Anthropic extends Claude watermark to four older models from November 3

Anthropic extends Claude watermark to four older models from November 3

Anthropic is now rolling out its invisible text watermark to four older Claude models: Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6. According to an email to API customers, the expansion is set to begin November 3 — but on two of the models it comes with a limitation Anthropic itself has acknowledged: on Opus 4.6 and Sonnet 4.6, the watermark is silently deactivated if the API call changes even one of three default sampling parameters. For developers counting on the watermark for EU AI Act purposes, with a deadline of December 2, this means production settings should be reviewed now.

What is changing

The watermark was launched in August in response to EU regulation that requires such marking of generated content, and from the start it was rolled out to the company's newest models. Now it is being extended to older systems. According to The Independent, there is no way to opt out, and the watermark applies to all users globally — despite the justification being European regulation.

The November 3 start date, however, has not been confirmed through Anthropic's official pages. It originates from an email sent to API customers, known through The Decoder's coverage and relayed by several publications; a Japanese technology blog holding screenshots of the email notes that the date "is not yet listed on Anthropic's official page." So it is a third-hand source for the actual dates, while the expansion itself to the four models is confirmed by multiple independent reports.

The vulnerability Anthropic itself has acknowledged

The most striking thing is not the expansion, but what Anthropic has said about it. According to The Independent, the company states that changing the settings that govern how the system picks words — done via the API — removes the watermark on Opus 4.6 and Sonnet 4.6.

The Decoder, which first reported the caveat, has identified the three parameters: temperature, top_p and top_k. The watermark on the two models activates only when API calls use the exact default values for all three. Change any one of them, and the watermark is deactivated without any signal — no error is returned, no warning appears in the response. A developer who adjusts sampling for creative writing or controlled generation may therefore believe the text is watermarked when it is not.

Anthropic's own advice in the customer email, quoted via The Decoder, puts it plainly: "If you rely on the watermark for your own compliance, keep these settings at their defaults."

It is worth being precise about the scope: the evidence covers only Opus 4.6 and Sonnet 4.6. There is no documentation that Mythos 5 or Opus 4.7 share the same weakness, and it should not be assumed.

Why does it happen? The mechanism behind it

The watermark is, according to technical analysis, built on Google DeepMind's SynthID-Text method, published in Nature in October 2024. The method uses what is called tournament sampling: during text generation, a group of candidate words is gathered, and an extra "watermarking layer" influences which word is ultimately chosen, in a way that is statistically traceable later — without the text reading any differently to humans.

The key to the vulnerability lies in when the mechanism was added. On Opus 4.6 and Sonnet 4.6, the watermark was retrofitted onto finished, trained model weights. Tournament sampling works inside the word-selection process itself, and when a developer changes the temperature or top_p/top_k, the basis for how candidate words are ranked and chosen shifts. The result is that the statistical signature either is not embedded or can no longer be reliably detected — which is why the watermark is switched off rather than functioning incorrectly.

The newest models — Opus 5.5, Haiku 5.5 and Sonnet 5.5 — do not have this limitation. There, watermarking was integrated during training itself, so the mechanism was optimized as part of the model's architecture rather than sitting as a layer on top of finished weights.

The compliance deadline that makes this urgent

The context is Article 50(2) of the EU AI Act, which requires machine-readable marking of AI-generated text. The deadline is December 2 — roughly a month after the November 3 watermark expansion. For developers planning to use the Claude watermark as part of their compliance, the window to verify that production calls keep the sampling parameters at default values is therefore measured in days.

There is an important limitation on the detection side as well. The tool for checking whether text carries the watermark is still in a pilot phase, and access is limited to regulators, news organizations, fact-checking groups, researchers and educational institutions. That means a company cannot, in principle, verify on its own that its outputs are actually watermarked — yet another reason the silent deactivation point on Opus 4.6 and Sonnet 4.6 is a practical problem, not just a technical curiosity.

Open questions

Several matters remain unresolved. Anthropic has not published primary documentation on the parameter dependency, and the company has not issued a public response beyond the reported advisory email. The email's exact wording is known only through The Decoder's coverage.

There is also another, separate way to avoid the watermark, which should be kept distinct: The Independent has reported that users can simply choose even older models — all the way back to Opus 3 — which are not watermarked. That is a question of model choice, not API parameters, and it points to a broader limitation of the rollout: the watermark follows the models, not the company's entire production.

And it remains to be seen how regulation and practice will deal with this. MSN's syndicated analysis suggests that most production setups use non-default sampling, but that is the outlet's own analysis, not a verified figure. What Article 50(2) actually requires — and whether a watermark that switches off under common API configurations counts as sufficient marking — are questions regulators have not yet answered publicly.

The concrete advice stands regardless, in Anthropic's own email: check that temperature, top_p and top_k are set to their default values in all production calls where the watermark is part of the compliance picture — on Opus 4.6 and Sonnet 4.6 especially, because there the difference between watermarked and not watermarked is invisible both to the user and in the response that comes back.