Anthropic's text watermark is easy to bypass on several older Claude models

Anthropic's text watermark is easy to bypass on several older Claude models

Update, November 4, 2026:

Anthropic emailed API customers again about a second round of watermark retrofits. Starting November 16, 2026, Claude Opus 4.6, Claude Opus 4.5, Claude Sonnet 4.5, and Claude Haiku 4.5 will all get text watermarking. On Amazon Bedrock, the rollout may take a few extra days.

Claude Opus 4.6 was originally part of the first wave and should have gotten the watermark on November 3. Anthropic explicitly confirms the delay to November 16 but gives no reason. The other three first-wave models, Claude Mythos 5, Claude Opus 4.7, and Claude Sonnet 4.6, don't show up in the new email so their rollout likely went ahead on November 3 as planned.

Claude Opus 4.5, Claude Sonnet 4.5, and Claude Haiku 4.5 are three models that weren't part of the previous announcement. All four models in this wave share the same sampling restriction: the watermark only applies when temperature, top_p, and top_k are set to their defaults. In the first wave, that limit only hit two of four models (Opus 4.6 and Sonnet 4.6).

Original article, October 31, 2026:

Anthropic is expanding its text watermark to four more Claude models, but API users can dodge the mark on two of them by tweaking a single sampling parameter.

In an email to API customers, Anthropic said it will watermark Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6, and Claude Sonnet 4.6. Newer models like Claude Opus 5.5 already carry the mark, and the rollout on Amazon Bedrock may take a few extra days.

Anthropic calls the watermark an "imperceptible pattern in word choice" that doesn't change meaning, quality, or readability. The company says it adds no extra characters or tokens, doesn't affect pricing or request and response formats, and barely slows output speed. Anthropic also says the watermark "contains no information about the user, their organization, or their conversations with Claude."

Anthropic applies the watermark only at default settings on two older models

On Claude Opus 4.6 and Claude Sonnet 4.6, Anthropic says the watermark kicks in only when developers leave the three sampling parameters at their default values. Those parameters, temperature, top_p, and top_k, control how much randomness the model uses when picking words. A minor tweak to any one of them is enough to dodge the watermark. Anthropic warns in its email that "If you rely on the watermark for your own compliance, keep these settings at their defaults."

The email doesn't mention that caveat for Claude Mythos 5 or Claude Opus 4.7, which suggests the watermark applies to those models regardless of sampling settings. But the loophole on the older models is still notable, since Opus 4.6 remains Anthropic's best writing model, ahead of even Opus 5.5.

Anthropic has a detection API in private preview for verifying the watermark and offers more details on its content labeling information page.

Anthropic retrofits older Claude models to meet the EU AI Act deadline

Anthropic points to the EU AI Act's December deadline as the reason it's watermarking older models now. Every model released after Aug. 2, 2026, shipped with the watermark on day one, while older models are getting it in stages. Since the watermark is embedded at the model level, it works on every platform that hosts these models, including Amazon Web Services, Google Cloud, and Microsoft Foundry. Customers can't turn it off.

Anthropic uses a variant of Google DeepMind's SynthID text method, which tweaks the randomness behind word selection to produce a statistically detectable pattern. OpenAI launched its own watermarking system textGrain in October 2026, but it only activates by default for ChatGPT and Codex users in the EU. API customers worldwide can flip it on or off, and it ships disabled. Google Deepmind open-sourced SynthID for text and built it into the Gemini models.

Whether watermarking truly leaves text quality untouched is disputed. Blogger John Gruber argues that no two synonyms mean exactly the same thing, so picking words by a watermark key instead of semantic fit inevitably degrades precision. The legal trade outlet Artificial Lawyer raises a separate concern for law firms, where clients who've banned AI use could discover the mark, and multiple watermarks layered inside one document could create complications.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe now