Anthropic Extends Invisible Text Watermarking to Four Older Claude Models Starting November 3, According to Customer Email
Anthropic already applies an invisible watermark to text generated by its recent models to comply with the European AI Act. According to an email sent to API customers and reported by The Decoder, Claude Mythos 5, Opus 4.7, Opus 4.6, and Sonnet 4.6 will follow on November 3. Here is what the watermark does, what it cannot do, and who is allowed to detect it.
Texts written by Claude already carry an invisible signature when produced by recent models. According to an email sent to its API customers and reported on October 31 by The Decoder, Anthropic will expand this watermark to four older models starting November 3, 2026: Claude Mythos 5, Opus 4.7, Opus 4.6, and Sonnet 4.6, with an Amazon Bedrock rollout following a few days later. Anthropic has not published this date on its website, but its help center confirms that it is adding watermarking to models released before August 2, 2026. On X, a widely shared post framed it as Claude preparing to “snitch” on its users; Anthropic’s documentation describes something far more limited.
What the watermark does
The underlying principle, detailed by Anthropic in a page published on August 14, builds on SynthID-Text, the method published by Google DeepMind in 2024. When multiple words fit equally well, the model would normally choose at random; with watermarking, that selection is guided by a secret key and preceding words. The text contains no hidden characters or extra tokens and costs nothing extra, yet anyone holding the key can calculate the statistical probability that Claude contributed to writing it. The marking operates at the model level and therefore everywhere: the API, Claude apps, Claude Code, Claude Cowork, Claude Tag, and via AWS, Google Cloud, and Microsoft Foundry. Generated files (PNG, JPEG, etc.) also receive Content Credentials, which are signed metadata adhering to the C2PA standard.
The driver is regulatory: Anthropic says it signed the EU Code of Practice on transparency for AI-generated content in July, tied to Article 50 of the AI Act, which requires labeling AI-produced text. The developer is applying this worldwide, citing the absence of a reliable method to restrict it solely to European users.
Who can detect it, and what it proves
This is the point that triggered backlash. The detection API is currently in private preview: it is restricted to organizations eligible under European law (regulators, law enforcement, media outlets, fact-checkers, researchers, educational institutions, civil society) and enterprises legally obligated to verify marking. An individual cannot, for now, test their own text; Anthropic says it aims to broaden access. The watermark itself contains no information about the user, their organization, or their conversations, according to the developer: at most, it indicates that Claude likely wrote or substantially reworked a passage.
Anthropic openly lists its limitations. Detection performs poorly on short texts; watermarks appear less frequently in code and factual passages, where word choices are tightly constrained; simple grammatical corrections leave little trace, whereas a translation by Claude is fully marked; and a thorough rewrite erases it entirely. A detected signal cannot distinguish between “Claude wrote this” and “Claude heavily edited this.”
An exception on two models, according to The Decoder
According to the email cited by The Decoder, on Opus 4.6 and Sonnet 4.6 the watermark will reportedly only apply if sampling parameters (temperature, top_p, top_k) remain at their default values; Anthropic reportedly advises customers who rely on the watermark for their own compliance not to alter them. The email allegedly made no mention of this caveat for Mythos 5 and Opus 4.7. These details do not appear on Anthropic’s public pages reviewed on November 1.
Our take
Claude’s watermark is not spyware: it does not record who wrote what or for whom, focusing solely on the specific words selected by the model. However, it changes the landscape for anyone publishing text produced with Claude without disclosure, as journalists, educators, and regulators will increasingly have the tools to verify it. The real imbalance lies elsewhere: users have no way to verify what third parties might soon detect in their own writing. And if the loophole around sampling parameters is confirmed, it reveals the fragility of the entire effort: a watermark that can be disabled simply by tweaking a setting protects the vendor’s compliance far more than it guarantees content traceability.
Sources
- Anthropic — How Claude's text watermark works Primary source
- Claude Help Center — How Claude marks AI-generated content Primary source
- The Decoder — Anthropic's watermark rollout leaves a loophole on two older Claude models (October 31, 2026) Secondary source — Reports the contents of an email sent to API customers.
- X — post by Pete Sena (@petesena), October 30, 2026 Secondary source — Example of the viral framing of the news (“Claude gonna start snitching on Tuesday”).
A primary source comes directly from the company, lab or organization concerned. A secondary source reports the information without being its author: we flag it as such. Spotted an error? See our corrections policy.
