Anthropic adds Claude watermarks, but two models have a bypass

How the watermark works

Anthropic describes the watermark as an imperceptible pattern in word choice. It adds no characters or tokens, does not change meaning, quality or readability, and has little effect on generation speed. The company says it does not encode information about the user, their organization or their conversation with Claude.

The mark is being added to Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6 and Claude Sonnet 4.6. Newer models, including Claude Opus 5.5, already use it. Deployment on Amazon Bedrock may take a few more days.

For Opus 4.6 and Sonnet 4.6, the watermark is active only when developers leave temperature, top_p and top_k unchanged. Altering any one of them is enough to bypass it. Anthropic told API customers to keep the defaults if their compliance depends on the watermark.

The notice does not give the same caveat for Mythos 5 or Opus 4.7, suggesting the watermark may persist across generation settings on those models. Anthropic is testing a detection API in a closed preview.

A compliance feature with a default-setting caveat

Anthropic says it is adding watermarks to older models ahead of the EU AI Act deadline in December. Models released after August 2, 2026, launched with watermarks; earlier models are receiving them in stages. Because the mark is built into the model, it applies wherever the model is available, including Amazon Web Services, Google Cloud and Microsoft Foundry. Customers cannot turn it off.

The method is a version of Google DeepMind’s text SynthID: it adjusts randomness in word selection to create a statistically detectable pattern. Google DeepMind has open-sourced text SynthID and integrated it into Gemini.

OpenAI launched its own text watermarking system, textGrain, in October 2026. It is enabled by default only for ChatGPT and Codex users in the EU. API customers worldwide can switch it on or off, and it starts disabled.

The systems differ not just in how they mark text, but in who controls the mark. Anthropic’s is built into the model; OpenAI’s API customers can choose whether to use textGrain.

What the mark can and cannot prove

Opus 4.6 is still Anthropic’s strongest model for writing, ahead even of Opus 5.5. That makes the bypass detail more than a footnote: the older model most relevant to writing is also one where changing a generation parameter can remove the watermark.

I think the harder question is whether a detectable pattern can be treated as evidence about how a document was made. Blogger John Gruber argues that synonyms are never perfectly interchangeable, so choosing words partly to satisfy a watermark key must compromise precision. Artificial Lawyer points to another concern: law firms may find watermarks in documents from clients who prohibited AI use, and multiple marks in one document could create further complications.

The watermark may help identify text generated under particular conditions, but the settings caveat and disputes over text quality leave a gap between detecting a mark and establishing what it means.