AI companies are buying pallets of old printed books. Physical books, paper and glue, the format the entire industry was supposed to have made quaint. ISBNdb, a broker that sources bulk print acquisitions for AI labs, pitches it with a straight face: “The world’s best AI training data is sitting on a shelf.” And the pitch works, because books have one property no amount of prompt engineering can fake. They were printed before the slop existed.
So the companies that built the slop machines are paying real money to avoid eating the output of the slop machines. Meanwhile, an entire vendor category is charging you monthly to feed those same companies as much machine output as you can generate. Someone in this supply chain has misread the room.
The measurement went first
Old search was deterministic enough to build an industry on. A ranking was a position, a position produced impressions and clicks, and clicks carried tracking parameters into analytics that told you what converted. You could argue about attribution windows for hours, and God knows we did, but the pipeline held still long enough to be measured.
AI answers hold still for no one. Ask the same question twice and the brands can change. There is structure under the noise, a distribution whose stability depends on the corpus behind it and the quality of the prompts probing it, but here’s the thing about the probing: it’s synthetic. Your tracker fires sterile prompts at an API and gets back answers stripped of the context and personalisation that shape what actual humans see. Even a perfectly stable reading is likely a perfectly stable reading of the wrong thing.
A more honest industry might have stopped here. Ours built dashboards. Position tracking for a system with no positions, share of voice for answers nobody’s session will ever reproduce, all reported with the decimal-point confidence of a rank report from 2014. And on the production side, the same vendors sell the thing this piece is actually about: AI-generated content, at scale, optimised for retrieval by systems whose owners are building the tools to identify it.
The infrastructure is already at internet scale
On 19 May (at I/O 2026), Google announced that SynthID, its invisible watermarking system, had marked more than 100 billion AI-generated images and videos plus roughly 60,000 years of audio, with verification rolling into Search immediately and Chrome in the weeks after. Same day, OpenAI committed to embedding SynthID in every image generated through ChatGPT, Codex and the API. Kakao and ElevenLabs are on the partner list; NVIDIA joined earlier through its Cosmos models. This is what provenance looks like when it stops being a research demo and starts being plumbing.
I can hear the objection from here: that’s images and audio, and the content farms sell text. Correct. OpenAI’s commitment covers images only, and Google’s published text watermarking comes with documented weaknesses. DeepMind says detection confidence drops sharply when text is thoroughly rewritten or translated, and the method struggles on short factual outputs. Plenty of people have read exactly that far and concluded AI text at scale is safe. Comforting… Also lazy.
It’s also, as of August, out of date. Anthropic has signed the EU AI Act’s Code of Practice on transparency and published its plan: Claude models launched from 2 August 2026 onwards are to embed watermarks in generated text at the model level, applied worldwide, across the API, the consumer apps and the cloud platforms. The legal trigger is European, but the watermark ships inside the model, so a Brussels mandate becomes the global default. Anthropic says it will help third parties detect the watermarking, with the mechanism described in “forthcoming technical documentation”, a phrase I encourage you to savour. Their own page notes the mark doesn’t certify authorship either: text merely processed by Claude, proofread, translated, tidied up, can carry it. And the published limitations are the familiar ones, heavy editing, translation, very short passages, which are, as ever, the limitations of what’s been chosen for publication.
The open-source SynthID text repository carries a note from DeepMind itself: the code is a reference implementation for the research paper, “not intended for production use”, with a hashing function offering no cryptographic security guarantees. Read that again, slowly. The version you can inspect is, by Google’s own description, not the version that runs. Everyone confidently citing the published limitations is citing the limitations of a demo.
I spent nearly six years inside Google’s search quality and webspam teams, so let me save you some suspense about how this works. Google has never published how spam detection operated. Ever. Publishing the mechanism is handing over the evasion manual, and every serious detection system in the history of search has been built on that silence. The idea that the same company would now document its AI text detection honestly, for the convenience of the people it’s designed to catch, is genuinely sweet. If a text watermarking or detection method that survives paraphrasing exists or arrives, the first you will hear of it or how it works is never.
The evasion side turned up right on schedule, of course. Within days of Anthropic’s announcement, a watermarks remover appeared on GitHub covering Claude, Gemini and OpenAI, and its README is more honest than most of the GEO industry. For statistical text watermarks its method is a heavy rewrite through another model, labelled best-effort, and it concedes that until vendors ship public detectors, “no tool can honestly certify” the mark is gone. It even recommends laundering Claude text through a different model, in case the rinse re-stamps the washing. That’s the mouse’s side of the game in full: scrubbing invisible characters and hoping that was the watermark, paraphrasing against a detector nobody can query, and shipping with a disclaimer that it cannot know whether any of it worked. The cat is under no obligation to show up where you can see it.
So the real question was never whether today’s documented watermarks can be stripped. You cannot verify the absence of a watermark, and the organisations building them will not confirm which ones work. Producing AI content at scale is a standing bet that no reliable detection exists now and never will, placed against companies with the compute, the training-data incentive, a regulatory mandate the labs are already signing commitments under, and a twenty-year institutional habit of catching people who were certain they couldn’t be caught and confident they could “make it look natural”. I’ve met the people on the other side of that bet. I used to be one of them.
About that mandate. Article 50 of the EU AI Act requires providers of generative AI systems to mark synthetic outputs, text included, in a machine-readable format, and applied from 2 August. The pending AI Omnibus package would give systems already on the market until December, and the guidelines carve out plenty, so nobody’s switching off the content pipeline out of fear of Brussels just yet. One carve-out is worth reading twice, though: AI-generated text on matters of public interest escapes disclosure where a human has assumed editorial responsibility. A regulator sat down and decided the thing that makes machine text acceptable is a human willing to put their name on it. Content-at-scale operations exist precisely because nobody wants to do that.
You can’t paraphrase your way out of slop
Fine, suppose the watermarks never land. Paraphrase everything, launder every output through a second model, translate it, strip whatever signals you dreamt about. Congratulations: you now own a large pile of laundered slop, and slop gets caught on content grounds, no watermark required.
Nuclear testing contaminated the world’s steel after 1945, so instrument manufacturers salvaged pre-war shipwrecks for low-background steel. Pre-2022 text is now that shipwreck, and the labs are hauling it up by the pallet-load, because everything published after the flood needs filtering while books need none. Think about what the target corpus actually is. The most heavily curated text collection ever assembled, curated by the wealthiest companies on earth, specifically against the thing you’re paying a SaaS to help you produce more of. I’ve written before about models learning to cite their own output. The book-buying is the labs’ answer to that problem, and unlike the industry’s answers, theirs cost them actual money.
The lever is placed upstream
A disclosure, because this space has spent a year demanding them from everyone else: I’ve joined geoSurge, and today is the day that becomes public. If you’re reading this before my posts on social media, congratulations, you heard it here. The research below is theirs, which means the sceptical read you’re about to get is me applying my own rules to my own employer. For the record, the conviction came first. Back in May I deliberately vagueposted that I’d finally seen an approach to this problem with legs. It was them. I kept the details to myself until I was certain the approach held up. It did, to the point where I signed.
geoSurge, an AI visibility SaaS, published research in late July measuring what a model does before it searches. Across nine industries, 66 buyer-style prompts and nearly 4,000 model responses, brands the model already held in its top-10 memory for a category were named in its search queries at 3.2 times the rate of brands it didn’t remember: 55.7% against 17.4%. The gap held in all nine industries, and when the model’s queries named a brand at all, 63% of the time it named one from its top-five recall. The model, it turns out, mostly goes looking for things it already knows. Ask any human who has ever shopped for anything.
Caveats, because the study states them and they matter: exploratory data, an association with no proven cause, and brand prominence sitting right there as a confound, since famous brands are both better remembered and more searched. It’s also vendor research, and worth being precise about which vendor, mine included in the scrutiny. geoSurge’s entire pitch is the memory layer; that’s where they focus and their CEO’s own line is “As models know more, they search less”, and they just raised $12m on that thesis. A study finding that memory predicts search is a study finding that their funding round was a good idea, which earns the numbers extra scrutiny, and to their credit the caveats above are theirs, printed in the report.
If the finding holds, the rest of the category, the prompt trackers and citation dashboards and content pipelines, is optimising the downstream half of a decision the model largely made at training time. geoSurge is betting the opposite way, which is precisely why their numbers deserve the scrutiny I’ve just applied.
If vendor data alone feels thin, Google Research published the independent version at ICML this year. Across 13 models and more than four million graded answers, frontier models had encoded 95 to 98% of the facts tested and still failed to directly recall a quarter to a third of them. Rare facts sat in the model, retrievable when primed with training-like context, unreachable when asked plainly: the recall gap between popular and rare facts ran past twenty points while the encoding gap was five. The authors also take a swing at the comfortable assumption of the moment, writing that “parametric knowledge is essential for fluency, speed, and integration across contexts” and warning against treating it as something RAG compensates for. Their benchmark is Wikipedia facts, not brands, so read the mapping as mine: a stray corpus mention probably gets encoded, and encoded is worth nothing if the model can’t surface it unprimed. Recall follows prominence, the kind built by being learned broadly and consistently. Encoding is nearly free. Recall is the product.
Now put the halves together. Parametric memory is built from training data. Training data is being curated against AI-generated content, filtered for quality and displaced by purchased books. AI content at scale fails twice over. It never enters the corpus that forms memory, so it builds nothing durable, and even entry wouldn’t rescue it, since encoded and recallable are different things. Whatever retrieval-time visibility it buys is rented: re-contested on every query, granted by a fan-out that mostly walks the model’s memory list, revocable the day a filter changes. You’re renting a stall in a market that restocks from a warehouse you’re barred from.
Depreciation runs on someone else’s schedule
Underneath all of it sits a scheduling problem the industry would rather not discuss. Prompt trackers subscriptions bill monthly and report quarterly. Parametric memory forms on training-cycle timescales and lags publication by months to years. Selling a quarterly-reportable product for a lever that cannot be quarterly-reported takes creativity, which is how we ended up with mention counts, share-of-voice charts and content volume: numbers whose main qualification is fitting in a QBR.
And the nullification, when it comes, will not announce itself or send a calendar invite. A training-data policy tightens somewhere, or a detector ships quietly into Search, and the asset you’ve been scaling reprices to zero while the invoices for producing it keep arriving on the first of the month.
The people who run the machines are buying old books and won’t tell you what their detectors can do. Both of those are tells. You’re allowed to read them.
Congratulations on this next chapter. Exciting times.