The Claude watermark reaches older models: how Anthropic marks AI-generated text

The Claude watermark is moving beyond Anthropic's newest models. In an email to API customers, reported by the trade site The Decoder on October 31, Anthropic said it will add the mark to text from Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6. Smaller sites quoting the same email put the start on November 3, 2026; Anthropic has not published a date. The reason is the EU AI Act, which from August 2 requires AI-generated content to carry machine-readable marks.

What is the Claude watermark?

It is an invisible statistical pattern in the words Claude picks, not a label or a hidden character. Anthropic's explainer on the text watermark, published on August 14 and updated on September 1, says "nothing is added to the text and there are no hidden characters." The mark lives in the text itself, so it travels with copy and paste.

Anthropic marks content in two ways. Text gets the statistical watermark. Supported files, such as PNG or JPEG images, get signed C2PA Content Credentials, a metadata note from the open C2PA standard. That second method is not a watermark at all, Anthropic says, because "nothing in the file changes."

The company's help article on marking lists where marks apply: the Claude apps, the Claude Platform API, Claude Code, Claude Cowork and Claude Tag. Supported models also carry the text watermark when you reach them through AWS, Google Cloud or Microsoft Foundry. Files can be checked with Anthropic's free Claude Content Checker.

How does a statistical text watermark work?

It replaces a coin flip with a keyed choice. A language model writes one word at a time, and often several words fit almost equally well. Anthropic's example is "cold and…", where "overcast" or "grey" would both do. Normally a random number settles the pick.

With the watermark, however, a process built on a secret key and the few preceding words makes that pick instead. The output still looks random to a reader. But anyone holding the key can check whether a passage keeps agreeing with those keyed choices, and put a probability on Claude's involvement. Anthropic compares it to a game that uses the digits of pi instead of dice rolls: the moves look random, but anyone who knows pi can spot the pattern.

Claude's method is "a version of the SynthID-Text approach" that Google DeepMind described in Nature in October 2024. That paper says SynthID-Text changes only the sampling step and that detection does not need the model itself. A live test on nearly 20 million Gemini responses found no drop in text quality. Anthropic traces the family of methods back to a 2022 proposal by computer scientist Scott Aaronson. A widely cited academic version is the "green list" scheme in A Watermark for Large Language Models (Kirchenbauer et al., 2023).

Anthropic says the Claude watermark costs nothing extra. It adds no tokens, so prices do not change, and its effect on speed is negligible. Anthropic also says it found no impact on quality, creativity or readability.

Which Claude models carry the watermark, and from when?

New models carry it at launch, and four older ones join next. Anthropic's support page says Claude models launched in the EU on or after August 2, 2026 support marking from day one. The Claude Platform docs confirm it for Claude Fable 5.1 and Mythos 5.1, "on every platform where the model is available."

For older models, the EU law grants a transition period, and Anthropic said in August it would add the mark "over the coming months." Its help page has a model table but no date. Today the table shows Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6 with C2PA file credentials only, and no text watermark yet. Opus 4.5, Sonnet 4.5 and Haiku 4.5 are in the same state, and the email, as reported, does not list them. Opus 4.8, released before August 2, already has the watermark everywhere. The rest comes from the customer email, as reported by trade press:

• The mark reaches Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6, and newer models such as Opus 5.5 already carry it.
• Rollout on Amazon Bedrock may take a few extra days.
• It adds "no extra characters or tokens" and does not change request or response formats.
• Customers can't switch it off, The Decoder reports.

Notably, Anthropic applies the mark worldwide, not only in Europe. Its explainer says the company does not yet have "a durable way to scope it by region."

Is there a way around it on the API?

On two models, yes. According to The Decoder, the email says the Claude watermark applies to Opus 4.6 and Sonnet 4.6 only when temperature, top_p and top_k stay at their defaults. It quotes the email's advice: "If you rely on the watermark for your own compliance, keep these settings at their defaults." The email gives no such caveat for Mythos 5 or Opus 4.7.

That fits Anthropic's own docs. Its release notes say that on Claude Opus 4.7, setting any of those three sampling parameters to a non-default value returns an error. On the newest models, too, setting them at all returns an error. So the loophole, as reported, exists only where the knobs still turn.

Why does the EU AI Act require watermarks?

Article 50(2) of the AI Act requires providers of generative AI to put machine-readable marks on their outputs, so those outputs can be detected as AI-made. The marks must be effective, reliable and interoperable. The European Commission's guidance says the rule applies from August 2, 2026. Fines can reach €15 million or 3% of worldwide turnover.

There is a short grace period, and it explains the timing. Systems already on the market before August 2 only have to comply from December 2, 2026. The Decoder reports that Anthropic points to that December deadline as the reason it is marking older models now.

The rule has exceptions, though. For example, a short sequence of numbers, symbols or letters needs no mark, and neither does source code. Tools that only do standard editing are exempt too. Anthropic signed the EU's Code of Practice on Transparency of AI-Generated Content in July 2026. The Commission counted about 190 signatories by July 31, including Google, Meta, Microsoft, Mistral and OpenAI.

How does Claude compare with OpenAI and Google SynthID?

All three shape word choice, but they differ on where the mark is on and who can check it. OpenAI announced its own scheme, textGrain, on October 5, TechCrunch reported. It covers ChatGPT and Codex in the EU only. For developers, it is opt-in on select API models and off by default.

Google's SynthID-Text is open source and ships in Hugging Face Transformers, so any developer can add it to a model. Google's developer docs say it survives "mild paraphrasing" but weakens when text is thoroughly rewritten or translated.

Anthropic's choice is the strictest of the three. Its mark is on by default for every user in every region. API customers reportedly have no off switch, though on Opus 4.6 and Sonnet 4.6 non-default sampling settings skip it.

Who can detect the Claude watermark?

Not the public, for now. Instead, a detection API is in private preview for groups the EU law has in mind. Anthropic lists regulators, law enforcement, media, fact-checkers, independent researchers, educational organisations and EU civil society groups. Enterprises with their own compliance duties under the Act can apply too.

This matters if you use an AI detector. Third-party tools look for stylistic tells and do not have Anthropic's key, the company notes. So a detector score and the Claude watermark measure different things.

What are the limits of text watermarks?

A mark is evidence, not proof, and Anthropic says so plainly. Finding one is "not fully conclusive," because Claude may have only edited or translated someone's text. Equally, a missing mark proves nothing.

The signal is weak in several cases:

• Short texts. Detection needs many word choices, so confidence grows with length.
• Facts and code. Where only one word is right, such as a name or a line of code, there is nothing to steer.
• Light proofreading. If Claude changes only a few words of human text, the mark may be undetectable.
• Rewrites. Anthropic says light editing probably won't remove the watermark, but a complete rewrite will.

Outside research points the same way. In a 2023 study, Krishna and colleagues showed that a paraphrasing model can evade AI-text detectors, watermarks included. OpenAI's own tests, as TechCrunch reported, found that swapping 10% of words for synonyms cut detection from about 92% to 66%.

Meanwhile, privacy is the other common worry. Anthropic says the watermark carries no identifying information and cannot be traced to a person, organisation or chat.

What this means if you write with Claude

We checked Anthropic's pages and the EU guidance; the email details rest on The Decoder's report. Still, the core is clear. If you publish text written with Claude, assume it carries a mark that an approved checker could find. For a few lines or code from Claude Code, the signal will be faint. That does not make AI use a secret, and in the EU it was never meant to be.

C

Claude

49

Assistant focused on long documents and code work

🇺🇸United States·Added 2mo ago

Freemium·from $17/mo·API

88trust score out of 100

C

Claude Code

71

Anthropic's coding agent that reads a repository, edits files and runs commands from the terminal, IDE, desktop app, browser or Slack

🇺🇸United States·Added 2mo ago

Paid·from $17/mo·API

96trust score out of 100

1

C

ChatGPT

49

General assistant with tools, memory, files and voice

🇺🇸United States·Added 2mo ago

Freemium·from $8/mo·API

86trust score out of 100

2

G

Gemini

71

Google assistant wired into Workspace and Android

🇺🇸United States·Added 2mo ago

Freemium·from $4.99/mo·API

94trust score out of 100

If your team must disclose AI use, keep sampling settings at defaults, as the email advises. For drafting tools beyond chat, see our list of AI writing assistants.

What to watch next

Watch three dates and one switch. November 3 is when the older models reportedly get the mark, with Amazon Bedrock a few days behind. December 2 is the EU deadline for systems already on the market. And watch whether Anthropic opens its detection API beyond the private preview, which would decide who can actually check.