Anthropic is expanding its AI text watermarking system to additional Claude models, aiming to make AI-generated content easier to identify as regulators push technology companies towards greater transparency. However, the rollout has exposed a technical limitation: developers using two older Claude models can reportedly bypass the text watermark by changing a single sampling parameter in their API requests.
The affected models are Claude Opus 4.6 and Claude Sonnet 4.6. According to a report published by The Decoder on October 31, 2026, Anthropic’s watermark is applied to these models only when developers leave the sampling settings at their default values. A small change to parameters such as temperature, top-p or top-k can prevent the watermark from being applied. The discovery raises questions about how consistently AI-generated text can be identified when watermarking depends partly on how a model is configured.
Key Takeaways
- Anthropic is expanding text watermarking to four additional Claude models.
- Claude Opus 4.6 and Claude Sonnet 4.6 have a reported configuration loophole.
- Changing one sampling parameter from its default setting can bypass watermarking on those two models.
- Claude Mythos 5 and Claude Opus 4.7 are also included in the rollout, without the same caveat reported for the older models.
- Anthropic uses a version of Google DeepMind’s SynthID-Text watermarking technology.
- The rollout is connected to transparency requirements under the EU AI Act.
- Anthropic says its watermark does not identify individual users or add extra tokens to generated text.
Anthropic Expands Watermarking to More Claude Models
Anthropic is introducing text watermarking across four additional Claude models: Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6.
The company had already introduced watermarking in newer models, including Claude Opus 5.5. The latest expansion is intended to bring older models into the content-marking framework as Anthropic prepares for regulatory requirements.
According to The Decoder, Anthropic informed API customers about the rollout through an email. The company also indicated that deployment through Amazon Bedrock could take a few additional days.
The watermark is designed to remain invisible to readers. Instead of adding special characters, labels or visible identifiers, it creates a statistically detectable pattern through the model’s word-selection process.
Anthropic says the system does not add extra tokens, change pricing or alter the normal API request and response formats. It also says the watermark does not contain information identifying users, organisations or individual conversations.
How Developers Can Bypass the Watermark on Two Older Models
The main issue concerns how Anthropic applies watermarking to Claude Opus 4.6 and Claude Sonnet 4.6.
According to the report, these models apply the watermark only when three sampling parameters remain at their default settings:
- Temperature: Controls the randomness of the model’s word selection. Higher values generally produce more varied responses.
- Top-p: Controls the cumulative probability range from which the model selects its next token.
- Top-k: Limits the number of candidate tokens considered during selection.
Changing even one of these parameters from its default value is reportedly enough to prevent the watermark from being applied to the two affected models.
This creates a limitation for developers and organisations that rely on the watermark to identify AI-generated content. An application that modifies sampling settings for writing style, creativity or output consistency could unintentionally disable the marking mechanism.
Anthropic reportedly warned API customers that anyone relying on watermarking for compliance should keep these parameters at their default values.
The report does not identify the same configuration limitation for Claude Mythos 5 or Claude Opus 4.7.
Which Claude Models Are Affected?
The latest rollout covers four models, but the reported loophole is limited to two older versions.
| Claude model | Watermark rollout | Reported sampling loophole |
|---|---|---|
| Claude Mythos 5 | Included | No equivalent caveat reported |
| Claude Opus 4.7 | Included | No equivalent caveat reported |
| Claude Opus 4.6 | Included | Yes |
| Claude Sonnet 4.6 | Included | Yes |
| Claude Opus 5.5 | Already supported | No equivalent caveat reported |
The distinction matters because developers often adjust sampling parameters to control how an AI model responds. Watermarking that depends on default settings may be less reliable in applications where these configurations are frequently customised.
However, the reported limitation should not be interpreted as proof that every output from these models can be made undetectable. It concerns the application of the watermark under particular API configurations, not every possible method of identifying AI-generated text.
How Anthropic’s Text Watermark Works
Anthropic’s watermarking system uses a version of Google DeepMind’s SynthID-Text approach.
Large language models generate text by selecting tokens one at a time. In many situations, several words can communicate almost identical meanings. For example, a model might choose between words such as “grey” and “overcast” without significantly changing a sentence.
The watermark uses these low-impact choices to introduce a statistically detectable pattern.
Instead of relying entirely on ordinary randomness, the model uses a secret key and preceding words to influence certain token-selection decisions. The resulting text looks normal to readers, but a detector with the relevant key can examine whether its word choices are consistent with the watermark.
<escape>For example, a sentence may contain several equally suitable word choices. The watermark subtly influences those choices over a sufficiently long passage, creating a pattern that can be detected statistically.</escape>
The system is not designed to insert unusual words or visible identifiers. It also does not work equally well in every type of content. Short passages, highly factual writing and exact code have fewer opportunities for the model to make interchangeable word choices.
Why Anthropic Is Introducing Watermarks
Anthropic has linked its watermarking rollout to transparency requirements under the European Union’s AI Act.
The EU’s framework requires providers to mark certain AI-generated content in machine-readable ways. Anthropic says newer models released from August 2, 2026, include marking capabilities from launch, while older models are being updated under a transition period.
The company’s approach includes two different technologies:
| Content type | Marking method |
|---|---|
| Generated text | Invisible statistical watermark |
| Supported generated files | C2PA Content Credentials |
C2PA is an open standard for attaching signed provenance information to digital files. It can help establish whether a supported file was generated or processed using a particular tool.
Text watermarking serves a different purpose. It allows a detector to estimate whether Claude was involved in generating a passage, without adding visible metadata to the text itself.
Anthropic says the watermark is being applied globally because it does not yet have a durable way to restrict the feature by geographic region.
Anthropic’s Watermark Detection API Is Still in Private Preview
Anthropic has developed a detection API that can check whether text contains its watermark. However, access remains limited.
The company says the tool is available in private preview to eligible organisations, including regulators, law enforcement agencies, media organisations, fact-checkers, independent researchers and educational institutions. Certain enterprises with compliance obligations can also request access.
The availability of a detector is important because a watermark is useful only if authorised parties can verify it.
However, watermark detection has limitations. It does not establish who wrote the text, identify the person who used Claude or prove that an entire document was generated by AI.
A positive result indicates that Claude was likely involved in producing or processing the content. It is not a complete authorship or ownership record.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
