Watermarking, which the European Union requires to be added to AI content under the EU AI Act, has a downside. According to new research from Lasso Security, the watermarking technology changes how AI agents interact with external tools, making them more vulnerable to malicious attacks.
Watermarking, which the European Union requires to be added to AI content under the EU AI Act, has a downside. According to new research from Lasso Security, the watermarking technology changes how AI agents interact with external tools, making them more vulnerable to malicious attacks.
To meet EU requirements, companies like OpenAI and Anthropic have implemented Google DeepMind’s SynthID-Text technology. It subtly changes the probability of choosing the next word when generating text. For example, instead of the word “gloomy,” the model might prefer the word “gray.” This difference is imperceptible to humans, but a special algorithm can read this hidden pattern.
However, AI agents have been shown to be sensitive to such minimal changes in vocabulary. According to Lasso, this affects both what the model says and what the agent does, The Register reports .
Researchers have identified two key negative effects of watermarks.
On the BFCL v4 benchmark, the presence of watermarks reduced the accuracy of 6 out of 7 tested models (including Llama-3.1, Qwen3, and Gemma-3). AI agents were more likely to choose the wrong tools when performing tasks, confuse arguments, or produce parsing errors.
The presence of marking had little effect on ordinary malicious requests, but significantly weakened protection against Prompt Injection attacks. When watermarking was used, the success rate of attacks increased significantly, and AI models were more likely to agree to execute dangerous commands.
Lasso Security experts note that this research does not call for the abandonment of watermarks, as they are necessary for establishing the origin of content. The effect of labeling extends to any third-party agents that access the models via API.
Nevertheless, developers and cybersecurity professionals must now test their systems (conduct Red Teaming) against labeled content in order to detect anomalies in artificial intelligence behavior early.
