Anthropic Watermarks Older Claude Models With an API Sampling Loophole
Anthropic will retrofit text watermarking onto four older Claude models starting November 3 to meet EU AI Act rules, but API sampling tweaks can disable the mark on two of them.
In short
- Anthropic is expanding its text watermarking framework to Claude Mythos 5, Opus 4.7, Opus 4.6, and Sonnet 4.6 starting November 3, 2026.
- On Opus 4.6 and Sonnet 4.6, changing temperature, top_p, or top_k away from default values removes the watermark.
- The watermarking method uses a variant of Google DeepMind's SynthID-Text, altering subtle word choice distributions, which Anthropic claims adds zero tokens and incurs no additional cost.
- Anthropic implemented the change to comply with Article 50 of the European Union's AI Act ahead of a December 2026 deadline.
- Detection tools remain in a closed private preview limited to regulators, researchers, and qualifying compliance enterprises.
Anthropic is expanding its invisible text watermarking system to four older language models starting November 3, 2026, as reported by CellCog. The update retrofits Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6, and Claude Sonnet 4.6 with statistical watermarks designed to verify machine origin. However, Anthropic informed API developers that a technical loophole allows users to bypass the watermark entirely on two of those models simply by altering standard generation settings.
The expansion represents Anthropic's effort to bring legacy systems into compliance with international transparency rules. While newer offerings like Claude Opus 5.5 already apply watermarks by default, older systems have operated without machine-readable identifiers. As regulatory deadlines approach, Anthropic is bringing its earlier catalog under the same provenance framework.
Retrofitting the Claude Catalog
According to an Anthropic customer email shared on social media and documented by FourWeekMBA, the text watermark activates across the four legacy models on the primary Claude Platform starting November 3. The company noted that the rollout for managed instances hosted on Amazon Bedrock may take a few additional days to complete.
Anthropic's documentation outlines a staged implementation across its portfolio. A review of the Claude Help Center shows that 9 of 16 listed Claude models carry all three of the company's provenance markings: text watermarks on first-party surfaces, text watermarks on cloud partner infrastructure (Amazon Web Services, Google Cloud, and Microsoft Foundry), and C2PA Content Credentials for generated image files. The four retrofitted models are currently designated for first-party surface marking, while three other older variants—Opus 4.5, Sonnet 4.5, and Haiku 4.5—remain listed without formal watermarking rollout dates.
The Sampling Parameter Loophole on Older Models
While newer models embed watermarks across varied configurations, Anthropic disclosed a notable limitation on two older versions. On Claude Opus 4.6 and Claude Sonnet 4.6, the watermarking algorithm activates only when developers retain default values for three core sampling parameters: temperature, top_p, and top_k, as detailed by superpowerdaily.com.
These three parameters govern how much randomness the model injects when selecting words. A developer who adjusts any single parameter away from its default setting causes the model to generate plain, unmarked text. In its notice to API customers, Anthropic stated, "If you rely on the watermark for your own compliance, keep these settings at their defaults." Anthropic did not list this sampling restriction for Claude Mythos 5 or Claude Opus 4.7, indicating that those two models retain watermarks across custom settings. The loophole on Opus 4.6 is particularly consequential for enterprise workflows, as Opus 4.6 remains Anthropic's highest-performing writing model, ahead of even the newer Opus 5.5.
How SynthID-Text Word Selection Operates
Anthropic's watermarking architecture does not insert extra or invisible characters, or appended metadata strings into Claude's text output. Instead, it relies on a statistical method adapted from Google DeepMind's SynthID-Text research, as reported by CellCog.
Under normal execution, when a language model faces multiple equally probable words—such as choosing between "overcast" and "grey" to complete a sentence—it uses pseudo-random numbers to make the pick. Anthropic's watermark substitutes that arbitrary randomness with a deterministic mathematical key evaluated against the preceding words. Over the span of a paragraph, this key biases word selections into an imperceptible mathematical pattern that a matching detector can spot.
Anthropic claims the process adds zero additional tokens, does not alter API pricing, introduces negligible latency to generation speeds, and preserves response meaning, readability, and quality. Crucially, the company states that the statistical pattern contains no identifying details about the user, their organization, or the specific conversation history.
Driven by the EU AI Act
Anthropic explicitly links the retrofitting effort to European Union regulation. Under Article 50(2) of the EU AI Act, providers of generative artificial intelligence systems must ensure outputs are marked in a machine-readable format and detectable as artificially generated. While systems introduced after August 2, 2026, had to comply immediately, existing market models were granted a transition period ending in early December 2026, according to reporting from CellCog.
Anthropic signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026 alongside approximately 190 other industry participants. Because the provider lacks a durable mechanism to apply watermarking selectively based on geographic region, it is rolling out the feature globally across all supported interfaces. Competitors have taken different paths: OpenAI launched its proprietary textGrain watermarking system in October 2026, but activated it by default only for EU ChatGPT and Codex users while leaving it disabled and optional for global API developers.
Detection Access and Verification Boundaries
Anthropic has not released a public verification tool for text. Text detection remains restricted to a private preview API accessible only to qualifying organizations under EU law, including regulatory authorities, law enforcement, news media, academic researchers, fact-checkers, and civil society groups, alongside enterprises facing direct compliance obligations.
Anthropic emphasizes that watermark detection is probabilistic rather than definitive proof of authorship. A positive test indicates that Claude was likely involved in generating or processing the text at some stage, but it cannot differentiate between Claude drafting an entire passage and Claude heavily editing human writing. Text that has been completely rewritten by a person loses the mark, whereas light editing preserves it. Very short passages, source code, and strictly factual responses offer too few interchangeable word choices for the algorithm to leave a reliable signature.
The widespread introduction of statistical text watermarking continues to generate debate across the technology and legal sectors. Commentators like John Gruber have argued that true synonyms rarely exist, meaning any algorithm selecting words based on a cryptographic key rather than semantic precision risks degrading nuance. Legal analysis from outlets such as Artificial Lawyer highlights operational risks for law firms whose clients explicitly prohibit artificial intelligence, where embedded watermarks could inadvertently expose assisted drafting. For now, Anthropic's November 3 rollout extends regulatory compliance across its legacy lineup, even as the default parameter loophole leaves an exit door open for API users.
Questions people ask
Which older Claude models are receiving the text watermark on November 3, 2026?
Anthropic is applying the text watermark to Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6, and Claude Sonnet 4.6.
How can API users bypass the watermark on Opus 4.6 and Sonnet 4.6?
On Claude Opus 4.6 and Claude Sonnet 4.6, the watermark only functions when temperature, top_p, and top_k remain at their default values. Changing any of those three parameters disables the watermark.
Does the Claude text watermark include personal or account information?
No. Anthropic confirms that the watermark contains no identifying information about the user, their organization, or the contents of their conversation.
Can the public access Anthropic's text watermark detector?
No. Anthropic's text detection API is in private preview, restricted to regulators, media organizations, researchers, educational bodies, and qualifying enterprises.
Sources
- Anthropic's watermark rollout leaves a loophole on two older Claude modelsThe Decoder, Oct 31, 2026
- How Claude marks AI-generated contentClaude Help Center
- Anthropic expands text watermarking to older Claude versions beginning November 3Mashable SEA | Latest Entertainment & Trending, Nov 1, 2026
- Anthropic to Watermark 4 Older Claude Models for EU AI ActFourWeekMBA, Nov 1, 2026
- Claude's Text Watermark: Older Models Join Nov 3CellCog, Oct 31, 2026
- Anthropic adds Claude text watermarks, but two older models leave a bypasssuperpowerdaily.com, Nov 1, 2026
- Anthropic expands text watermarking to older Claude versions beginning November 3Mashable, Nov 1, 2026
How this story was made: the newsroom picked it up from the-decoder.com, Google Search and Reddit, gathered the full text of the sources above, and drafted it with AI assistance. Every factual claim was then checked against those sources before publishing (26 claims checked). Illustrations marked as AI-generated are not photographs. Spotted an error? Tell us.
Published November 2, 2026 at 00:09 UTC
