OpenAI's watermark won't survive a paste into Word
Issue #052 · 4 min read
OpenAI's watermark won't survive a paste into Word
EU compliance ships, MCP gets a trust problem, and GitHub quietly hands Copilot a new API
The big story
OpenAI is about to start watermarking ChatGPT and Codex text in the EU.
Not visibly. The marks are invisible, built into the pattern of word choices, there to satisfy the EU AI Act's rule that AI-generated text be detectable.
OpenAI says editing the text can make the watermark harder to detect — which is another way of saying the watermark mostly survives only if nobody touches what the AI wrote (OpenAI's own post).
That is nearly the opposite of how people actually use ChatGPT. They paste a draft, rewrite a paragraph, trim a line, send it. The watermark is built for a use case — copy, paste, publish untouched — that is not the common one.
Access to detection tools starts with researchers only, not the public, so nobody outside a lab can check a given block of text today (TechCrunch, The Verge).
The Register's take is the blunt one worth reading: compliance, technically, but weak sauce.
If you're building anything that touches EU users and generates text with OpenAI's models, the watermark exists now. Whether it means anything the moment a human edits a sentence is a separate question, and today's coverage suggests the honest answer is: probably not much.
What shipped
GitHub Copilot code review can now be triggered through the REST and GraphQL APIs, and Balanced is now the default effort level for every review request. If your team has been running Copilot reviews manually through the UI, this is the thing that lets you wire it into CI instead — set the effort level per request and stop babysitting the button (GitHub changelog).
GitHub's security overview now shows AI Scan enablement status for pull requests, organization-wide. Admins can finally see, in one coverage view, which repos have AI-assisted code scanning turned on and which don't — useful if you've been rolling this out piecemeal and have no idea how much of your org is actually covered (GitHub changelog).
A structural flaw in MCP, the protocol agents use to talk to each other, lets a malicious prompt hop from one agent to the next. This one is worth a flag even though it's not a product release: if you're letting agents built on Google's or anyone else's MCP implementation message each other, the trust boundary you assumed exists may not (Ars Technica).
Worth noting what we're skipping: GitHub shipped a pile of smaller npm and secret-scanning updates this week — token expiry changes, new secret detectors, GraphQL fields for security advisories. Useful if you're deep in GitHub's platform, not newsletter-worthy on their own, so we're leaving them for the changelog.
What I'd actually do this week
Check whether anything your team publishes through ChatGPT or Codex touches an EU audience, and read OpenAI's own explanation of where the watermark applies before you tell legal it's handled — it answers fewer questions than the headline suggests.
If your product lets agents talk to other agents over MCP, ask your eng lead this week whether you're exposed to the flaw Ars Technica described, not next sprint.
If you've turned on Copilot's AI code review, pull up the new security overview and actually look at your org's coverage number instead of assuming it's everywhere you think it is.
Reply if you've hit the MCP issue in the wild — want to hear what it actually looked like.