Anthropic adds Claude text watermarks, but two older models leave a bypass

Anthropic will begin adding text watermarks to four more Claude models on November 3, 2026, but two come with a consequential exception. On Opus 4.6 and Sonnet 4.6, the mark applies only at default generation settings. Developers changing those settings can produce unmarked output, even as Anthropic extends the system to meet a European compliance deadline.

One rollout, different coverage

The expansion covers Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6. Anthropic notified API customers by email, according to The Decoder. Mashable reported the November 3 start date and said the rollout uses the same technology already operating in Opus 5.5.

For the two 4.6 models, three controls determine whether the watermark operates: temperature, top_p and top_k. These sampling parameters govern randomness in word selection. The Decoder reports that changing any one from its default is enough to bypass the mark. Anthropic’s email identifies that restriction for Opus 4.6 and Sonnet 4.6, but does not specify the same caveat for Mythos 5 or Opus 4.7.

Anthropic ties the older-model retrofit to the EU AI Act’s December deadline, The Decoder reports. Its original August explanation said models launched before August 2, 2026, had a transition period and would receive watermarking over the following months. The November rollout puts a start date and named models behind that earlier commitment.

If you rely on the watermark for your own compliance, keep these settings at their defaults.

Anthropic, in its customer email quoted by The Decoder

A pattern in wording, not a hidden label

The watermark does not append a notice or insert invisible characters. Anthropic’s technical explanation describes a version of Google DeepMind’s SynthID-Text approach: it changes the source of randomness used to choose among plausible next words. A key, combined with preceding words, guides those choices into a pattern that a detector can later check.

The company illustrates this with a weather sentence that could reasonably end in either “overcast” or “grey.” Neither word must always win. Instead, many such choices across a passage create the signal. Anthropic says the method does not push Claude toward words it would not otherwise consider.

Anthropic says its internal tests found no effect on content, creativity or readability. It also says watermarking adds no tokens, leaves pricing unchanged and has a negligible effect on speed. The pattern carries no information identifying a user, organization or conversation. Those are company assurances about the technology, not independent findings from this rollout.

Detection is narrower than proof

Even when the mark is applied, its meaning is limited. Anthropic says a detector estimates the likelihood that Claude helped produce a passage. It cannot distinguish between Claude writing the text and heavily editing it. Nor can it establish that an unmarked passage was human-written or rule out another AI system.

The amount and kind of text also affect detection. Anthropic identifies several boundaries in its explanation:

• Short samples contain fewer word choices, giving a detector less evidence than a longer passage.
• Exact factual answers and code leave fewer interchangeable choices, so watermarking is sparser.
• Light proofreading may leave too few marked changes to register. Anthropic says a complete rewrite removes the watermark.

Checking the signal also requires access to a detector. Anthropic’s detection API remains in private preview, with access for eligible organizations including regulators, media, researchers and educational institutions, plus enterprises with relevant compliance obligations. The company says it plans to broaden access over time; the expansion to older models is not a general release of the checking tool.