Claude’s New Watermark Has a One-Knob Loophole

Situation report: Anthropic is adding its text watermark to four more Claude models. On two of them, API users can switch it off without meaning to. All it takes is changing one sampling setting.

The Decoder reports that Anthropic emailed API customers to say it will watermark Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6, and Claude Sonnet 4.6. Newer models such as Claude Opus 5.5 already carry the mark. The rollout on Amazon Bedrock may take a few extra days.

The catch sits in the two older models. If you rely on AI labeling for compliance, it matters to you.

🎯 What Anthropic Is Shipping

Anthropic calls the watermark an “imperceptible pattern in word choice.” It says the mark doesn’t change meaning, quality, or readability. Here’s what the company claims:

1. No extra tokens. It adds no characters and doesn’t touch pricing.
2. No format changes. Request and response structures stay the same.
3. Small speed cost. Output is only slightly slower.
4. No user data. The mark “contains no information about the user, their organization, or their conversations with Claude.”
5. Always on. The watermark lives inside the model, so customers can’t turn it off. It follows the model to AWS, Google Cloud, and Microsoft Foundry.

Under the hood, Anthropic uses a variant of Google DeepMind’s SynthID text method. SynthID nudges the randomness behind each word choice. Any single word looks normal. Across a full passage, the choices add up to a pattern that a detector can pick out statistically.

⚠️ The Loophole

On Opus 4.6 and Sonnet 4.6, the watermark only works when three sampling parameters stay at their defaults:

• temperature: how much randomness goes into word selection
• top_p: how much of the probability mass the model samples from
• top_k: how many candidate words the model considers

Change any one of them, even a little, and the mark disappears. Anthropic says so directly: “If you rely on the watermark for your own compliance, keep these settings at their defaults.”

The email doesn’t give that warning for Mythos 5 or Opus 4.7. That suggests the watermark holds on those models whatever the settings.

What stands out is which model has the gap. According to The Decoder, Opus 4.6 is still Anthropic’s best writing model, ahead of even Opus 5.5. The model people most want for polished prose is the one where the watermark is easiest to lose. That won’t help Anthropic’s case that watermarking works.

📅 Why Now: The EU Deadline

Anthropic points to the EU AI Act’s December deadline as the reason. Every model released after Aug. 2, 2026, has carried the watermark from day one. Older models are getting it in stages.

Here’s how the major labs compare:

1. Anthropic: On by default, can’t be turned off, built into the model.
2. OpenAI: Its textGrain system launched in October 2026. It’s only on by default for ChatGPT and Codex users in the EU. API customers worldwide can toggle it, and it ships disabled.
3. Google DeepMind: Open-sourced SynthID for text and built it into Gemini.

Anthropic has the strictest setup of the three. Older models with a settings-based off switch weaken that picture a bit.

🧭 The Pushback

Not everyone agrees that watermarking leaves quality alone. Blogger John Gruber argues that no two synonyms mean exactly the same thing. If a watermark key picks the word instead of the best semantic fit, precision has to suffer at least a little.

Legal trade outlet Artificial Lawyer raises a separate risk for law firms. Some clients have banned AI use, and they could find the mark in documents. Several watermarks stacked in one document could also make things messy.

📋 What To Do

1. Check your sampling settings. If you run Opus 4.6 or Sonnet 4.6 and need the watermark for compliance, keep temperature, top_p, and top_k at their defaults.
2. Write down which models carry the mark. Mythos 5, Opus 4.7, and Opus 5.5 appear to hold it under any settings. Opus 4.6 and Sonnet 4.6 don’t.
3. Watch the detection API. Anthropic has a verification tool in private preview. Once it opens up, anyone will be able to check text for the watermark, including your clients.
4. Plan for December. EU enforcement will set the bar. Expect other providers to tighten their defaults as the deadline gets closer.

The watermark exists now. The open question is whether regulators will accept protection that a single parameter change can switch off. Full details are available at The Decoder.