Anthropic Extends Claude's Invisible Text Watermark to Four More Models, and Two of Them Can Switch It Off With One Setting

Anthropic is extending its text watermark to four more Claude models — Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6 and Claude Sonnet 4.6 — according to a notice the company sent to API customers by email. Newer models in the family, including Claude Opus 5.5, already carried the mark. The change is being rolled out through the API, and Anthropic has not published a public documentation page describing the expansion, so the details below come from the customer notice and the reporting built on it rather than from an official product page.

The mark is not a visible tag or a metadata field. Anthropic describes it as an imperceptible pattern in word choice, embedded in the statistics of how the model picks its next token, which means a reader cannot see it and light editing does not reliably remove it. The company says the watermark adds no extra characters or tokens, does not change pricing or the request and response formats, barely affects output speed, and contains no information about the user, their organisation or their conversations. Technically it is a variant of Google DeepMind's SynthID text method, which nudges the randomness behind word selection to produce a pattern that a statistical detector can confirm.

The caveat is the interesting part. On Claude Opus 4.6 and Claude Sonnet 4.6, the watermark applies only when developers leave three sampling parameters — temperature, top_p and top_k — at their default values. Change any one of them and the output comes back unmarked. Anthropic's notice warns customers who rely on the watermark for their own compliance work to keep those settings at their defaults, which is an unusual thing for a vendor to write down: the workaround and the request not to use it appear in the same paragraph.

The notice does not attach the same condition to Mythos 5 or Opus 4.7, which implies the mark applies there regardless of sampling settings. That is an inference from what the email omits rather than something Anthropic has stated, and it is the kind of gap that a public technical document would close immediately.

The timing is regulatory. Anthropic points to the European Union's AI Act deadline in December as the reason for retrofitting older models now. Under the company's account, every model released after 2 August 2026 shipped with the watermark from day one, while older models are being brought in stages. Because the mark is embedded at the model level rather than in a wrapper, it travels with the model to every platform that hosts it, including Amazon Web Services, Google Cloud and Microsoft Foundry, and customers cannot turn it off. Rollout on Amazon Bedrock may take a few extra days.

Anthropic also operates a detection API in private preview for checking whether a piece of text was likely produced by a watermarked Claude model. Access is limited, which matters for how useful the signal is in practice: a watermark that only the vendor and a handful of partners can verify is closer to an audit trail than to a public provenance label.

The design has drawn predictable objections. Writing critic John Gruber has argued that no two synonyms carry identical meaning, so choosing words by a watermark key instead of by semantic fit must cost some precision. Legal trade outlet Artificial Lawyer has raised a separate concern for law firms: clients who have banned AI use could in principle discover the mark in a document, and several watermarks layered inside one file would complicate attribution.

The wider point is that the loophole, not the watermark, tells you where the industry is. OpenAI's textGrain, launched in October, ships disabled for API customers worldwide and switches on by default only for ChatGPT and Codex users in the EU. Anthropic's version cannot be switched off at all but can be sidestepped by a parameter change on two of the four models it just covered. Both are compliance features built to a deadline, and neither yet behaves like an enforcement mechanism. Teams that depend on provenance should treat the setting as part of their compliance surface, and assume the mark is evidence rather than proof.