Agents in Practice #9: Watermarking LLM output and Learning from Copilot traces

Agents in Practice #9 on Claude’s new policy of adding watermarks to LLM output, and Microsoft’s takeaways from analyzing Copilot traces
llm
agents
agents-in-practice
Author

Ryan Lee

Published

September 3, 2026

Welcome to the 9th issue of Agents in Practice!

📬 Agents in Practice is a weekly newsletter on agentic AI research and applications. Subscribe here →

Marking AI-generated Content

Diagram illustrating generative watermarking

Anthropic announced that models launched on or after August 2, 2026 will embed an invisible watermark in generated text. The watermark will be added regardless of how they are accessed. The text watermark is added during generation and travels with the text when it is copied and pasted, although heavy editing, paraphrasing, or translation may remove the detectable signal. Thus, detecting a mark only means that Claude may have processed the content, not that Claude originally authored it.

The underlying technique is DeepMind’s SynthID-Text. In this algorithm, a random seed generator generates a new random seed on each generation step. Then the LLM’s sampling algorithm is given a generated random seed on each generation step, introducing correlations between each random seed and output token. The paper introducing the algorithm showed that such watermarks can be deployed at scale without a measurable loss in response quality.

Anthropic’s text watermark detector is currently in private preview for eligible organizations. Non-text files such as PNG, JPG, and SVG files can also include signed provenance metadata following the C2PA standard, so a public content checker can read it. The first supported models are Fable 5.1 and Mythos 5.1, with support for older models still in progress.

Personal Thoughts

Detecting AI-generated content has been an active area of research and product formulation as AI-generated content becomes more and more commonplace. Sometimes AI-generated text can be obvious just from its vocabulary, with words like “load-bearing” or “footgun”. However, these clues are not reliable, as (1) they can easily be paraphrased, and (2) you start to imitate its style after chatting with it for hours every day. A watermarking system can therefore be a more reliable solution. However, these watermarks do not clearly differentiate the level of assistance by Claude. A human-written passage that Claude only proofread could carry a mark, while a heavily edited Claude response could lose it. A more fine-grained watermark may be needed if such watermark detectors become widely used in education, publishing, or online platforms.

Read more

Learning from Copilot traces

Token type breakdown for LLM calls

Microsoft published an analysis of anonymized telemetry from 13.5 million GitHub Copilot sessions across 3.2 million users during one week in June 2026. These sessions contained 760.5 million LLM calls, 774.7 million tool calls, and 44.9 trillion prompt tokens. The researchers collected only structural metadata such as timestamps, token counts, model names, tool names, and success or failure status, but not prompts, model outputs, source code, or tool arguments. From this data, the authors highlight 15 takeaways. Below are a few highlights from me:

  1. Most LLM calls result in a tool action, and most tool results immediately trigger another LLM call. Reasoning without action and action without reasoning are rare.
  2. Most LLM calls (87%) are initiated by autonomous agent execution rather than direct user interaction (13%).
  3. Agent execution is predominantly serial, with median concurrency being only 1.15. Tool execution is more parallel but still largely sequential, with 93% of tool batches invoking a single tool.
  4. History and tool-call traces comprise over 75% of all prompt tokens.
  5. Tool calls take only 4.7% of time but contribute 28% of prompt tokens, while LLM execution takes 85.4% of wall-clock time and contributes 48% of prompt tokens.
  6. Prefix caching rate is high overall (median 98%), and follows a predictable trajectory within a turn.
  7. Context compaction only occurs in 7.8% of sessions, but those sessions account for 44.2% of all tokens. The median compaction removes 72.8% of prompt tokens, but takes roughly 22% of the turn’s execution time and causes the cache hit rate to drop by 66.1% on the next call.
  8. Read-heavy tools complete fast and succeed nearly universally, while execution tools fail more often. The long tail of long-running tools dominates total tool time and drives session latency.

Personal Thoughts

The paper gives two useful insights that I have also experienced. Long sessions that go through context compaction have been the most expensive sessions by far, and incremental compacting instead of relying on auto-compacting has reduced cost substantially. Execution tools that take long often require multiple trials by the agent, even if they are documented clearly.

Although not at the scale of GitHub Copilot, doing such a study on personal traces will be quite insightful and beneficial.

Read more

One-liners

Subscribe to Agents in Practice

Get new issues of Agents in Practice — a newsletter summarizing exciting new research and applications in agentic AI — delivered to your inbox.