Anthropic adds text watermark to four more Claude models, with a loophole

Anthropic is extending its invisible text watermark to four more Claude models: Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6 and Claude Sonnet 4.6, according to an email to API customers reported on Oct. 31. The catch: on Opus 4.6 and Sonnet 4.6, the mark only applies when developers leave the model’s sampling settings at their defaults, so a small tweak to any one of them is enough to avoid it.

Anthropic cites the EU AI Act’s December deadline as the reason it is retrofitting older models now. For teams that build on Claude and expect the watermark to cover their own transparency obligations, the default-settings condition matters.

What changes in this rollout

Since Aug. 2, 2026, every newly released Claude model has shipped with the watermark from day one, while older models are getting it in stages. Newer models such as Claude Opus 5.5 already carry it. The new email brings four more models into scope, and Anthropic says the rollout on Amazon Bedrock may take a few extra days.

The conditions differ by model, as Anthropic’s email describes them:

Model	Watermark status	Sampling condition
Claude Opus 5.5 and other models released after Aug. 2, 2026	Already watermarked	None reported
Claude Mythos 5	Being added	No caveat mentioned in the email
Claude Opus 4.7	Being added	No caveat mentioned in the email
Claude Opus 4.6	Being added	Only at default temperature, top_p and top_k
Claude Sonnet 4.6	Being added	Only at default temperature, top_p and top_k

Source for table: Anthropic’s email as reported by The Decoder.

Because the watermark is embedded at the model level, it works on every platform that hosts these models, including Amazon Web Services, Google Cloud and Microsoft Foundry, and customers cannot turn it off.

The Opus 4.6 and Sonnet 4.6 loophole

On the two 4.6 models, Anthropic says the watermark only applies when three sampling parameters stay at their default values. Those parameters (temperature, top_p and top_k) control how much randomness the model uses when it picks each next word. A minor change to any one of them removes the watermark.

Anthropic flags this directly to customers:

“If you rely on the watermark for your own compliance, keep these settings at their defaults.”

That warning appears in Anthropic’s email to API customers.

The email does not mention the same caveat for Claude Mythos 5 or Claude Opus 4.7, which The Decoder reads as a sign that the watermark applies to those models regardless of sampling settings. That is an inference from what the email leaves out, not a statement from Anthropic.

The gap is notable because, in The Decoder’s assessment, Opus 4.6 remains Anthropic’s best writing model, ahead of even Opus 5.5. Anyone who wants unmarked Claude prose has a documented route through a model some still prefer for writing. For developers, the practical consequence runs the other way: if a product changes temperature or top_p on Opus 4.6 or Sonnet 4.6 for stylistic reasons, its output is not watermarked.

How the Claude watermark works

Anthropic describes the watermark as an “imperceptible pattern in word choice” that doesn’t change meaning, quality or readability. It adds no extra characters or tokens, does not affect pricing or request and response formats, and, per Anthropic, barely slows output speed.

The method is a variant of Google DeepMind’s SynthID text technique, which adjusts the randomness behind word selection to produce a statistically detectable pattern. An explainer by XiaoHu.AI, based on Anthropic’s technical write-up, describes it this way: when several words fit equally well, ordinary generation picks one at random, and the watermark replaces that random source with one determined by a key plus the preceding text. A single word reveals nothing, but across many choices someone holding the key can test whether the sequence follows the same selection rule. The watermark only chooses among options the model already considers reasonable; it does not insert rare words to leave a mark.

This also explains the 4.6 loophole in principle: the scheme works through the sampling step, which is the same step that temperature, top_p and top_k control.

Signal strength varies by content. Full-length generation and translation produce stronger signals, while short text, code, factual passages and light proofreading are harder to verify. When Anthropic first announced the system in August, it said a mark may be lost when text is heavily edited, paraphrased, translated or mixed with other writing, and very short passages may not contain enough material for reliable detection.

On privacy, Anthropic says the watermark “contains no information about the user, their organization, or their conversations with Claude”.

Why now: the EU AI Act timeline

The obligations of Article 50 of the EU AI Act took effect on Aug. 2, 2026, requiring generative AI providers to mark the content their systems produce and make sure it can be detected as AI-generated. Anthropic has signed the Article 50(2) Code of Practice on Transparency of AI-Generated Content as a provider of both generative AI models and systems.

The August plan covered Claude models launched on or after Aug. 2, and Anthropic said at the time it was working to add marking to earlier models under the law’s transition arrangements. Although prompted by EU rules, marking applies wherever supported Claude models are offered worldwide, not only to output produced in the EU; XiaoHu.AI reports this is because Anthropic cannot yet enable the watermark reliably by region.

Text is only half of the scheme. Supported files, including SVG, PNG and JPG, receive digitally signed provenance metadata based on the C2PA open standard (from the Coalition for Content Provenance and Authenticity). Anthropic said that metadata may be unavailable through some cloud platforms, products, features or file types.

How rivals handle AI text watermarks

The three largest model makers have taken different defaults:

• Anthropic: watermark on by default at the model level, no customer opt-out, across cloud platforms.
• OpenAI: launched its own system, textGrain, in October 2026; it is on by default only for ChatGPT and Codex users in the EU, while API customers worldwide can toggle it and it ships disabled.
• Google DeepMind: open-sourced SynthID for text and built it into the Gemini models, where it has been deployed since 2024.

For API builders, that makes Claude the stricter option of the three: the mark is present unless a developer uses one of the two 4.6 models with non-default sampling.

What it means for builders, and the open questions

Several practical points follow from the sources:

• Compliance is still your job. Developers deploying Claude in their own products remain responsible for assessing how Article 50 applies to their services. If your product relies on Anthropic’s watermark, Anthropic’s own advice for Opus 4.6 and Sonnet 4.6 is to keep sampling settings at their defaults.
• Verification is limited for now. Anthropic has a detection API in private preview for verifying the watermark.
• A detection is a signal, not proof. Because people use Claude to proofread, translate and summarize existing material, a mark indicates Claude may have processed the content rather than establishing who wrote it; and failing to detect a mark does not show text was written without AI. A detection result carries no user identity and cannot establish authorship, cheating or truth.

The quality debate

Whether watermarking really leaves text quality untouched is disputed. Blogger John Gruber argues that no two synonyms mean exactly the same thing, so choosing words by a watermark key instead of semantic fit inevitably costs precision. The legal trade outlet Artificial Lawyer raises a separate concern for law firms: clients who have banned AI use could discover the mark, and multiple watermarks layered in one document could cause complications.

An independent paper posted to arXiv in September by Alexander Nemecek, Vipin Chaudhary and Erman Ayday tests the open-source SynthID-Text implementation on two open-weight models, because no public tool can test the deployed systems. On prose, the measured effect of the watermark does not exceed that of changing the sampling seed. On code, it cost three points of correctness on one model and was below measurement on the other, while detection stayed near chance. The authors stress that these results come from open implementations, not from Anthropic’s production system, and argue that the real governance failure is that neither users’ objections nor vendors’ assurances can currently be verified. They call for release of matched outputs, configuration disclosure, accredited audits, a shared evaluation protocol and interoperable detection.

What to watch next

• The December deadline: whether Anthropic closes the default-settings gap on Opus 4.6 and Sonnet 4.6 before the EU AI Act deadline it cites.
• Bedrock timing: the Amazon Bedrock rollout may lag by a few days.
• Detection access: whether the detection API moves beyond private preview, and whether third parties get tools; Anthropic said in August that detection methods for users and third parties were in development without a published timetable.
• Remaining older models: the email covers four models; content from older models or unsupported platforms may still carry no detectable mark.
• Independent audits: whether vendors release the matched outputs and configuration details researchers say are needed to test quality and privacy claims.