<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Carlos Ortet Tech]]></title><description><![CDATA[Carlos Ortet Tech]]></description><link>https://carlosortet.hashnode.dev</link><generator>RSS for Node</generator><lastBuildDate>Sat, 24 Oct 2026 17:19:03 GMT</lastBuildDate><atom:link href="https://carlosortet.hashnode.dev/rss.xml" rel="self" type="application/rss+xml"/><language><![CDATA[en]]></language><ttl>60</ttl><item><title><![CDATA[You need to sign your content. Anthropic already marks everything Claude generates and you still don’t]]></title><description><![CDATA[Originally published at carlosortet.com. Republished here with canonical. It matters more than ever, and it is more urgent than ever, to be able to prove…]]></description><link>https://carlosortet.hashnode.dev/you-need-to-sign-your-content-anthropic-already-marks-everything-claude-generates-and-you-still-don-t</link><guid isPermaLink="true">https://carlosortet.hashnode.dev/you-need-to-sign-your-content-anthropic-already-marks-everything-claude-generates-and-you-still-don-t</guid><category><![CDATA[AI]]></category><category><![CDATA[geo]]></category><category><![CDATA[content]]></category><category><![CDATA[llm]]></category><category><![CDATA[Machine Learning]]></category><category><![CDATA[Copywriting]]></category><dc:creator><![CDATA[carlos ortet]]></dc:creator><pubDate>Sat, 15 Aug 2026 15:56:52 GMT</pubDate><enclosure url="https://cdn.hashnode.com/uploads/covers/69766260458247a1a87d5074/94c106c8-7a71-4d66-b3d0-bfb93ad569b7.jpg" length="0" type="image/jpeg"/><content:encoded><![CDATA[<blockquote>
<p>Originally published at <a href="https://carlosortet.com/blog/sign-your-content-anthropic-marks-claude">carlosortet.com</a>. Republished here with canonical.</p>
</blockquote>
<p>It matters more than ever, and it is more urgent than ever, to be able to prove that a model has read and used our content. There is an opportunity window to mark your content and this is before a model uses it.</p>
<p>On 10 July I published an article here about the idea of hiding an impossible date inside a text so you could prove, later, that an AI had trained on it. Thirty two days later, on 11 August 2026, Anthropic confirmed that all the text Claude generates comes out marked with a similar kind of watermark.</p>
<p>I read it as a win for the whole idea of watermarking LLMs but instead of us marking what the AI swallows, it is the AI marking first what it creates itself. Not ideal but it is still a step ahead. It means the people who understand these models best have just shown the technique works. What is missing is applying it on the other side. Which is not easy and it is not solved yet.</p>
<h2>What you need to know</h2>
<ul>
<li><p>Anthropic marks Claude text across all its products and worldwide, not just in the European Union. Models launched from 2 August 2026 ship with marking built in.</p>
</li>
<li><p>The mark proves that Claude <strong>may have processed</strong> that text. It does not prove Claude wrote it, or that whoever published it used AI. Anthropic says so itself.</p>
</li>
<li><p>The most repeated objection, that marking degrades the output, has had an answer since 2023: there are schemes with no such conflict. The real limit is set by entropy (a parameter I have written about before, and it keeps coming back).</p>
</li>
<li><p>What the industry solved in 2026 is marking what <strong>comes out</strong> of a model. What it has not solved is proving what <strong>went in</strong>. That is where we come in.</p>
</li>
<li><p>Both halves have weak points. Work presented at EACL 2026 already forges another model's mark (a disaster). Another paper from 2025 strips watermarks with a 99% success rate and no access to the model (checkmate).</p>
</li>
<li><p>A small correction to my July article: I wrote that a mark appearing only once is undetectable. An ICML 2025 paper shows otherwise, if you act before publishing.</p>
</li>
</ul>
<h2>What Anthropic has actually done</h2>
<p>Sticking to the facts is the only way to understand the situation and the futures it opens.</p>
<p>Anthropic signed the Code of Practice on Transparency of AI-Generated Content, the instrument that develops article 50(2) of the European AI Regulation. The Commission found it adequate on 8 July 2026 and the AI Board on 9 July. The obligations apply from 2 August.</p>
<p>From there, Anthropic takes three key decisions.</p>
<p>The first: models launched from 2 August 2026 mark every text they generate, and earlier ones will follow with no announced date.</p>
<p>The second: the mark sits at model level and applies worldwide, not only in Europe.</p>
<p>The third: the watermark applies to absolutely every surface. The Claude apps, the API, Claude Code, Cowork, Tag, and also when the model runs inside AWS Bedrock, Google Cloud or Microsoft Foundry. There is no door that lets you get clean content out, and no way to switch it off has been documented.</p>
<p>On the mechanism used as the mark, Anthropic has been shy. It says the mark "is part of the text", that it travels with it when copied and pasted, and that it "may persist through some editing". For the files it generates in .svg, .png and .jpg it attaches signed metadata using the open C2PA standard (which we already explained in the 10 July article).</p>
<p>It has announced technical documentation and detection tools, but as of 12 August 2026 it has not published them. TechCrunch asked how much editing it takes to remove the mark and got no answer (in the previous blog post we explained this phenomenon and its limits).</p>
<p>What we do know is what kind of mark it uses, because it is the only one that fits "part of the text" and survives copy and paste: the token choice is steered at generation time, with a secret key. Within that territory, though, there are two very different families, and the difference between them is exactly what watermarking experts have argued about most since this system was announced.</p>
<p>The first is the green list I explained in the July article (<a href="https://proceedings.mlr.press/v202/kirchenbauer23a/kirchenbauer23a.pdf">Kirchenbauer et al., ICML 2023</a>): the key splits the vocabulary at each step and a nudge is added to the logits of the green tokens. It works, and it has a cost: it touches the system's probability distribution, so it raises the perplexity of the text. We do not love that, though it will not be visible to most users.</p>
<p>The second family of watermarks does the same without touching the distribution. These are the schemes called distortion free: Scott Aaronson's at OpenAI, based on the Gumbel-Softmax rule, and <a href="https://eprint.iacr.org/2023/763">Christ, Gunn and Zamir's</a>, who prove that without the key nobody can tell marked text from ordinary text. It is also how DeepMind's SynthID-Text works.</p>
<p>Which of the two Anthropic uses, they have not clarified. But they claim the mark does not change the quality or readability of the response, and that property is only proven in the second family. So either they are in the distortion free family, or their claim is empirical and carries no rigour. My inclination is that they use a distortion free system.</p>
<p>This news inside the wider AI picture: Google signed the same code on 24 July 2026 and pulled Apple, NVIDIA, ElevenLabs, Kakao and OpenAI into adopting SynthID.</p>
<p>OpenAI has applied marking and C2PA to its images since 19 May 2026 and to its audio, but not to its text. That makes Anthropic the first to mark text at this scale. The others will follow.</p>
<p>When are we going to mark our own content? Is that technology of watermarking persistent at the source not just as important for the industry and for society, if not more? That is exactly why at 498 Advance we have spent almost a year working on this, and now with more conviction than ever.</p>
<h2>The market keeps promising solutions with no scientific basis that, predictably, do not work.</h2>
<p>I am excited that the line of work has been validated, that what we built will be useful and that we can carry on. What we were seeing in the market left us puzzled, and the promises from other teams did not square with the scientific evidence we know. What follows is anecdotal, but it is worth telling.</p>
<p>Within days, tools appeared promising to strip Claude's watermark. The analysis of those tools concludes that they do delete things, but not the mark: what they clean up are invisible characters, zero width spaces and the like.</p>
<p>In the July article I spent a whole section explaining why invisible ink is a bad hiding place, specifically with this line: an invisible character gets deleted by the system without thinking, with no need to understand the context; a date that cannot exist would only be deleted by someone who understands what they are reading. The market disagreed and built products on that error in under a week. Companies and users paid for the licences. Nobody bothered to research it or to ask the scientists whether that solution had any foundation.</p>
<p>I tell it because the anecdote explains why this subject is so slippery even for technical people: everyone's intuition points down the wrong path. All the knowledge built over decades of scientific research has enormous value, and we can and should use it to move forward.</p>
<h2>The quality argument, answered in 2023</h2>
<p>Of everything said since 11 August, the objection that comes up most is that marking has to make the output worse. You cannot optimise for the best answer and for carrying a mark at the same time, the argument goes, and least of all when what you generate is code. Anthropic's claim that quality is unaffected has taken a beating.</p>
<p>The question already has an answer, and it is three years old. In August 2023 Scott Aaronson gave a talk at the Simons Institute about the scheme he was working on at OpenAI, and closed with this: people seemed to have an intuition that there would inevitably be a trade off between watermarking and output quality, and in fact there is none. In his scheme the token choice is made so that it looks exactly like ordinary sampling to anybody without the key. The text does not get worse because, statistically, and for the human eye, it is the same text.</p>
<p>So the community intuition is right for the green list family and wrong for the other one. And that has a practical consequence I find quite interesting: if Anthropic were degrading quality, somebody would measure it and the debate would be over, nothing would be more fun than that. That nobody has published such a measurement suggests, again, that they are in the second.</p>
<p>There is a real limit, though, and it is entropy.</p>
<p>Aaronson quantified it: the number of tokens you need to see the mark grows as the inverse square of the average entropy per token. If the model had little room to choose (low entropy), there is little mark to plant. Ask it for the first hundred prime numbers and the entropy is zero, so there is no way to mark anything, though it hardly matters who gets credit for that list. Because a text with no entropy means there has been no generalisation, it is probably uncontestable data, with no original thought or narrative (that is my intuition, I have not studied it properly). A few hundred tokens is usually enough, and with a few thousand the confidence is very high.</p>
<p>So the complaint that the mark makes code worse has no basis: it simply marks it weakly, because in the stretches where there is only one reasonable way to write something the model had nowhere to hide the signal. It is the same reason the mark is unreliable on short passages. In any other scenario the mark will work very well and does not degrade quality at all.</p>
<h2>The easy half is solved. But, like everything, it has weak points.</h2>
<p>Marking a model's output is the easy problem. The provider controls the moment of generation, controls the key and controls the detector. That is why it got solved first, and why the regulation was able to mandate it from the moment it applied.</p>
<p>That it is solved does not mean it is robust, though, and this is where the 2025 and 2026 literature makes a few people uncomfortable.</p>
<p>The most elegant attack is called BIRA and it evades the mark with a success rate above 99% across several watermarking schemes, keeping the meaning of the text intact.</p>
<p>It needs no access to the model and no queries: it inverts the bias, applying a negative nudge to the tokens identified by surprisal, and detection collapses exponentially. The code is published and, in a first informal test on our side, with no protocol or formal metrics, it worked consistently.</p>
<p>The second one goes for the throat of the idea of proof, and rests on a rather entertaining trick. It is called DITTO, it was presented as an oral at EACL 2026, and it does the opposite of erasing: it <strong>forges</strong>. By distilling from a marked model, an attacker steals the victim's signal and then emits text carrying somebody else's mark. In other words, disinformation can be manufactured that looks like it came out of Claude.</p>
<p>The irony is clear. The mechanism DITTO exploits to forge is radioactivity, exactly the same phenomenon I was defending in July as the route to <strong>prove</strong> that somebody had trained on your content. The property that turns a watermark into evidence is the one that turns it into a forgery kit. It is the same thing seen from two sides. What interests us is how to apply that principle to mark original texts, before they go into an LLM, so the mark is durable even after being tokenised or reused by a second model.</p>
<p>The third mechanism speaks to exactly that durability, and this one hits me personally. In July I wrote that the A→B→C distillation chain was an open frontier and that, as far as I knew, no study had measured it. I was wrong: an ACL 2025 paper measured it, and the result does not favour my hypothesis: watermarks do not survive distillation when the attacker wants to avoid them. Targeted paraphrasing before distilling, or neutralisation at inference time, and the inherited mark disappears while knowledge transfer is preserved. It seems we have no escape route here, or at least not with this technique: if one model exploits another that used your content (marked for traceability and protection), this technique does not guarantee you can identify it. At least not if the attacker wants to avoid it.</p>
<p>So what still stands is what the theoretical work I cited a few months ago already said: <strong>no strong watermark is unremovable.</strong></p>
<h2>The hard part is the interesting one: proving what went in</h2>
<p>The models have got ahead of us in applying a mark to content. They generate it from our content and then sign it. It is an unbalanced situation, because we still have no system that identifies and protects the original content and its source.</p>
<p>In 2026 the industry and the regulator built a system so that a model can prove what it has written. Nothing equivalent exists for a creator to prove what has been read, or that it was used for training or for generating answers. Anthropic can prove Claude generated a text. A publisher cannot prove Claude read or processed its catalogue.</p>
<p>It is the same asymmetry inside the Regulation itself: article 50 mandates marking the output and has a code of practice, a deadline and signatories. Transparency about training data exists on paper, but there is no independent verification tool. The regulator asks for a declaration and has nothing to check it with.</p>
<p>This was clear from the start. In the question session of that 2023 talk, somebody in the audience put it to Aaronson in these terms: what about the producing end, the creator who needs to prove they wrote it themselves? The answer was that at most you are ruling out an alternative hypothesis. Which is to say, not even the designer of the scheme had anything to offer on this side of the board. And the provider's watermark is no use for this problem: it certifies that Claude touched a text, not that Claude read yours.</p>
<h2>STAMP changes the situation</h2>
<p>In the July article I devoted a section to what I called the memorisation wall. My argument: marking is easy, but detection requires the model to have learned the mark, and models only learn what they see many times.</p>
<p>I quoted the numbers from the copyright trap literature: a hundred tokens repeated a thousand times are detected with reasonable reliability, twenty five tokens are detected close to chance, and ninety appearances as a threshold in a giant model. And I concluded that a unique phrase, hidden once, would be caught by nobody.</p>
<p>That conclusion is correct for literal traps, of the January 32 kind. But it cannot be generalised, and for the general problem it is false.</p>
<p>A paper presented at ICML 2025, STAMP, detects content that appears <strong>a single time</strong> in the training data and represents less than 0.001% of total tokens. You generate several watermarked rephrasings of your text, publish one and keep the rest private, then compare what likelihood the model assigns to the public version against the private ones. If the model has seen it, it prefers the one you published. The authors validate it on paper abstracts and blog articles, which is exactly our use case.</p>
<p>The impossible date (just an idea but there are many other options in the same direction) is still the only marking layer a human being can <strong>see</strong>: a judge, a journalist or a client understands in three seconds why day 32 cannot be there by accident. STAMP needs an expert witness and a statistical test. They are complementary layers. But if what you want is detection strength, the impossible date technique (the date was only an example of a carrier, but it illustrates the idea) is the legible layer and STAMP is the layer that actually detects.</p>
<p>So there is a route to a solution here.</p>
<p>Which means what conditions this whole line of work is that <strong>you have to act before publishing</strong>.</p>
<p>STAMP is no use for claiming over something you published five years ago unmarked. And that is precisely the problem of almost the entire publishing sector: it found out it was raw material when the LLMs had already swallowed and digested its whole catalogue. That said, a publishing house puts out thousands of new texts every year, institutions and citizens generate original ideas that ought to be signable, so the problem remains central and still needs a solution.</p>
<h2>A mark should not be confused with a detector.</h2>
<p>This is going to happen.</p>
<p>Anthropic has been careful with the nuance, and I will use their words:</p>
<blockquote>
<p>A detected mark provides a signal that content was processed by Claude, but is not fully conclusive. Detecting a Claude mark tells you that the content may have been processed by Claude. It does not, on its own, confirm the full provenance of the content. Lack of a detected mark doesn't mean the content wasn't AI-generated or processed.</p>
</blockquote>
<p>Somebody may have used Claude to translate, proofread or summarise human material. And the absence of a mark proves nothing either: it could come from an earlier model, another provider, or a heavily edited text.</p>
<p>A good part of the general worry comes precisely from here. If the mark does not confirm authorship and its absence rules nothing out, plenty of people have concluded that, well, what is it for?</p>
<p>The most widespread unease is the scarlet letter: using Claude to revise your own text and having it come out marked as though the machine had written it. The same happens with other applications. Picture a student who writes their essay and then runs it through a corrector like Grammarly. Picture that app applying the marking, and the teacher who grades the work spotting the mark of an AI system. The text will be flagged as AI generated when it was not.</p>
<p>It is a reasonable worry, and exactly the one the paragraph above is trying to defuse. The trouble is that the nuance sits in one paragraph in a help centre buried among hundreds of pages of text, while accusations of AI use are made daily in an office and affect people's lives. This is happening among educational institutions as we speak.</p>
<p>The problem is going to be institutional. There will be universities and companies treating the mark as if it were an AI detector, and it will be a disaster. A reference study on seven commercial detectors found a false positive rate of 61.3% on essays by Chinese students against 5.1% on essays by United States natives, because perplexity based methods systematically penalise simpler vocabulary.</p>
<p>To be clear, a cryptographic watermark and a perplexity detector are technically different, and the first is far more reliable. But the way institutions use an automated signal against a person does not depend on the quality of the signal. And that is why it is inevitable that somebody ends up accused of illicit AI use simply for having run Claude over their own text to fix the spelling.</p>
<p>This is not new either. In the 2023 talk, Aaronson listed the questions holding up deployment of the scheme at OpenAI, and one of them was exactly this: if there are people who should be able to use a language model without having to declare it, such as someone writing in a language that is not their own and using it to improve their English, is it fair that everything they do comes out marked? His answer was that he did not know how to build a marking tool that works only for the cases you disapprove of and not for the ones you sympathise with.</p>
<p>Three years on, the tool has already shipped and that question is still unanswered. It is also still unclear who will get access to the detector. Anthropic has announced its own and has not yet said who will be allowed to use it.</p>
<h2>For a change, this one is about money.</h2>
<p>The business impact of all this is enormous, and it is the engine behind the interest in marking. Happily, any progress in this area also helps us move forward in our search for protection of authorship and safeguarding of the truthfulness of information. Three figures that show the economic stakes:</p>
<p>First. Anthropic agreed to pay 1.5 billion dollars to authors and publishers, around 3,000 dollars per work across some 500,000 works, after a court held that downloading books from pirate sites was infringement even though the training itself was fair use. The distinction is the key to everything: what was judged was not training, it was <strong>provenance</strong> (a very interesting precedent for us).</p>
<p>Second: there were more than 35 active training data lawsuits in the main Western jurisdictions in the second quarter of 2026, and discovery in those cases turns precisely on the provenance of each book, image or article in the dataset.</p>
<p>The third looks ahead: from 15 September 2026, Cloudflare blocks mixed use crawlers by default on pages carrying advertising, and pushes a pay per use model so AI companies compensate publishers (Cloudflare is winning my sympathy by the day).</p>
<p>All three point the same way. The value is no longer in holding the content, it is in documenting the use it was put to. I have not yet managed to make any media company see this; they remain set on hoarding and protecting access to content. What good is installing alarms once the safe has already been emptied? And that capability sits with the AI lab, not with whoever wrote the text.</p>
<h2>Why at 498 Advance we are working to find the best source marking system.</h2>
<p>Traceability is key to a huge number of solutions. Knowing that a text generated by ChatGPT comes from particular sources lets us guess how the system works inside, and it also helps us judge how reliable that answer is. It also lets us assess the return on the effort of informing LLMs better.</p>
<p>If I invest in producing high value information about medicine or animal care and I can confirm the AI is using it, then it makes sense to keep investing. On top of the obvious reasons of protecting both proprietary information and trade secrets which, more and more, will live in local or private AI models and will be open to being squeezed by training or search crawlers from larger models.</p>
<p>What Anthropic has done, stripped of noise, is equip itself with a defensive capability: it can demonstrate what came out of its model, with what coverage and under what conditions. That is legitimate and sensible. What I find intolerable is that the same capability is out of reach for a publisher, who is the other party to the contract and the one who supplied the raw material.</p>
<p>A publishing house, a news outlet, a photo archive or an individual author are in the opposite position: they were feedstock for training, many without knowing it and almost all finding out after the fact, and they have no tool to exercise the defence Anthropic does exercise. That asymmetry is not a law of nature. It is a missing product. 498 Advance wants to build that solution and, at the same time, to have a system for calculating the ROI of GEO work.</p>
<p>498A, the R&amp;D lab at Zoopa, is working on the two layers that are still unsolved. The first goal is to understand the system and its formal limits thoroughly, and to build a solid way of working from there. That system can be embodied in different products later. Without a solid scientific base we would fall into the same error as the products that rushed to promise mark removal and have now been shown to be useless.</p>
<p>The first layer to solve is marking for publishers: marking content at the moment of publication, with a legible mark and a statistical mark at the same time, and keeping a timestamped registry. What matters about the timestamp is that it does not depend on detection being perfect: it proves when you planted the mark, and that chain of custody is what makes any later claim credible.</p>
<p>A few weeks ago I discussed this solution with the head of the largest publishing house in the world, and mentioned it in passing to executives at one of the most important news groups in Latin America. In both cases I failed to convey the strategic importance of the matter and came away with a "we are already looking into it". It is worrying that there is no joint initiative among the large publishing groups, because it would have enormous social and cultural value.</p>
<p>The second is a traceability layer tied to the AI Regulation: the regulator demands transparency about training data but has nothing to verify it with, and nobody should trust a lab that audits itself. That need for a neutral third party has a long runway, and I do not see anyone occupying it.</p>
<p>With GEORadar we measure how models see and cite you. For that task, and for putting the key information in front of the AI crawlers, knowing the origin of the data reliably is fundamental.</p>
<p>What we will not promise is the same as in July, and now with better reason: we are not going to chase a mark through a chain of distillations, because ACL 2025 has shown that a determined attacker will remove it without difficulty.</p>
<h2>The question that will not let me enjoy my holidays</h2>
<p>In 2026 the industry already knows how to sign what it says. There is still no simple way to certify what has been read and is being used.</p>
<p>While that asymmetry stands, whoever wrote the text is defenceless, and the system does not reward the creation of reliable, high quality content. The burden of proving authorship falls on the side with the fewest resources.</p>
<p>Both the impossible date and STAMP require having acted <strong>before</strong> publishing. Every article that goes out unmarked is a claim that can no longer be made later.</p>
<p>So I am left with a different question. If you publish original work: how many years of that work are you willing to write off before you start marking what you make?</p>
<hr />
<h2>Glossary</h2>
<ul>
<li><p><strong>C2PA:</strong> open content provenance standard. It attaches cryptographically signed metadata to a file stating who generated it and how. It is removed by simply reformatting or taking a screenshot.</p>
</li>
<li><p><strong>Spoofing (mark forgery):</strong> generating text carrying another provider's watermark, so authorship is attributed to somebody who did not write it.</p>
</li>
<li><p><strong>Token surprisal:</strong> a measure of how unexpected a token is in its context. Watermarks hide preferentially in surprising tokens, which is why attacks look for them there.</p>
</li>
<li><p><strong>Likelihood:</strong> the probability a model assigns to a specific text. Comparing the likelihood of two versions of the same text lets you infer which one it has seen before.</p>
</li>
<li><p><strong>Article 50 of the AI Regulation:</strong> the transparency layer of the European rule. Among other things it mandates machine readable marking of AI generated content. It applies from 2 August 2026.</p>
</li>
<li><p><strong>498 Advance:</strong> R&amp;D lab created by the agency Zoopa, focused on AI and visibility in generative search.</p>
</li>
</ul>
<h2>Frequently asked questions</h2>
<p><strong>Is everything I write with Claude marked?</strong> If you use a model launched from 2 August 2026, yes, and the surface makes no difference: app, API, Claude Code, Cowork, Tag, or the model running inside AWS, Google Cloud or Microsoft Foundry. No way to switch it off has been documented.</p>
<p><strong>Does the mark prove a text was written by an AI?</strong> No. It proves Claude may have processed it. That is compatible with you writing the text and using Claude to translate, summarise or proofread it. Anthropic clarifies this itself.</p>
<p><strong>Does marking make responses worse, especially code?</strong> It depends on the scheme. In the green list family there is a cost, because the probability distribution is altered. In the distortion free family there is none, and it is proven: without the key, marked text is indistinguishable from ordinary text. With code something different happens: the code keeps its quality and simply carries a weak mark, because where there is only one reasonable way to write something there is no entropy left to hide the signal in.</p>
<p><strong>Can it be removed?</strong> With heavy paraphrase, yes. The tools sold in the first days did not remove it: they cleaned up invisible characters, which is a different thing. And the literature has attacks with over 99% evasion without access to the model.</p>
<p><strong>Does this help me prove an AI trained on my content?</strong> No, and that is the point of the article. Anthropic's mark runs the other way: it certifies what leaves the model, not what went in. For the second you need to mark your content before publishing it.</p>
<p><strong>What can I do if I published my archive unmarked?</strong> Little, by the watermarking route. Both the impossible date and STAMP require acting before publication. For what is already published there are other routes: a timestamped registry of what was published and when, crawler control, and the contractual and judicial route, where data provenance is the axis of the cases.</p>
<p><strong>What if somebody forges Claude's mark on a text of mine?</strong> It is a scenario documented in the literature since EACL 2026, not a hypothesis. That is why the nuance about the mark indicating processing rather than authorship matters more than it appears to.</p>
<h2>Sources</h2>
<ul>
<li><p>Anthropic. Help centre article on content marking, updated 11 August 2026. Reported in <a href="https://techcrunch.com/2026/08/11/anthropic-says-it-will-watermark-text-generated-by-its-ai-models/">TechCrunch</a>, <a href="https://www.forbes.com/sites/maryroeloffs/2026/08/11/claude-will-put-invisible-watermarks-on-ai-text-and-images-and-the-internet-isnt-happy/">Forbes</a>, <a href="https://fortune.com/2026/08/11/anthropic-claude-watermark-ai-text-police-ai-slop/">Fortune</a> and <a href="https://www.euronews.com/next/2026/08/11/eu-compliance-delivered-globally-anthropic-to-watermark-claudes-output-worldwide">Euronews</a></p>
</li>
<li><p>European Commission. Code of Practice on Transparency of AI-Generated Content, article 50(2). Found adequate on 8 and 9 July 2026. <a href="https://digital-strategy.ec.europa.eu/en/library/how-sign-code-practice-transparency-ai-generated-content">digital-strategy.ec.europa.eu</a> · analysis at <a href="https://www.twobirds.com/en/insights/2026/taking-the-eu-ai-act-to-practice-the-final-transparency-code-of-practice">Bird &amp; Bird</a></p>
</li>
<li><p>Aaronson, Scott. "Watermarking of Large Language Models". Simons Institute, Berkeley, 17 August 2023. <a href="https://simons.berkeley.edu/talks/scott-aaronson-ut-austin-openai-2023-08-17">simons.berkeley.edu</a></p>
</li>
<li><p>Kirchenbauer, Geiping, Wen, Katz, Miers and Goldstein. "A Watermark for Large Language Models" (the green list). ICML 2023. <a href="https://proceedings.mlr.press/v202/kirchenbauer23a/kirchenbauer23a.pdf">proceedings.mlr.press</a></p>
</li>
<li><p>Christ, Gunn and Zamir. "Undetectable Watermarks for Language Models" (distortion free family). 2023. <a href="https://eprint.iacr.org/2023/763">eprint.iacr.org/2023/763</a></p>
</li>
<li><p>Rastogi, Maini and Pruthi. "STAMP: Proving Dataset Membership via Watermarked Rephrasings". ICML 2025. <a href="https://arxiv.org/abs/2504.13416">arXiv:2504.13416</a></p>
</li>
<li><p>"Can LLM Watermarks Robustly Prevent Unauthorized Knowledge Distillation?". ACL 2025 (Main). <a href="https://arxiv.org/abs/2502.11598">arXiv:2502.11598</a></p>
</li>
<li><p>"DITTO: A Spoofing Attack Framework on Watermarked LLMs via Knowledge Distillation". EACL 2026 (oral). <a href="https://arxiv.org/abs/2510.10987">arXiv:2510.10987</a></p>
</li>
<li><p>"LLM Watermark Evasion via Bias Inversion" (BIRA). 2025. <a href="https://arxiv.org/abs/2509.23019">arXiv:2509.23019</a></p>
</li>
<li><p>Sander, Fernandez, Durmus, Douze and Furon. "Watermarking Makes Language Models Radioactive". NeurIPS 2024. <a href="https://arxiv.org/abs/2402.14904">arXiv:2402.14904</a></p>
</li>
<li><p>Zhang, Edelman, Francati, Venturi, Ateniese and Barak. "Watermarks in the Sand". ICML 2024. <a href="https://arxiv.org/abs/2311.04378">arXiv:2311.04378</a></p>
</li>
<li><p>Google. Signing of the transparency code and expansion of SynthID, 24 July 2026. <a href="https://gcn.com/synthid-watermarking-google-signs-act-transparency/20021/">gcn.com</a></p>
</li>
<li><p>OpenAI. "Advancing content provenance for a safer, more transparent AI ecosystem". <a href="https://openai.com/index/advancing-content-provenance/">openai.com</a></p>
</li>
<li><p>Analysis of the market for Claude watermark removal tools. <a href="https://medium.com/@y.raj1457/claude-watermarks-its-text-now-and-the-removal-tools-miss-it-2ab7ccfd86a3">Medium, August 2026</a></p>
</li>
<li><p>Cloudflare. Default blocking of mixed use crawlers from 15 September 2026. <a href="https://techcrunch.com/2026/07/01/cloudflares-new-policy-pushes-ai-companies-to-pay-for-publishers-content/">TechCrunch</a></p>
</li>
<li><p>Data on false positives in commercial detectors against essays by non native students. Reported at <a href="https://www.editage.com/blog/ai-detection-in-academic-writing-ai-detectors-accuracy-false-positives-and-researcher-concerns/">Editage</a></p>
</li>
<li><p>Ortet, Carlos. "January 32: how to know if an AI trained on your content, and prove it". 10 July 2026. <a href="https://carlosortet.com/blog/how-to-know-if-an-ai-trained-on-your-content">carlosortet.com</a></p>
</li>
</ul>
]]></content:encoded></item><item><title><![CDATA[48,000 characters in 2,700 tokens: how LLMs read text as images]]></title><description><![CDATA[Why rendering dense text as a PNG cuts LLM token costs 59-74%, what the papers say, where it breaks, and how AI systems read your website.]]></description><link>https://carlosortet.hashnode.dev/48-000-characters-in-2-700-tokens-how-llms-read-text-as-images</link><guid isPermaLink="true">https://carlosortet.hashnode.dev/48-000-characters-in-2-700-tokens-how-llms-read-text-as-images</guid><category><![CDATA[AI]]></category><category><![CDATA[llm]]></category><category><![CDATA[Machine Learning]]></category><category><![CDATA[performance]]></category><dc:creator><![CDATA[carlos ortet]]></dc:creator><pubDate>Sun, 05 Jul 2026 11:13:12 GMT</pubDate><content:encoded><![CDATA[<p>Last December I ran into, like half of GitHub, a small open source project called <a href="https://github.com/teamchong/pxpipe">pxpipe</a>, trending that week with a claim that sounds like a billing error: the same Claude Code session that cost $42.21 as plain text cost $4.51 when the bulky parts of the request were converted into PNG images before leaving the machine.</p>
<p>The only difference was that the model read most of its context with its eyes instead of its tokenizer.</p>
<p><a href="https://carlosortet.com/pxpipe-claude-code-ab-cost.jpg"><img src="https://carlosortet.com/pxpipe-claude-code-ab-cost.jpg" alt="Side by side comparison of two identical Claude Code sessions, one costing $42.21 in plain text and the other $4.51 with context rendered as images" style="display:block;margin:0 auto" /></a></p>
<p><em>The A/B that made the rounds: same session, $42.21 as text versus $4.51 with imaged context. Source: pxpipe repo (MIT).</em></p>
<p>That number is worth taking apart, because the mechanism behind it is bigger than one tool. It's a line of work that is worth looking into in detail. It explains a real cost lever for anyone running agents or long-context pipelines. And it connects to a second question: when an AI system fetches your website in real time, what does it actually see? This is key for us, since we work on GEO (<a href="http://georadar.app">georadar.app</a>) The answer involves the same vision channel.</p>
<h2>What makes the trick: images are billed by pixels, not by characters</h2>
<p>Every multimodal model prices an image by its dimensions. A 1000x1000 pixel image costs the same number of tokens whether it contains a white void or 5,000 words of dense documentation. The token meter counts pixels. It doesn't care what's painted on them. Did they miss it? Do they not care? Can it be that simple?</p>
<p>Text, on the other hand, is billed character by character. On real Claude Code traffic, dense content like code, JSON and logs runs at roughly one character per text token. The same content rendered as a tightly packed image yields about 3.1 characters per image token (this packaging is an important finding that we did not see in advance).</p>
<p>That gap is the whole trick. The canonical example from the pxpipe documentation: a block of roughly 48,000 characters (system prompt plus tool documentation) costs about 25,000 tokens as text. Rendered as a dense PNG, it costs about 2,700 image tokens. Same information, 89% fewer tokens for that block. Sounds crazy, but it's real.</p>
<p><a href="https://carlosortet.com/pxpipe-transformrequest-render.png"><img src="https://carlosortet.com/pxpipe-transformrequest-render.png" alt="Real output of the pxpipe transformRequest pipeline showing a system prompt and tool docs reflowed into one dense page of tiny text with newline markers" style="display:block;margin:0 auto" /></a></p>
<p><em>What the model actually receives: 48,000 characters whitespace-minified, reflowed into full rows, with ‚Üµ marks where the original line breaks were. Source: pxpipe repo (MIT).</em></p>
<p>To make that page readable for a vision encoder, the text goes through three preparation steps. Redundant whitespace gets stripped. The lines get reflowed to fill complete rows of the image, wrapping at columns about 1,928 pixels wide. And small ‚Üµ marks get inserted where the original newlines were, so the structure survives the compaction. A dense page packs around 92,000 characters.</p>
<h2>This is why pixels beat words at carrying words</h2>
<p>The counterintuitive part isn't the billing. It's that the model can actually read this with accuracy.</p>
<p>Sean Goedecke wrote <a href="https://www.seangoedecke.com/text-tokens-as-image-tokens/">a good analysis</a> of why the math works. A text token is a discrete choice: one option out of a vocabulary of roughly 50,000 entries, which then gets mapped to an embedding vector. An image token has no such constraint. It can occupy any point in the embedding space, which makes it far more expressive per unit. DeepSeek's research puts a number on it: about 10 text tokens can be recovered from a single image token with near perfect accuracy.</p>
<p>The idea isn't new, and that's part of what makes the current moment interesting. I saw it in a post, tried it, and have kept using it since. People have been pasting screenshots into multimodal models for years, and the standing objection was always the same: vision encoders weren't reliable enough at reading small dense type, so nobody sane would route production context through them. What changed between 2024 and now is the encoders. When DeepSeek published its optical compression results and pxpipe shipped its evals, the conversation moved from "would this even work" to "here's the exact ratio where it stops working". That's the difference between a party trick and an engineering option.</p>
<p>Here's how the main providers actually count image tokens today:</p>
<table>
<thead>
<tr>
<th>Provider</th>
<th>How an image is priced</th>
<th>A 1000x1000 px image</th>
</tr>
</thead>
<tbody><tr>
<td>Anthropic (Claude)</td>
<td>28x28 pixel patches, one visual token each: ‚åàw/28‚åâ x ‚åàh/28‚åâ</td>
<td>1,296 tokens</td>
</tr>
<tr>
<td>OpenAI (high detail)</td>
<td>85 base tokens + 170 per 512x512 tile after rescaling</td>
<td>765 tokens</td>
</tr>
<tr>
<td>Google (Gemini)</td>
<td>258 tokens flat if ‚â§384 px, otherwise 258 per 768x768 tile</td>
<td>1,032 tokens</td>
</tr>
</tbody></table>
<p>On current Claude models (Fable 5, Opus 4.7 and 4.8), an image is capped at 4,784 visual tokens with a long edge of up to 2,576 pixels. The pxpipe render width of 1,928 pixels sits comfortably under that ceiling. None of this is an accident.</p>
<h3>The fine print per provider</h3>
<p>The details matter more than the headline formula, because each provider hides different tradeoffs in them.</p>
<p>Anthropic's older models capped images at 1,568 pixels on the long edge and 1,568 visual tokens. Anything larger got downscaled before processing, which silently capped your cost and your resolution at once. You'll still find the legacy approximation "tokens equals width times height divided by 750" in older writeups. The patch math replaced it: 28 by 28 pixels per visual token, ceiling-rounded on each axis. For a 1000x1000 image both formulas land within 3% of each other, which is why the old rule survived so long.</p>
<p>OpenAI works in two steps: the image gets scaled to fit inside a 2048 pixel square, then its shortest side gets brought to 768 pixels, and only then does the 512 pixel tiling apply. A "low detail" flag skips all of it for a flat 85 tokens, which is useless for reading text but fine for "is this a cat".</p>
<p>Google's approach is the bluntest: anything up to 384 pixels on both sides is 258 tokens, period. Beyond that, 768 pixel tiles at 258 each.</p>
<p>Three consequences follow. First, the optimal render size is provider-specific, so a pipeline tuned for Claude wastes money on Gemini. Second, resizing before upload is your decision to make, and making it consciously beats letting the API downscale for you. Third, per-image caps mean very long documents want several medium-density pages rather than one gigantic one. pxpipe packs about 92,000 characters per page and simply emits an array of PNGs when the content overflows.</p>
<p><a href="https://carlosortet.com/text-or-pixels-90-vs-50-tokens.png"><img src="https://carlosortet.com/text-or-pixels-90-vs-50-tokens.png" alt="Diagram from the Text or Pixels paper showing the same context consuming 90 tokens as plain text and 50 tokens as an image entering a multimodal LLM" style="display:block;margin:0 auto" /></a></p>
<p><em>The idea in one picture: identical context, 90 tokens as text, 50 as an image. Source: "Text or Pixels? It Takes Half" (arXiv 2510.18279), CC BY 4.0.</em><br /><em>*the graphic could be nicer. I know, sorry about that. I promise to improve it in the future.</em></p>
<h2>What the research says</h2>
<p>Two papers from October 2025 put this on solid ground.</p>
<p><a href="https://arxiv.org/abs/2510.18279">"Text or Pixels? It Takes Half"</a> tested the idea systematically on GPT-4.1-mini and Qwen2.5-VL-72B. The setup was careful: text typeset with LaTeX at 300 DPI, adaptive font sizing targeting a 0.8 fill ratio, resolutions from 600x800 to 750x1000 pixels. Rendering long text as images achieved roughly 2:1 compression (38% to 58% fewer decoder tokens) while keeping accuracy within 3 points of the text-only baseline. On needle-in-a-haystack retrieval the imaged arm scored 97% to 99%; on CNN/DailyMail summarization it beat dedicated compression baselines like LLMLingua-2 at matched ratios. And there was a bonus nobody expected: on Qwen2.5-VL-72B, the shorter decoder sequence made end-to-end inference 25% to 45% faster. Cheaper and quicker, from the same trick.</p>
<p><a href="https://arxiv.org/abs/2510.18234">DeepSeek-OCR</a>, published the same month, went further and mapped the limits. Their "contexts optical compression" work shows that while the ratio of text tokens to vision tokens stays under 10x, decoding precision holds at 97%. Push to 20x compression and precision drops to around 60%. The curve between those two points is the price list of this whole technique.</p>
<p><a href="https://carlosortet.com/deepseek-ocr-compression-precision.png"><img src="https://carlosortet.com/deepseek-ocr-compression-precision.png" alt="Charts from the DeepSeek-OCR paper showing 97% precision below 10x compression degrading to about 60% at 20x, and DeepSeek-OCR outperforming other systems with far fewer vision tokens" style="display:block;margin:0 auto" /></a></p>
<p><em>The boundary of the technique: precision holds near 97% below 10x compression, then degrades. On OmniDocBench, 100 vision tokens per page beat systems spending 256, and under 800 beat systems spending 6,000+. Source: DeepSeek-OCR (arXiv 2510.18234), CC BY 4.0.</em></p>
<p>The efficiency numbers are hard to ignore. DeepSeek-OCR reads a document page with 100 vision tokens and beats GOT-OCR2.0, which spends 256 per page. With fewer than 800 it outperforms MinerU2.0, which averages more than 6,000. In production, DeepSeek uses this to generate LLM training data at over 200,000 pages per day on a single A100-40G.</p>
<p>The paper's discussion section contains the most science-fiction idea in this whole space: optical memory. Store a conversation's older history as images at progressively lower resolution, so distant context literally fades the way human memories do. More on that at the end.</p>
<h2>Inside a production pipeline</h2>
<p>pxpipe is the most instructive implementation to read because it publishes its evals and its failure cases. It runs as a local proxy between your client and the Claude API. Requests pass through byte-identical except for three categories of content, each behind a profitability gate: tool results above roughly 6,000 characters of dense content, older conversation turns behind the live tail, and the static system prompt plus tool documentation slab.</p>
<p>Two design rules matter more than the rest. Recent turns always stay as text. And the static prefix is preserved untouched, because breaking prompt caching would eat the savings.</p>
<p>The measured results, from the project's own benchmark tables:</p>
<table>
<thead>
<tr>
<th>Test</th>
<th>Text baseline</th>
<th>With imaged context</th>
</tr>
</thead>
<tbody><tr>
<td>Novel arithmetic, Claude Fable 5 (n=100)</td>
<td>100/100</td>
<td>100/100, with 38% fewer tokens</td>
</tr>
<tr>
<td>Gist recall A/B (n=98)</td>
<td>98/98</td>
<td>98/98</td>
</tr>
<tr>
<td>State tracking (n=18)</td>
<td>18/18</td>
<td>18/18</td>
</tr>
<tr>
<td>SWE-bench Lite (n=10)</td>
<td>10/10</td>
<td>10/10, requests 65% smaller</td>
</tr>
<tr>
<td>12-character hex recall, Opus (n=15)</td>
<td>15/15</td>
<td>0/15</td>
</tr>
</tbody></table>
<p>Look at that last row again. Note it!</p>
<p>On SWE-bench Pro, the harder agentic benchmark, the imaged arm resolved 14 of 19 tasks against 15 of 19 for plain text, with requests 60% smaller and 18 of 19 runs agreeing on the final verdict. That's the honest shape of the tradeoff on difficult work: a small accuracy tax on the hardest problems, bought at more than half the price.</p>
<p>End to end, over a snapshot of 13,709 real requests, the bill dropped 59%, from $100 to about $41. Traces where compression applied heavily ran 70% to 74% cheaper.</p>
<p>Two operational costs come with it. Encoding PNGs adds latency on large requests, noticeable when your pipeline is latency-sensitive rather than cost-sensitive. And the technique is battle-tested on ASCII and Latin-1 content; CJK text works but the project handles it conservatively, with less aggressive packing. If your context is mostly Chinese or Japanese, your compression ratio will be worse than the headline numbers.</p>
<h2>When imaging your context adds, and when it subtracts</h2>
<p>Every writeup of this technique that only quotes the savings is doing you a disservice. The method is lossy, and it fails in a specific, nasty way.</p>
<p>Exact recall of short strings breaks first. In pxpipe's test, Opus recalled 12-character hex strings from imaged content 0 times out of 15. The newer Fable 5 managed 13 of 15. And the failures aren't errors you can catch: the model confabulates a plausible value with full confidence instead of saying it can't read it. The project documents a real case of a name being confidently misremembered from imaged history.</p>
<p>It's also model-dependent. The technique works because current frontier vision encoders (Claude Fable 5, GPT 5.6) read dense text almost perfectly. Opus 4.7 and 4.8 misread around 7% of the time, which is why pxpipe keeps them opt-in. A model without a strong text-reading encoder turns your compressed context into noise.</p>
<p>So the honest rule: imaging adds when the content is bulk context for reasoning (code, docs, logs, old conversation turns). It subtracts when any byte matters exactly. Hashes, API keys, IDs, phone numbers and anything you'll need to quote back verbatim should stay as text, always.</p>
<p>One more key caveat: the arbitrage moves. When Anthropic shipped Opus 4.7, the maximum native image resolution jumped from 1,568 to 2,576 pixels on the long edge, and typical screenshots went from around 1,558 tokens to 4,739. The same image, three times the cost, in one release. The lesson isn't "use the trick". The lesson is: understand your provider's per-pixel economics and measure them, because they change without asking you.</p>
<h2>Try it yourself in about ten minutes</h2>
<p>If you run Claude Code, the experiment costs just two commands:</p>
<pre><code class="language-bash">npx pxpipe-proxy
ANTHROPIC_BASE_URL=http://127.0.0.1:47821 claude
</code></pre>
<p>A dashboard at <code>127.0.0.1:47821</code> shows every conversion and the tokens saved. The proxy only touches allowlisted models; everything else passes through byte-identical, and you can kill it entirely with <code>PXPIPE_MODELS=off</code>.</p>
<p>For your own pipelines, the same machinery is available as a library:</p>
<pre><code class="language-ts">import { renderTextToPngs, transformAnthropicMessages } from "pxpipe";

const imgs = await renderTextToPngs(bigToolResultText);
const { body, applied } = await transformAnthropicMessages({
  body: requestBytes,
  model: "claude-fable-5",
});
</code></pre>
<p>Before trusting any number, measure your own baseline. Anthropic's <code>count_tokens</code> endpoint is free, and comparing imaged versus plain requests on your real traffic takes an afternoon. My checklist for anyone adopting this:</p>
<ul>
<li><p>Gate by density. Prose compresses poorly; code, JSON and logs compress well.</p>
</li>
<li><p>Keep the live tail of the conversation as text, always.</p>
</li>
<li><p>Keep anything byte-exact (hashes, keys, IDs, amounts) out of the imaged path.</p>
</li>
<li><p>Re-measure after every model release. The Opus 4.7 repricing tripled image costs overnight.</p>
</li>
<li><p>Log what was compressed. When a confabulation shows up, you'll want to know what the model was reading.</p>
</li>
</ul>
<h2>The part almost nobody connects: this is also how AIs read your website</h2>
<p>Everything above treats text-as-image as a cost trick you apply to your own requests. Now flip the direction. When ChatGPT, Claude, Perplexity or an AI browser agent fetches a page from your site in real time, what do they see?</p>
<p>It turns out your site doesn't have one AI reader. It has three, and they disagree.</p>
<blockquote>
<p>Your website has three AI readers now: the crawler, Google, and the agent. None of them see the same page.</p>
</blockquote>
<p><a href="https://carlosortet.com/ai-three-readers-web.png"><img src="https://carlosortet.com/ai-three-readers-web.png" alt="Illustration of a character examining three browser windows showing the same website as raw code, as a rendered page and as a pixel mosaic" style="display:block;margin:0 auto" /></a></p>
<p><em>The same page, three readings: raw HTML for crawlers, a rendered page for Google, pixels for agents.</em></p>
<p><strong>Reader one: the crawlers.</strong> Each AI company runs three families of bots against your site. A training crawler (GPTBot, ClaudeBot) collects content for future models. A search-index bot (OAI-SearchBot, Claude-SearchBot) feeds the assistant's search layer. And a user-triggered fetcher (ChatGPT-User, Perplexity-User) hits your page live, in the seconds between a user's question and the answer. That last one is the "real time" in real-time AI answers.</p>
<p>As of mid 2026, none of them execute JavaScript. Not one, in any of the three families. Vercel's analysis of production traffic found GPTBot downloads JavaScript files about 11.5% of the time (ClaudeBot 23.8%) and never runs them. They fetch the raw HTML, extract what's there, and move on. No second pass, no rendering queue. If your content only exists in the DOM after client-side rendering, it doesn't exist for these systems.</p>
<p><strong>Reader two: Google, the exception.</strong> Gemini and AI Overviews inherit Googlebot's infrastructure, and Googlebot renders JavaScript. Google's Martin Splitt has confirmed it. The practical consequence is strange and very real: the same page can be fully visible to Google's AI surfaces and invisible to ChatGPT, Claude and Perplexity at the same time. If your brand shows up in AI Overviews but never in ChatGPT answers, check how much of your content depends on JavaScript before blaming the model.</p>
<p><strong>Reader three: the agents.</strong> Agentic browsers like OpenAI's Atlas (powered by their Computer-Using Agent) and Perplexity's Comet read the fully rendered page, through a mix of accessibility-tree snapshots, DOM parsing and screenshots sent to a vision model. This is where the first half of this article loops back: agents are reading web pages through the same vision channel, with the same economics and the same degradation curve. DeepSeek's numbers apply here too. A clean, well-structured page reads at 97%. A dense, cluttered one slides toward the 60% end, and the agent fills the gaps with confident guesses.</p>
<p>There's a fourth pattern worth knowing about on the retrieval side. <a href="https://arxiv.org/abs/2407.01449">ColPali</a> (ICLR 2025) showed that for document search, skipping OCR entirely and embedding page images directly beats the classic extract-and-chunk pipeline: 0.81 versus 0.66 NDCG@5, while indexing pages in 0.39 seconds instead of 7.22. The layout, tables and figures that text extraction destroys turn out to carry retrievable meaning. Visual structure is information.</p>
<h3>What this means if you publish content</h3>
<p>If you own a website that you'd like AI systems to read correctly, the three-reader split translates into checkable work:</p>
<ul>
<li><p><strong>Serve the substance in raw HTML.</strong> Server-side render or prerender anything you want crawlers and live fetchers to see: prices, specs, FAQs, comparisons. The test takes one command: <code>curl</code> your page and search the response for your key facts. If they're not in that output, two of your three readers can't see them.</p>
</li>
<li><p><strong>Don't let AI Overviews lull you.</strong> Google renders your JavaScript, so decent AIO visibility proves nothing about ChatGPT, Claude or Perplexity. Audit them separately.</p>
</li>
<li><p><strong>Treat your accessibility tree as an API.</strong> Agents from OpenAI and Perplexity prioritize ARIA roles and labels before falling back to vision. Semantic HTML and honest labels are no longer just an accessibility checkbox; they're how machines operate your interface.</p>
</li>
<li><p><strong>Design for the 97% end of the curve.</strong> Dense, cluttered, low-contrast pages push a vision-reading agent toward the degradation zone where it starts guessing. Clear hierarchy and legible text sizes now serve two audiences.</p>
</li>
<li><p><strong>Keep critical facts unambiguous.</strong> An agent misreading a price from a screenshot fails exactly like the hex test: silently and confidently.</p>
</li>
</ul>
<h2>What we're building on top of this</h2>
<p>pxpipe proved the mechanism on one developer's traffic. The question that interests us at <a href="https://498as.com">498A</a> is what it does at audit scale, and it's turning into two work lines.</p>
<p>The first is about simulation economics. A <a href="https://georadar.app">GEORadar</a> brand study runs between 3,000 and 30,000 personalized prompts against five LLMs plus Google's AI Overviews. Every one of those calls carries a slab of static context: persona definitions, market instructions, product catalogs, scoring rubrics. It repeats thousands of times per study, it's token-dense, and none of it needs byte-exact recall. That's exactly the profile the compression math favors. So we're testing optical compression of that static slab on our own simulation engine. The public ratios say dense content compresses about 3x; what we're measuring is what that buys back on a full study: more prompts per budget, more engines per prompt, or the same audit at a fraction of the cost. Until our numbers are in, it stays labeled what it is, an experiment.</p>
<p>The second line points the other way. Our audits interrogate models about brands through the text channel, and the technical side already checks what crawlers can fetch. Nobody is auditing the third reader yet. We're prototyping exactly that: feeding brand pages to vision models the way agentic browsers see them, screenshot plus accessibility tree, and scoring what survives the trip. Which facts does a vision reader actually extract? At what layout density does the page slide toward the confabulation zone DeepSeek measured? For <a href="https://sam.georadar.app">S.A.M.</a>, our semantic alignment tool, this extends validation to a second channel: a claim now has to survive as text for the crawler and as pixels for the agent. Semantic alignment used to be a property of your copy. It's becoming a property of your layout too.</p>
<p>I wrote about the text side of that machinery in <a href="https://carlosortet.com/blog/how-llms-search-retrieve-answer-real-time-web-data">how LLMs search, retrieve and answer with real-time web data</a>. The vision side is newer, and most sites haven't been checked against it even once. That gap is the opportunity.</p>
<h2>Text that fades like memory</h2>
<p>Back to DeepSeek's closing idea, because it reframes everything. If text rendered as an image is cheap and readable, then old context doesn't have to be summarized or deleted. It can be stored as pictures that lose resolution over time. Yesterday's conversation at high DPI. Last month's at half. Last year's as a blurry thumbnail that still preserves the gist.</p>
<p>That's not a billing hack anymore. That's an architecture for artificial memory that behaves like the biological kind, built out of the same mechanism that turns $42.21 into $4.51. And for anyone running simulations at audit scale, it's also the difference between sampling a market and saturating it.</p>
<p>The pipeline between language models and text keeps getting stranger. We spent years teaching machines to read. Now the cheapest way to hand text to a machine built on language is, more and more often, to show it a picture.</p>
<h2>Technical sources consulted</h2>
<ul>
<li><p>teamchong: <a href="https://github.com/teamchong/pxpipe">pxpipe</a>, local proxy rendering request context as PNGs, benchmark tables and production cost traces (MIT).</p>
</li>
<li><p>Wei et al., DeepSeek-AI: <a href="https://arxiv.org/abs/2510.18234">DeepSeek-OCR: Contexts Optical Compression</a>, compression-precision curves, DeepEncoder architecture and the optical memory proposal (CC BY 4.0).</p>
</li>
<li><p>Li et al.: <a href="https://arxiv.org/abs/2510.18279">Text or Pixels? It Takes Half</a>, token efficiency of visual text inputs in multimodal LLMs (CC BY 4.0).</p>
</li>
<li><p>Faysse et al.: <a href="https://arxiv.org/abs/2407.01449">ColPali: Efficient Document Retrieval with Vision Language Models</a>, ICLR 2025, visual document retrieval and the ViDoRe benchmark.</p>
</li>
<li><p>Anthropic: <a href="https://platform.claude.com/docs/en/build-with-claude/vision">Vision documentation</a>, 28x28 pixel patches, per-tier resolution caps and token cost tables.</p>
</li>
<li><p>Google AI for Developers: <a href="https://ai.google.dev/gemini-api/docs/tokens">Understand and count tokens</a>, Gemini image tokenization by 768x768 tiles.</p>
</li>
<li><p>OpenAI: <a href="https://platform.openai.com/docs/guides/vision">Vision guide</a>, base plus per-tile image token pricing.</p>
</li>
<li><p>Vercel: <a href="https://vercel.com/blog/the-rise-of-the-ai-crawler">The rise of the AI crawler</a>, production measurements of GPTBot, ClaudeBot and PerplexityBot JavaScript behavior.</p>
</li>
<li><p>Stan Ventures: <a href="https://www.stanventures.com/news/gemini-ai-renders-javascript-2586/">Gemini AI renders JavaScript like Googlebot</a>, Martin Splitt's confirmation of Gemini's rendering infrastructure.</p>
</li>
<li><p>Sean Goedecke: <a href="https://www.seangoedecke.com/text-tokens-as-image-tokens/">Should LLMs just treat text content as an image?</a>, discrete versus continuous token expressiveness.</p>
</li>
<li><p>Sinaptik AI: <a href="https://github.com/sinaptik-ai/pixelprompt">PixelPrompt</a>, alternative open source implementation of text-to-image context compression.</p>
</li>
</ul>
]]></content:encoded></item><item><title><![CDATA[How I built a proactive personal AI assistant based on Moltbot for 10€ a month]]></title><description><![CDATA[An open source agent with persistent memory, command execution, real proactivity, and WhatsApp as its interface. Full architecture, real costs, and lessons…]]></description><link>https://carlosortet.hashnode.dev/how-i-built-a-proactive-personal-ai-assistant-based-on-moltbot-for-10-a-month</link><guid isPermaLink="true">https://carlosortet.hashnode.dev/how-i-built-a-proactive-personal-ai-assistant-based-on-moltbot-for-10-a-month</guid><category><![CDATA[AI]]></category><dc:creator><![CDATA[carlos ortet]]></dc:creator><pubDate>Fri, 30 Jan 2026 07:41:29 GMT</pubDate><content:encoded><![CDATA[<p><strong>An open source agent with persistent memory, command execution, real proactivity, and WhatsApp as its interface. Full architecture, real costs, and lessons learned.</strong></p>
<hr />
<h2 id="heading-why-build-your-own-assistant">Why build your Own assistant</h2>
<p>The idea of having an AI assistant that actually knows you is nothing new. Anyone who uses ChatGPT, Claude, or Gemini daily has felt the same frustration: every conversation starts from scratch, you have to re-explain your project context, and the assistant cannot do anything beyond the chat window.</p>
<p>At 498AS, we have been experimenting for months with language models applied to real workflows. Not just text generation, but agents that execute tasks, access tools, and maintain long-term context.</p>
<p>When we discovered Clawdbot (Moltbot), we saw an opportunity to close that gap. An open source project that lets you run your own AI agent with persistent memory, command execution, and the ability to message you before you message it.</p>
<p>We set it up. It works. And it costs 10 euros a month.</p>
<hr />
<h2 id="heading-what-is-clawdbot">What is Clawdbot</h2>
<p>Clawdbot (Moltbot) is an open source project that provides the infrastructure for running your own AI agent. It is not a closed product or a subscription app. It is the technical skeleton on which you build your personalized assistant.</p>
<p>Its core capabilities:</p>
<ul>
<li><p><strong>Multichannel communication.</strong> It talks to you via WhatsApp, Telegram, Discord, or whatever platform you prefer.</p>
</li>
<li><p><strong>Persistent memory.</strong> It remembers previous conversations, your projects, your preferences. It does not start from zero.</p>
</li>
<li><p><strong>Command execution.</strong> It can run scripts, open applications, control your browser. Real actions on your computer.</p>
</li>
<li><p><strong>Tool and API access.</strong> You configure which tools it can use, and the agent integrates them into its responses and actions.</p>
</li>
<li><p><strong>Full control.</strong> It runs on your server, under your infrastructure. You decide what data it holds and who can access it.</p>
</li>
</ul>
<hr />
<h2 id="heading-full-system-architecture">Full system architecture</h2>
<h3 id="heading-the-central-server">The Central Server</h3>
<p>The heart of the system is a VPS on Hetzner. Minimum specs: 2 vCPUs, 4GB of RAM. Model CX22. Cost: approximately 4 euros per month.</p>
<p>This server runs the Clawdbot gateway, which handles:</p>
<ul>
<li><p>Receiving and sending messages</p>
</li>
<li><p>Communication with the AI model</p>
</li>
<li><p>Persistent memory management</p>
</li>
<li><p>Tool and node coordination</p>
</li>
</ul>
<h3 id="heading-the-ai-model">The AI Model</h3>
<p><strong>Subscription option.</strong> If you already pay for Claude Pro Max, ChatGPT Plus/Pro, or similar, Clawdbot can use that subscription directly. No separate API costs.</p>
<p><strong>API option.</strong> If you prefer pay-per-use, you can connect the APIs from Claude, OpenAI, or any compatible model. For personal use it typically ranges between 10 and 30 euros per month.</p>
<h3 id="heading-whatsapp-as-the-interface">WhatsApp as the Interface</h3>
<p>The setup requires a dedicated prepaid SIM. Cost: 6 euros per month with minimal data. The agent has its own phone number. You message it like any other contact and it replies.</p>
<h3 id="heading-security-with-tailscale">Security with Tailscale</h3>
<p>The Clawdbot gateway is <strong>not exposed to the internet</strong>. It only listens on the Tailscale network.</p>
<p>Tailscale is a mesh VPN that creates a private network between your devices. End-to-end encryption, regardless of physical location. Free for personal use.</p>
<p>Our specific configuration:</p>
<ul>
<li><p>The Hetzner VPS is on the Tailscale network</p>
</li>
<li><p>Our phones and computers are too</p>
</li>
<li><p>The gateway only accepts connections from Tailscale IP ranges</p>
</li>
<li><p>The firewall is explicitly configured: only Tailscale can reach the gateway</p>
</li>
</ul>
<p>If someone scans the server from the internet, the gateway port does not even show up.</p>
<h3 id="heading-distributed-nodes">Distributed Nodes</h3>
<p>Clawdbot lets you connect "nodes": computers that the agent can control remotely. My MacBook is connected as a node. I can be out on the street, message the agent via WhatsApp saying "open Chrome and look up X" and it does it on my Mac.</p>
<p>All traffic between nodes and the gateway goes through Tailscale.</p>
<h3 id="heading-access-control">Access Control</h3>
<p>The agent does not talk to just anyone. We have an allowlist of authorized phone numbers. Permissions are granular: who can interact, which commands it can execute, which tools are available, whether execution requires prior approval.</p>
<hr />
<h2 id="heading-the-proactive-agent-the-real-game-changer">The proactive agent: The Real Game Changer</h2>
<p>This is the feature that turns a chatbot into an actual assistant. The agent does not wait for you to write. It messages you first.</p>
<ul>
<li><p><strong>Email alerts.</strong> The agent monitors your email and notifies you via WhatsApp when something relevant arrives.</p>
</li>
<li><p><strong>Calendar reminders.</strong> It reads your calendar and alerts you ahead of meetings.</p>
</li>
<li><p><strong>Custom alerts.</strong> Weather updates, price monitoring, GitHub repository activity.</p>
</li>
<li><p><strong>Scheduled tasks.</strong> "Every Monday at 9, review my pending tasks and tell me what I need to do this week."</p>
</li>
</ul>
<p>Proactivity completely transforms the relationship with the assistant.</p>
<hr />
<h2 id="heading-real-cost-breakdown">Real cost breakdown</h2>
<div class="hn-table">
<table>
<thead>
<tr>
<td>Item</td><td>Monthly Cost</td></tr>
</thead>
<tbody>
<tr>
<td>Hetzner CX22 VPS</td><td>~4 EUR</td></tr>
<tr>
<td>Prepaid SIM with data</td><td>~6 EUR</td></tr>
<tr>
<td>Tailscale</td><td>0 EUR (free tier)</td></tr>
<tr>
<td><strong>Total infrastructure</strong></td><td><strong>~10 EUR/month</strong></td></tr>
</tbody>
</table>
</div><p>The AI model is separate. If you already have a subscription to Claude Pro, ChatGPT Plus, or similar, you pay nothing extra.</p>
<hr />
<h2 id="heading-lessons-learned-after-weeks-of-use">Lessons learned After Weeks of Use</h2>
<ul>
<li><p><strong>More useful than expected.</strong> What started as a technical experiment became a daily tool.</p>
</li>
<li><p><strong>Proactivity is the differentiator.</strong> Having the agent message you when something important happens is a paradigm shift.</p>
</li>
<li><p><strong>Security is non-negotiable.</strong> Tailscale, firewall, allowlist, granular permissions. All of it.</p>
</li>
<li><p><strong>WhatsApp as an interface reduces friction.</strong> It is where you already are.</p>
</li>
</ul>
<hr />
<h2 id="heading-how-to-get-started">How to get started</h2>
<p>Clawdbot is open source and available on GitHub with comprehensive documentation and an active Discord community.</p>
<ol>
<li><p>Get a cheap VPS (Hetzner, DigitalOcean, or similar)</p>
</li>
<li><p>Install Clawdbot following the documentation</p>
</li>
<li><p>Connect WhatsApp with a dedicated SIM</p>
</li>
<li><p>Set up Tailscale on the server and your devices</p>
</li>
<li><p>Define an allowlist of authorized numbers</p>
</li>
<li><p>Configure tools and permissions</p>
</li>
</ol>
<p><strong>Security recommendations:</strong></p>
<ul>
<li><p>Do not expose the gateway to the internet. Use Tailscale.</p>
</li>
<li><p>Do not run as root.</p>
</li>
<li><p>Configure user allowlists.</p>
</li>
<li><p>Enable approval for command execution.</p>
</li>
</ul>
<p>We wrote a detailed blog post with the full architecture and step-by-step setup: <a target="_blank" href="https://zoopa.es/es/blog/como-montar-un-asistente-de-ia-personal-por-10e-al-mes-con-clawdbot/">Read the full article on our blog</a></p>
<hr />
<p><em>Article published by the 498AS team. Questions about the setup? Drop a comment or get in touch.</em></p>
]]></content:encoded></item><item><title><![CDATA[Clawdbot: The AI Assistant Siri Promised But Never Delivered — Complete 2026 Guide]]></title><description><![CDATA[Clawdbot is an open-source personal AI assistant that radically transforms how we interact with artificial intelligence. Unlike ChatGPT or Claude web…]]></description><link>https://carlosortet.hashnode.dev/clawdbot-the-ai-assistant-siri-promised-but-never-delivered-complete-2026-guide</link><guid isPermaLink="true">https://carlosortet.hashnode.dev/clawdbot-the-ai-assistant-siri-promised-but-never-delivered-complete-2026-guide</guid><category><![CDATA[AI]]></category><dc:creator><![CDATA[carlos ortet]]></dc:creator><pubDate>Sun, 25 Jan 2026 18:42:31 GMT</pubDate><content:encoded><![CDATA[<p><strong>Clawdbot is an open-source personal AI assistant that radically transforms how we interact with artificial intelligence.</strong> Unlike ChatGPT or Claude web, Clawdbot lives inside your everyday messaging apps — WhatsApp, Telegram, Slack, Discord — and can proactively message you, remember conversations from weeks ago, and execute tasks on your computer.</p>
<hr />
<h2 id="heading-the-problem-clawdbot-solves">The Problem Clawdbot Solves</h2>
<p>For over a decade, big tech companies promised us intelligent assistants that would transform our productivity. Siri arrived in 2011. Google Assistant in 2016. Alexa conquered millions of homes. And yet, in 2026, most users remain frustrated with these tools.</p>
<p>The fundamental problem is that these traditional assistants:</p>
<ul>
<li><p><strong>Wait passively</strong> for you to speak to them</p>
</li>
<li><ul>
<li><p><strong>Forget everything</strong> when the session closes</p>
<ul>
<li><ul>
<li><p><strong>Can’t execute</strong> complex tasks</p>
<ul>
<li><ul>
<li><p><strong>Live in closed ecosystems</strong> that limit their utility</p>
<ul>
<li><ul>
<li><strong>Prioritize data collection</strong> over real functionality</li>
</ul>
</li>
<li><p>Clawdbot represents a paradigm shift. It’s what Siri should have been and never was.</p>
</li>
</ul>
</li>
</ul>
</li>
</ul>
<hr />
</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
<li><h2 id="heading-clawdbot-vs-siri-vs-google-assistant-vs-alexa-2026-comparison">Clawdbot vs Siri vs Google Assistant vs Alexa: 2026 Comparison</h2>
</li>
</ul>
<p>| Feature | Clawdbot | Siri | Google Assistant | Alexa |</p>
<p>|————-|—————|———|—————————|———-|</p>
<p>| <strong>Proactivity</strong> | Writes to you when there’s news | Only responds | Limited to routines | Only basic notifications |</p>
<p>| <strong>Persistent memory</strong> | Remembers weeks/months | Forgets on close | Very limited | Session only |</p>
<p>| <strong>Executes PC tasks</strong> | Terminal, browser, files | No | No | No |</p>
<p>| <strong>Open source</strong> | MIT License, auditable | Closed | Closed | Closed |</p>
<p>| <strong>Your data on your machine</strong> | Local-first | Apple servers | Google servers | Amazon servers |</p>
<p>| <strong>WhatsApp integration</strong> | Native | No | No | No |</p>
<p>| <strong>Monthly cost</strong> | ~$27 (VPS+Claude) | Free (with iPhone) | Free | Free (with Echo) |</p>
<p><strong>Verdict</strong>: Clawdbot is the only assistant that combines real proactivity, persistent memory, and total user control. The trade-off is it requires initial technical setup.</p>
<hr />
<h2 id="heading-what-makes-clawdbot-different">What Makes Clawdbot Different</h2>
<p>The fundamental difference with ChatGPT or Claude web is that Clawdbot <strong>lives inside your messaging apps</strong>. You don’t go to a website. You message it like any other contact. And it can:</p>
<ul>
<li><p>Proactively send you messages</p>
</li>
<li><ul>
<li><p>Remember past conversations</p>
<ul>
<li><ul>
<li><p>Execute tasks on your computer</p>
<ul>
<li><ul>
<li>Run 24/7</li>
</ul>
</li>
<li><h3 id="heading-the-local-first-philosophy">The Local-First Philosophy</h3>
</li>
</ul>
</li>
</ul>
</li>
<li><p>One of the most relevant aspects of Clawdbot is its local-first architecture:</p>
</li>
</ul>
</li>
</ul>
</li>
<li><ul>
<li><p>Your data stays on your machine by default</p>
<ul>
<li><ul>
<li><p>No dependency on external servers (except the AI model you choose)</p>
<ul>
<li><ul>
<li><p>You can audit all the code since it’s open-source</p>
<ul>
<li><ul>
<li>You have total control over what it can and cannot do</li>
</ul>
</li>
</ul>
<hr />
</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
<li><h2 id="heading-the-creator-peter-steinberger">The Creator: Peter Steinberger</h2>
</li>
</ul>
</li>
</ul>
</li>
<li><p>Peter Steinberger (@steipete) is the creator of Clawdbot. His profile:</p>
</li>
<li><p><strong>Ex-founder of PSPDFKit</strong>, a PDF software company with global presence</p>
</li>
<li><ul>
<li><p><strong>13+ years of experience</strong> in native iOS development</p>
<ul>
<li><ul>
<li><p><strong>Based in Vienna and London</strong></p>
<ul>
<li><ul>
<li><strong>Builds in public</strong>, sharing both successes and failures</li>
</ul>
</li>
<li><p>The project was born as <strong>Clawd</strong>, Peter’s personal assistant. A “space lobster” with its own personality that manages his digital life.</p>
</li>
</ul>
</li>
</ul>
</li>
</ul>
<hr />
</li>
</ul>
</li>
</ul>
<h2 id="heading-installation-and-requirements">Installation and Requirements</h2>
<h3 id="heading-system-requirements">System Requirements</h3>
<p>| Component | Requirement |</p>
<p>|—————-|——————-|</p>
<p>| <strong>Node.js</strong> | &gt;= 22 |</p>
<p>| <strong>Package Manager</strong> | npm, pnpm (preferred), or bun |</p>
<p>| <strong>Operating System</strong> | macOS, Linux, Windows (via WSL2) |</p>
<p>| <strong>Minimum RAM</strong> | 2GB (4GB for web automation) |</p>
<h3 id="heading-quick-installation">Quick Installation</h3>
<pre><code class="lang-plaintext">bash
npm install -g clawdbot@latest
clawdbot onboard --install-daemon
clawdbot gateway --port 18789 --verbose
```

---

## Differentiating Features

### 1. Persistent Memory

Unlike traditional chatbots that forget everything when the session closes, Clawdbot maintains continuous 24/7 context, learned user preferences, and history of past conversations.

### 2. Real Proactivity

This is perhaps the most differentiating feature. Clawdbot doesn't wait passively:

- **Morning briefings**: Summary of emails, calendar, relevant news
- **Contextual alerts**: "Your meeting starts in 20 minutes"
- **Topic tracking**: "That project you mentioned has updates"

### 3. System Control

Clawdbot can interact with your computer: browser automation, file management, terminal commands, and script execution.

---

## Real-World Use Cases

| Use Case | Description |
|----------|-------------|
| **Automatic Inbox Zero** | Email cleanup, mass unsubscription, organization |
| **Smart Calendar** | Contextual reminders based on location/time |
| **Flight Check-in** | Complete automation without intervention |
| **Website Migration** | Full site rebuilds via chat |

---

## Community Testimonials

&gt; **@dajaset**: "I got up and running today with @clawdbot and it's been nothing short of an iPhone moment for me."

&gt; **@davekiss**: "Using @clawdbot for a week and it genuinely feels like early AGI."

&gt; **@karpathy**: "Not enterprise. Not hosted. Infrastructure you control. This is what personal AI should feel like."

---

## Real Costs

| Component | Cost |
|-----------|------|
| **Software** | FREE (MIT license) |
| **Basic VPS** | ~5 EUR/month |
| **Claude Pro** | $20/month |
| **Total** | ~$27/month |

---

## Who Should Use Clawdbot

### Ideal Profiles

| Profile | Why It Works |
|---------|--------------|
| **Developers** | Infinite extensibility, hackable |
| **Technical Power Users** | Total control, privacy |
| **Founders/CEOs** | 24/7 automation |

### Who Should Wait

- Non-technical users (setup requires terminal, VPS)
- Anyone who can't tolerate occasional bugs
- Working in heavily regulated industries

---

## Conclusions

Clawdbot represents a milestone in the evolution of personal AI assistants. It's not perfect — onboarding is still rough, there are occasional bugs, and it requires technical knowledge — but it's genuinely useful in ways Siri never achieved.

What's clear is that the model of "assistant that lives in your infrastructure and contacts you proactively" is the future. Big Tech will eventually arrive. The open-source community got there first.

**GitHub**: [github.com/clawdbot/clawdbot](https://github.com/clawdbot/clawdbot)

---

*Analysis by Carlos Ortet | ZOOPA Research | 498AS Innovation Lab | January 2026*
</code></pre>
]]></content:encoded></item></channel></rss>