The Claude Watermark Loophole on Two Older Models, Explained

Anthropic is putting an invisible mark on more of Claude's output, and the rollout comes with a catch worth knowing about. In an email to API customers reported on October 31, the company said it will watermark four more models: Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6, and Claude Sonnet 4.6. Newer models such as Claude Opus 5.5 already carry the mark. On two of the four, though, the mark only shows up if developers leave their sampling settings untouched.

That detail matters because the whole point of the watermark is accountability. If a compliance team is counting on it to prove that a piece of text came from Claude, a single settings tweak that silently removes it changes the deal.

How the Claude watermark works

Anthropic describes the watermark as an imperceptible pattern in word choice. It does not add characters, change the meaning, or make the text read strangely. The pattern is woven into which words the model picks, so it travels with the text when it is copied and pasted, and it may survive light editing. Readers cannot see it. Only a detector with the right key can check for it.

The method is a variant of Google DeepMind's SynthID approach for text, which adjusts the randomness behind word selection to leave a statistically detectable signal. Anthropic says the mark adds no cost, changes no API format, and carries no information about the user or the conversation. Customers cannot switch it off directly, and because it is embedded at the model level, it applies wherever the model is hosted, including Amazon Web Services, Google Cloud, and Microsoft Foundry. Amazon Bedrock may receive the change a few days later than other platforms.

The Claude watermark loophole, in plain terms

Here is the loophole. On Claude Opus 4.6 and Claude Sonnet 4.6, the watermark applies only when three sampling parameters stay at their defaults: temperature, top_p, and top_k. These settings control how much randomness the model uses when choosing words. Change any one of them through the API and the output comes back unmarked.

Anthropic says so itself. Its email warns customers who rely on the watermark for compliance to keep those settings at their defaults. That is honest, and it is also an admission that the retrofit is conditional. A developer who tunes temperature for more creative output, or sets top_p for tighter answers, will quietly lose the mark without any warning in the output itself.

The email carries no such caveat for Claude Mythos 5 or Claude Opus 4.7, which suggests those two are marked regardless of settings. Anthropic has not explicitly confirmed that, so treat it as a reasonable reading rather than a promise. The contrast is the story: two models get an unconditional mark, two get a conditional one, and the difference comes down to how each model was built.

Why the EU AI Act forced this rollout

The timing is not a coincidence. The EU AI Act's transparency obligations push providers toward making AI-generated content identifiable, with a December deadline driving the current wave of retrofits. Every Claude model released after August 2, 2026 shipped with the watermark from day one. Older models are being brought into line in stages, and this batch is the latest step.

Anthropic signed the EU's voluntary code of practice on transparency of AI-generated content in July 2026, alongside around 190 other signatories. OpenAI launched its own watermarking system, textGrain, in October 2026, but it only activates by default for ChatGPT and Codex users in the EU. Anthropic applied its mark worldwide from the start, which is a stronger stance, even with the loophole on two older models.

Checking for the mark is still limited. Anthropic's detection API is in private preview for eligible organizations such as regulators, law enforcement, media, fact-checkers, independent researchers, and educational groups, with wider access planned over time. For now, most people cannot verify a watermark themselves. They have to take the system's word for it, or apply for access.

What compliance teams should actually do

If your organization relies on watermarking, pin the defaults. That is the direct lesson from Anthropic's own warning. Lock temperature, top_p, and top_k at their defaults in any application where the watermark matters, log the settings with each request, and treat any output produced with non-default settings as unmarked by definition.

Then be honest about what a watermark can and cannot prove. Anthropic's own help page lists the limits. A detected mark means the text may have come from Claude, not that Claude wrote it from scratch, because people also use the model to proofread, rewrite, or translate. A missing mark proves nothing at all, because short passages, heavy edits, and paraphrasing can all wipe it out. The watermark is evidence, not proof, and any policy that treats it as a verdict will eventually embarrass someone.

This is also a good moment to remember how fast the rules around Claude are moving. The FTC sent 50 page demands to OpenAI and Anthropic as AI safety became a regulatory file, and Claude's first new API version since 2023 broke old settings including temperature, top_p, and top_k. The same parameters at the center of this loophole are the ones developers were recently forced to rethink. If your code touches them, audit it twice.

The honest verdict

Watermarking is a genuine transparency step, and Anthropic deserves credit for applying it worldwide and for disclosing the limitation instead of burying it. But a mark that disappears when one setting changes is a nudge, not a lock. It will catch casual, unmodified output, and it will miss anything produced by someone who tunes their settings, whether deliberately or by accident.

That gap will probably narrow as older models retire and detection access widens. Until then, the sensible position is to use the watermark as one signal among several, keep the defaults where compliance matters, and never build a policy that assumes every piece of Claude output carries a mark. The technology is moving in the right direction. It just is not finished yet.