Hidden watermarks in ChatGPT? OpenAI calls it an RL quirk

If you thought you could just copy and paste an essay from ChatGPT without leaving any trace, you might want to double-check what is hiding inside your clipboard.

The team at academic toolmaker Rumi spotted something unusual in OpenAI's newer and more advanced models, GPT-o3 and o4-mini. When generating longer text, these models appeared to embed hidden Unicode characters directly into the sentences.

Invisible markers inside plain text

The discovery happened when Rumi tested GPT-o3 on a prompt asking for a full essay about the Department of Education. Looking at the raw output in code editors like Sublime Text or Visual Studio Code, researchers uncovered systematic patterns of special characters.

The characters were mostly Narrow No-Break Spaces, known technically as Unicode U+202F. In a standard word processor or browser, they look identical to regular spacebar hits, completely invisible to the naked eye.

Crucially, these characters survive direct copy-pasting into tools like Google Docs. Older models like GPT-4o showed no signs of this behavior, leading the researchers to suspect OpenAI was quietly rolling out invisible text watermarks to track generated text and prevent plagiarism.

Unlike traditional AI detectors that are notorious for false positives, spotting non-standard Unicode spaces would theoretically offer near-zero false accusations, since no human naturally types a Narrow No-Break Space between words.

A deliberate watermark or just an RL glitch?

The story took another turn when OpenAI officially reached out to Rumi to push back on the watermark theory.

According to OpenAI, these invisible characters were not a deliberate security feature at all. Instead, the company described them as simply a quirk of large-scale reinforcement learning. In short, the model picked up the unusual formatting behavior on its own during post-training.

By April 23, Rumi reported that follow-up tests showed the special characters had vanished, indicating OpenAI likely patched whatever caused the glitch behind the scenes.

Still, skeptics pointed out that whether intentional or not, relying on character-level watermarks is fundamentally fragile. A student or researcher only needs to run a simple find-and-replace command in any basic text editor to strip every single special character in seconds.

Why it matters

The timing of this discovery is what made everyone pay attention. OpenAI had made ChatGPT free for students through the end of May, right in the middle of final papers and capstone projects.

If schools had caught wind of invisible markers, students directly pasting text could have faced immediate academic penalties, while slightly more tech-savvy peers using find-and-replace would skate by unnoticed. That creates a bizarre dynamic where the penalty falls on technical naivety rather than AI usage itself.

Beyond classrooms, there is also the high-stakes battle over model training data. With frontier labs widely suspected of scraping rival LLM outputs—like ongoing speculation around DeepSeek using ChatGPT data—reliable text watermarks are the holy grail for proving data theft.

We think this incident proves just how hard watermarking text really is compared to images or audio. A simple format conversion, text scraper, or regex pass immediately neutralizes character-based signatures. For schools and companies alike, policing generated text with hidden traps looks like a losing battle, pushing the real solution back toward process tracking and verified revision history.