Anthropic adds an invisible watermark to text from four older Claude models

The email's subject line says it all: “Text watermarking is coming to more Claude models.” Anthropic sent it in late October to organizations that use four of its models released before August 2, 2026, according to Pasquale Pillitteri's website and the trade outlet The Decoder, which reported its contents. Starting November 3, text produced by Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6 and Claude Sonnet 4.6 carries an invisible mark. On Amazon's Bedrock service, the rollout may take a few more days.

The principle is not new. Anthropic already applies it to all models released after August 2, 2026, the date the AI Act's transparency obligations took effect. The AI Act is the European regulation on AI. In July, the company also signed the European Union's code of practice on the transparency of AI-generated content. What changes is the extension to older models, for which the European text provides a transition period.

How do you mark a text without adding a single character?

In its announcement published on August 14, Anthropic explains that the watermark does not insert any hidden characters. It works on word choice: where the model would normally pick at random among several possible phrasings, a secret key steers the choice. The resulting pattern is undetectable when reading, but can be spotted by a tool that has the key. According to the company, the mark contains no information about the user, their organization or their conversations, and it is applied at the model level, regardless of the service hosting it. Because there is no reliable way to limit it to Europe, it is applied worldwide.

Anthropic itself acknowledges several limits. A fully rewritten text loses the mark, whereas a light edit would “probably” not erase it completely. Detection works poorly on short texts. Computer code and factual passages are only lightly marked. Finally, the watermark cannot distinguish a text written by Claude from a text heavily edited by it, and its absence does not prove that a human wrote the text.

On two models, a way out

The Decoder spotted an important detail in the email. On Opus 4.6 and Sonnet 4.6, the watermark applies only if three generation parameters (“temperature” and two other settings that control how much randomness goes into word choice) keep their default values. Changing just one of them is enough to produce unmarked text. Anthropic therefore advises customers who rely on this marking for their own compliance not to touch these settings. The email does not mention this caveat for Mythos 5 and Opus 4.7.

Other voices question the technique itself. Blogger John Gruber argues that two synonyms are never quite equivalent: letting a key choose between them would cost precision. The site Artificial Lawyer worries about law firms, some of whose clients prohibit the use of AI and could now check for it.

Who will be able to verify?

For now, almost no one. Anthropic's detection tool is in private preview, limited to organizations deemed eligible (regulators, media, researchers) and to companies subject to the obligation. There is no public tool for checking a text. Images and files produced by Claude, by contrast, receive provenance metadata under the C2PA standard.

Several older models, including Haiku 4.5, are not mentioned in the email, and no date is given for Google Cloud and Microsoft Foundry. The underlying question remains: what good is this marking as long as the tool able to read it stays reserved for a few? As with the first implementation standard of the AI Act, we will have to wait for real-world use to judge.