Anthropic watermarks four Claude models — but a single parameter call evades the mark on two of them

Anthropic watermarks four Claude models — but a single parameter call evades the mark on two of them

Anthropic is extending its text watermark to four Claude models ahead of the EU AI Act's December deadline, but on the two oldest of them the mark only activates at default settings — a limitation the company itself has warned customers about.

Anthropic is extending its text watermark to Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6 and Claude Sonnet 4.6. The news comes in an email to API customers that The Decoder's Matthias Bastian reported on 31 October 2026 (The Decoder, source ca7823f8). According to the email, all models launched after 2 August 2026 shipped with the watermark from day one, and the rollout on Amazon Bedrock may take a few extra days.

But the company has also disclosed a limitation that is directly relevant for developers: on Opus 4.6 and Sonnet 4.6, the watermark only activates when three sampling parameters are at their default values.

The gap in coverage

The three parameters are temperature, top_p and top_k. Together they control how much randomness the model uses when choosing words. On the two older models in the expansion, the watermark therefore only kicks in when these sit at their defaults. If a developer changes even one of them, the generated text escapes the mark.

The Decoder reports that Anthropic warned customers who rely on the watermark for compliance to leave the parameters untouched. It is an unusually candid caveat: the company itself points out the condition under which most vendors would have left it unmentioned. For a developer using the watermark as documentation in an AI Act context, it means that "our text is watermarked" only holds as long as no one in the value chain has adjusted the sampling.

Note that it is The Decoder's inference — based on the email's silence on the point — that the watermark on Mythos 5 and Opus 4.7 applies regardless of sampling settings. That is not a confirmed statement from Anthropic and should not be treated as one.

Why now

Anthropic ties the timing to the EU AI Act's December deadline, when the requirements for labeling AI-generated content take effect. According to the email, all models launched after 2 August 2026 shipped with the watermark from day one, while older models are now getting it in stages. The four models in this expansion are thus a retrofit of existing, widely used models — including Opus 4.6, which The Decoder describes as Anthropic's strongest writing model. It is not marginal text that is getting the mark, but models likely behind significant volumes of business-critical content.

How the mark works

Technically, Anthropic builds on a variant of Google DeepMind's SynthID method for text. The method adjusts the randomness in word choice so that a statistically detectable pattern emerges in the text — without any individual words being visibly changed. It is not a visible stamp, but a bias in the distribution of word choices that a detection model can read out of long passages of text.

Two features distinguish this setup from much other watermarking:

• Embedded at model level. Because the mark sits in the model itself, it applies on every platform hosting the models — Amazon Web Services, Google Cloud and Microsoft Foundry. A customer running Claude via Bedrock therefore cannot escape the watermark by switching cloud provider.
• Cannot be switched off. Customers have no way to disable the mark, according to The Decoder. This differs from OpenAI's solution and is central to whether the mark can function as reliable documentation.

Anthropic states that the mark is impossible to distinguish from unwatermarked text, and that it does not affect price, token counts or the content itself. There is also a detection API, but it is so far only in private preview — it has not been publicly tested.

All of this information comes from a single secondary source: The Decoder's account of Anthropic's email. Neither the email nor the company's documentation pages are publicly available for this article, so the details stand or fall with that reporting.

The quality question is contested

Anthropic's claim that the watermark does not degrade text quality is unverified, and it meets counterarguments. The blogger John Gruber has argued that no two synonyms mean exactly the same thing — so when the model picks words according to a watermark key rather than semantic precision, precision degrades. It is a general objection to all statistical watermarks, not just the SynthID variant.

In a legal context, Artificial Lawyer has raised concerns for law firms, where word choice can carry contractual and legal significance. For an industry where precise wording is the product itself, a watermark that is "entirely invisible" is a claim that requires proof, not just assurances.

Context: OpenAI went first — but narrower

Anthropic is not alone. OpenAI launched its own text watermarking system, textGrain, in October 2026. But it only activates by default for ChatGPT and Codex users in the EU — geographically limited and interface-based, not at model level. Anthropic's approach — model-based, across all platforms, with no off switch — is more aggressive on coverage. Together, the two launches point to text watermarking moving from research project to production standard for the major vendors, driven by the same December deadline.

At the same time, the difference shows how differently vendors interpret the scope of the regulation: OpenAI scopes by the user's geography, Anthropic by the model's launch date.

Open questions

Much remains unknown:

• Will Anthropic close the parameter gap? The email says nothing about whether the condition on Opus 4.6 and Sonnet 4.6 is temporary or permanent, or whether it will apply to future retrofits.
• How will regulators treat conditional watermarking? If a mark can be evaded with a single parameter call, it is unclear how much weight it carries as "labeling" under the AI Act's standard — and unclear whether the company providing the API or the customer changing the parameters bears the responsibility.
• Does detection work in practice? The detection API is in private preview and publicly untested. Effectiveness against paraphrasing, translation or mixed human/machine text is not documented.
• The quality claim. Anthropic's assurance of unaffected quality is the company's own statement, contradicted by Gruber and Artificial Lawyer, and unsupported by public measurements.

For developers, the concrete advice for now is simple: if you rely on the watermark for compliance, leave temperature, top_p and top_k at their defaults — and bear in mind that the mark is a vendor guarantee, not a technical impossibility to circumvent.