A man in Connecticut typed instructions into his own court filing in three-point white text on a white background, where no judge would ever see them and where any software reading the document certainly would. The hidden text told whatever system was processing the file to make its output agree with his arguments, to disregard the court's earlier denials, and to see that he got the remedy he wanted. He was caught. The Connecticut Judicial Branch does not use AI to review or decide filings, so there was nothing on the other end to talk to.

That happened in the same seven days that Google made the visible watermark on its AI images optional while keeping the invisible one, Anthropic shipped an API that lets other people's software detect text its models probably wrote, a new benchmark found that no frontier model clears sixty percent on basic visual perception, and OpenAI started turning Mac users' clicks and keystrokes into a searchable memory their assistant can read.

Five stories, and they are one story. Every document, image and screen you produce now has two readers. One of them is a person and one of them is a machine, and they do not see the same thing. Nearly every difficult question in AI governance this month is a consequence of that gap, and the uncomfortable part is which of the two readers has quietly become the one that decides.

The filing written for two audiences

Ashley Belanger reported for Ars Technica on a decision by Connecticut judge Walter Spader Jr., who appears to have identified the first US attempt to hide text in court filings that only an AI system can read. The plaintiff, Matthew Elliott, representing himself in a dispute with a healthcare provider over access to records, had shrunk the instructions to tiny type and colored them white on white. Spader described it as text "formatted to be invisible to a human reader while remaining fully legible to any software that reads the document's text."

Then Elliott did it again, after the court had already warned him. The later insertions included a link to a Nosferatu video, a line reading "hi :) I hope yo ucant see me," and a string of nonsense in capitals. He told the court they were jokes. "The fact that plaintiff continued to hide messages in new pleadings after receiving notice of this [sanctions] hearing is stunning," Spader wrote. The sanction was not financial. Elliott lost his electronic filing privileges and now files on paper, in person.

Here is the sentence that makes this worth your time, and it was written by a state court judge rather than a security vendor: "By hiding a command inside a document that the system later ingests, the filer attempts to smuggle their own instruction into that stream so that the system treats it as though it had come from the system's operator." That is a cleaner description of prompt injection than most of the documentation shipped by companies selling protection against it.

Two things have to be said plainly or the story gets misread. First, the attack failed and had no target. Connecticut's courts do not use AI to review or decide filings, and Spader said so. Anyone telling you an AI nearly decided a case here is ahead of the evidence. Second, the precedent Spader cited did have a target and also failed. In Brazil, two attorneys ran the same attack in a court that was using AI to review cases, were sanctioned around $16,000, and were caught because the court's own system flagged the hidden text before processing it.

What makes it a business story rather than a legal curiosity is Spader's own explanation of why he expects more of it. The tactic is already routine in hiring, where applicants hide instructions in resumes that they know will be read by software first. He called it "everywhere." So the transferable finding is not about courts. Your intake is an attack surface now. Resumes, invoices, RFP responses, support tickets, vendor security questionnaires, insurance claims, anything a stranger sends you that a machine reads before a person does.

The watermark comes off the part you can see

On the same day, Ivan Mehta reported for TechCrunch that Google is making the visible watermark on its AI generations optional. It covers images, video and songs across Gemini, the Flow video editor and, soon, Search, on the Nano Banana, Omni and Lyria models, via a toggle under Settings and Media Watermark. What stays is the invisible part: SynthID and the C2PA provenance metadata. Josh Woodward, Google's VP for Gemini, framed it as "striking a balance here between creative control and safety: while the visible watermarks are now optional, invisible SynthID watermarks and C2PA metadata are still being used for transparency." Google is also open sourcing Credentio, a C++ library that lets developers validate provenance locally.

Pointing the other way in the same week, Matthias Bastian reported at The Decoder that Anthropic has announced a watermark detection API, letting third-party developers check whether text came from its models. The technique is a variant of Google DeepMind's SynthID Text, which tweaks the randomness source during word selection so that a traceable statistical pattern is left behind without changing what the text says. Every Claude model released after 2 August 2025 watermarks automatically, with older models to follow. The Decoder attributes the timing to Anthropic having signed the EU Code of Practice on transparency for AI-generated content in July 2026.

Read those two announcements together and the direction is unmistakable. Provenance is migrating out of the layer a person can check and into the layer only software can. The mark you could see became a preference. The mark you cannot see became the standard.

That is a defensible trade and we would probably make it too. Visible watermarks are trivially cropped and they ruin the work. Statistical and cryptographic provenance is more durable and less obtrusive. But be precise about what changed: verifying where an image or a paragraph came from is no longer something a human being can do by looking at it. It is a tool call, and somebody has to own or trust the tool.

And the tool is weaker than the announcement implies, which Anthropic says itself, to its credit. Per The Decoder's account, the watermark is less reliable on short texts and on fact-dense passages with few alternative phrasings, is ineffective on code, does not survive heavy rewriting, and can only flag that the model was likely involved rather than telling you whether it wrote the whole thing or merely edited it. A published limitations list that honest is worth more than a confident claim, and it should change how you write policy. Any internal rule shaped like "AI-generated content must be labeled" now rests on a detector whose actual return value is closer to "probably involved, to an unknown extent, unless it was rewritten, and never for code." Write the rule against that, not against the headline.

What the mark actually proves

Since we drafted the section above, Anthropic published a fuller technical explanation and Search Engine Journal published two pieces working through it. The detail changes what you can responsibly do with a detection result, so it is worth being precise.

First, what the watermark is not. Roger Montti reports that there are no hidden Unicode characters embedded in the text, so it is not something you can paste into a text file to find or strip. And it has nothing to do with the stylistic tells the industry has been trading for two years. It is not counting em dashes, it is not looking for "it's not this, it's that" constructions, and it is not estimating the likelihood that a machine wrote something. We wrote a whole piece about those tells in The Punctuation That Snitched, and this is the technology that retires that entire genre.

What it actually does is change where the randomness comes from. In Anthropic's own words: "Instead of using an arbitrary random number generator to pick the next word, watermarking uses the key and a few words that come before to settle what word the model should pick. That is, the words that Claude picks are still random, but now, one can check the sequence of words and see if it's consistent with the choices Claude would make if it was using the key." The pattern is invisible to a reader and detectable only to someone holding the key. It is a version of the SynthID-Text approach DeepMind published in Nature in 2024, in a family going back to a 2022 proposal by Scott Aaronson.

Second, it can be defeated, and Anthropic says so plainly. "Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will. In the latter case, of course, it's arguable whether the text can any longer be described as AI-generated." That last clause is the honest one, and it is doing more work than it looks like: at the point where a person has replaced every word, the question the detector was built to answer has stopped being a meaningful question.

Third, and this is the part that should reach whoever writes your policy, it misleads in both directions.

It produces what look like false positives, because Matt G. Southern points out that people routinely use these models to proofread, translate, summarise or convert their own files. Any of those can leave the mark on writing whose ideas and words originated with a human. A hit means the model touched the text. It does not mean the model wrote it, and treating those as the same thing is how you end up accusing your own staff.

And it produces false negatives by design, which is the more dangerous half. The Code of Practice does not require watermarking of free-form text shorter than 200 tokens. Anthropic acknowledges that marked content may not carry a detectable mark at all, and as of Southern's reporting its help page named no model that currently carries one. OpenAI's provenance page lists C2PA and SynthID for images and SynthID for audio, and does not list text as a supported format. Meta and Microsoft are signatories of the same Code, and SEJ found no specific text-marking policies from either as of 13 August. So a clean result tells you nothing whatsoever. Not that a human wrote it, not that no model was involved, only that this particular key did not match.

Fourth, the compliance trap. Article 50(2) of the EU AI Act puts the marking duty on the provider of the model. Article 50(4) puts a separate labelling duty on the deployer for deepfakes and for AI-generated text published as public-interest information, and the European Commission has clarified that deployers cannot rely solely on the provider's machine-readable mark to discharge that obligation. If you publish, the vendor's watermark does not do your job for you. Around 190 organisations had signed the Code by the end of July, including Google, Meta, Microsoft, OpenAI and Anthropic in Section 1 and Getty Images, Lenovo and Lufthansa in Section 2, so the number of companies now holding a duty they may believe has been discharged upstream is not small.

All of which sharpens the argument rather than changing it. Provenance has moved into a layer you cannot see, the instrument that reads that layer is honest about being partial, and the obligation to declare what you published stayed exactly where it was: with you.

Two of our own recent pieces land directly on this. In The Default Is Now Action we argued that disclosure is increasingly applied by a classifier reading your pipeline's provenance metadata rather than declared by you. Google has now made that literally true by making the human-readable half optional. And in Seven Days, By Default, published on Saturday, the whole argument was that a safeguard living in a settings screen is a preference rather than a constraint. The visible watermark is now, precisely and literally, a setting with a toggle.

What the machine reader actually sees

If the machine is now the reader that matters, it is worth knowing how well it reads. Jonathan Kemper at The Decoder covered PerceptionBench, which tries to isolate visual perception from reasoning and world knowledge by breaking seeing into ten atomic sub-skills: visual relation, counting, attributes, depth and 3D, localization, comparison, fine-grained recognition, context integration, OCR and hallucination. It uses 3,000 tasks drawn from more than 17,000 verified questions, 60% of them derived from actual model errors.

No model cleared 60%. GPT-5.6 Sol led at 59.7%, then Kimi K3 at 58.5%, Claude Fable 5 at 57.2%, Gemini 3.1 Pro at 56.2%, GPT-5.5 at 55.8%, Qwen3.5-397B-A17B at 47.5% and GLM-4.6V at 32.5%. On the hallucination category the leader scored 26.9%.

Two caveats, both of which we would want applied to a number we published. PerceptionBench comes from Moonshot AI, and Moonshot's own Kimi K3 places second on it. That is the same disclosure we attached to the vendor-commissioned survey in Faster Than You Can Count: it does not make the work wrong, it means the result wants independent replication before anyone builds a decision on it. And the striking human comparison that has been circulating, 94.1% against a model score of 49.7%, is from a different benchmark called BabyVision, not from PerceptionBench. It is a real contrast and it is not a human baseline for these scores. We nearly conflated the two ourselves.

What makes this belong in the same piece as the rest is which sub-skills are weakest. Counting. Localization. OCR. Resistance to hallucination. Those are not exotic research problems, they are the exact operations that every automated document and image pipeline in commercial use depends on: reading a total off an invoice, finding the damage in a claim photo, counting units in an inventory shot, pulling a number off a form.

So hold both halves of the machine reader in your head at once. It reads your text with a fluency that is genuinely uncanny, and it looks at your images like something that has not finished learning to see. Those two facts living inside one system is the reason "the AI checked it" is not a sentence that carries information.

Your own screen becomes an input

The last of the five is the one most likely to arrive at your company without a decision being made. Matthias Bastian at The Decoder describes OpenAI's Computer History, a macOS feature that captures clicks, keystrokes, keyboard shortcuts and app switches through the operating system's accessibility layer and turns them into a searchable memory timeline the assistant can draw on.

Give the design its due, because a lot of it is careful. It records no screenshots, no screen recordings, no microphone and no system audio, and excludes private browsing. Consent is layered: in Business and Enterprise workspaces an administrator has to enable it, then each user has to consent separately, and the Memories feature has to be on. Users control which apps and sites contribute through include and exclude lists. Temporary event files sit on the Mac for 48 hours and are then deleted, and the memory files are not used for training. It is not available in the European Economic Area, Switzerland or the United Kingdom.

Two details belong in a policy rather than a product review. The generated memory files persist as unencrypted plaintext Markdown on the local file system until somebody manually deletes them. And OpenAI processes the temporary files on its servers, saying it does not keep them after processing unless required by law.

Then there is the part that ties the whole week together. OpenAI itself flags a heightened prompt injection risk in this feature, and recommends excluding apps that handle health, financial or personal data. Set that beside the Connecticut filing. Elliott hid an instruction in a document in the hope that a machine would read it and obey. Computer History is a product designed to read what is on your screen and hand it to a model with memory. The vendor is telling you, in its own documentation, that the thing to worry about is that something on your screen will turn out to be an instruction.

That is not a reason to refuse it. It is a reason to make the decision on purpose, with the include and exclude lists written before the feature is enabled rather than after, which is the same argument we made about internally generated apps in Data Never Leaves and about vendor tool grants in Ask For The Prompt.

The gate, again

Judge Spader wrote the sentence this entire piece has been walking toward. In Connecticut and in Brazil alike, he observed, the hidden prompts were "exposed, in each of those settings, the moment a human being actually looked at what the machine produced."

We have made that argument three times this year from three different directions: in The Harness Is the Product about coding agents, in One Letter Off, Guns Drawn about a misread plate becoming a felony stop, and on Saturday in Seven Days, By Default about who is able to switch a safeguard off. It is considerably more persuasive coming from a judge who arrived at it independently, from an entirely different direction, working from a case file instead of a threat model.

And the gate does not have to be clever. In every one of these stories the defeating move is the same and it is embarrassingly cheap. Extract the text a machine will actually ingest, and compare it to the page a human actually approved. Flag anything that appears in one and not the other. That is a short script, not a project, and almost nobody runs it, for one reason: the document looked fine.

"Looked fine" is the phrase to be afraid of now. It is a statement about exactly one of your two readers.

The playbook

Six moves, none of which require a new vendor.

1. Read what the machine reads. For any document arriving from outside that gets processed automatically, extract the text layer and diff it against the rendered page. Zero-size fonts, white on white, off-canvas positioning, metadata, alt text and comments all count as content the machine sees and you do not.

2. Treat inbound documents as untrusted input rather than as content. The security model for a resume or an RFP response is now the security model for a form field. Nothing a stranger sends you should reach a model that is in a position to act on it.

3. Decide who owns the detector before you write the policy. If your rule depends on provenance no human can see, you have taken a dependency on somebody else's tool. Learn how it fails, and write the rule against what it actually returns.

4. Do not let a provenance mark be a setting. If your organisation needs the visible watermark, mandate it in your own pipeline and check it on output. The platform just demonstrated that its half of that promise can move into a menu.

5. Match the automation to the sub-skill, not to the demo. Counting, localization and OCR are the measurable weak spots. If a workflow leans on any of them, sample its output and grade it yourself rather than trusting an aggregate score from anybody, including us.

6. Ask the model to argue against the position before you act on it. Which brings us to the last thing the judge said.

Our position

Spader did not stop at the sanction. He offered a diagnosis of how a person ends up hiding white text on white paper, and it is the most useful paragraph in any of the week's reporting.

What frequently happens with self-represented litigants, he wrote, is that they build the argument backward, asking a chatbot to help advocate for their position without ever asking it for the truth or to make the opposing case. Sycophancy then entrenches them, and no ruling to the contrary can dislodge it. He called it "a genuine hazard of the technology, and one that judges now see often." Then: "An argument prompted only to agree with its author is, in the end, dishonest even with its author. Those using these tools must ask them to test a position as readily as to advance it."

That is the through-line, and it reframes the other four stories. The invisible layer is a technical problem with a cheap fix, and we have given you the fix. But the reason a person sits down and writes instructions in white on white is not technical at all. It is that the machine had been agreeing with him for months, and the machine agreeing with you is the most expensive free feature in the industry.

So our position is three sentences. Build the diff, because your intake is now an attack surface and the check costs an afternoon. Own the detector, or do not write the policy that depends on it. And be considerably more suspicious of any system that has never once told you that you were wrong, whether that system is a model, a benchmark, a vendor, or the version of your own argument that only ever got prompted to win.

Sources

Every claim above is carried from the reporting below, credited in the body and linked here. Where sources disagree or where a figure comes from a different study than the one under discussion, we have said so rather than smoothed it over.

Related Reading