its own AI Text Classifier in July 2023, citing its low rate of accuracy.

Institutions have been drawing the obvious conclusion. An AFP report on October 6, 2026 described Yale, Cornell, and the University of Wisconsin-Madison among a growing number of universities pulling back from detector evidence, with UW-Madison's faculty guidelines calling the tools "imperfect at best" and noting their documented bias against non-native English speakers; Harvard College Dean David Deming wrote that "we would all benefit from getting out of the AI-detection business" (AFP via The Jakarta Post, October 6, 2026).

A cryptographic watermark is a different class of method from those stylometric detectors, and comparing the two is not quite fair. But the deployment history is the reason to be skeptical of any party promising a clean verdict on authorship, and it is the reason a restricted, calibrated rollout is better for candidates than an open one.

What this changes for you right now

Little, in terms of what anyone can check. Quite a lot, in terms of what you should assume going forward.

Three practical consequences:

1. Verbatim pasting is the exposure path. A watermark travels with copied text and degrades with rewriting. Pasting a model's prose or code straight into assessed work is the case these methods are built to catch, and it is also the case most employer policies already prohibit. The policy is the binding constraint; the watermark is just better enforcement of it.
2. Absence proves nothing, in either direction. If you wrote something yourself and a tool flags it, the Liang findings and the university retreat above are the relevant context, and you are entitled to ask what evidence the flag rests on. Our guide to what happens after a coding assessment flags you covers how those reviews usually run.
3. Ask about the rules before the assessment, not after. What a company may disclose to you about automated evaluation is itself increasingly regulated; see what candidates are entitled to know under 2026 AI hiring rules.

Where a tool fits in this picture depends entirely on which rules apply to your assessment. Control is a desktop AI interview assistant for interviews, online assessments, and screen-share workflows; it shows answers in an overlay you read from, and new users get their first five messages and two minutes of voice transcription free. Whether using it is permitted for a specific test is set by the assessment provider or employer, not by us, and some explicitly prohibit it.

The bottom line

The watermark is real, it is live, and you cannot currently be checked against it by anyone who is hiring you. The mark is strongest on long, unedited English prose, weak on short answers and translated text, and unresolved on code. Its presence would indicate that an OpenAI or Anthropic model produced part of a passage; it would not measure how much of the work was yours, and its absence would not vouch for you.

The useful move is not to reason about detection probabilities. It is to read what the assessment actually permits and to work inside that, because that is the rule you will be judged against whether or not anyone can read a watermark. Start with the 2026 rules for AI on take-home coding assignments.