Which Claude models are getting the watermark?
Anthropic has told API customers that it will add its invisible text watermark to four older Claude models. The models are Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6 and Claude Sonnet 4.6.
The Decoder reported the customer email on 31 October, citing the message sent to developers. The change extends a programme that began with models released on or after 2 August 2026.
An earlier wave covered Claude Fable 5, Claude Sonnet 5 and Claude Opus 4.8. Those three models received the mark from 30 September, according to heise online.
Anthropic's public help page, updated this week, separates text watermarks from Content Credentials in files. For the four models, only the C2PA file column is currently ticked. Text marking is still listed as in progress.
Nine of the 16 Claude models on that page carry first-party text watermarks. The other seven, including the four added this week, currently list only C2PA file credentials.
The Decoder reported that the Amazon Bedrock rollout may take a few extra days. The help page gives no date for the text rollout on those models.
Anthropic applies the mark at the model level rather than in a product layer. It appears in the Claude apps, the API, Claude Code, Claude Cowork and Claude Tag. For supported models, Anthropic says users cannot switch it off, a point heise and The Decoder both report.
heise reports that Anthropic aims to retrofit all affected older models by 2 December. That date ends a transition period for AI systems already sold in the EU before 2 August.
The four additions are older releases rather than new launches. The Decoder describes Opus 4.6 as Anthropic's best writing model, ahead of Opus 5.5. That makes the retrofit matter for customers who have not moved to newer versions.
The help page is Anthropic's live inventory, and it changes as models are retrofitted. The table is a snapshot, not a permanent list. Buyers should check the cloud-partner column again after each rollout.
How does the Claude text watermark work?
Claude generates text one token at a time, choosing among words that could come next. In many places, two or more options fit equally well, and a random number settles the choice.
Watermarking changes the source of that randomness. A secret key and the preceding words help decide which plausible token the model picks. The result is a statistical pattern spread across a passage, not a hidden character.
Anthropic compares the process to moving around a board game with digits of pi instead of a die. The point is that the outcome still looks random to readers. Detection works by testing whether a passage's choices fit the key better than chance.
Anthropic says nothing is added to the text and there are no hidden characters. The mark uses no extra tokens, so pricing and speed stay effectively unchanged. Anthropic also says the mark cannot be traced to a person, organisation or conversation.
A detector holding the key can estimate how likely it is that Claude produced a passage. The more text Claude writes, the stronger the signal becomes. A single sentence is rarely enough, while a long document is easier to classify.
Anthropic credits the SynthID-Text paper, published in Nature in October 2024, for the technique. heise describes the Claude method as Anthropic's own variant of Google DeepMind's SynthID approach.
Because the mark lives in word choices, it travels when text is copied and pasted. Anthropic says it may survive some editing, but heavy rewriting weakens it. The mark is also separate from any visible label that a publisher might add.
Files work differently. Anthropic attaches Content Credentials that follow the C2PA provenance standard. A free Claude Content Checker reads those labels on supported image files.
Text detection is more restricted. Anthropic's detection API is in private preview for regulators, law enforcement, media, fact-checkers, independent researchers, educators and EU civil society groups. Enterprises with their own compliance duties can also apply.
The method is weaker on code and on light proofreading. Anthropic says exact outputs are not nudged, so code carries less watermarking. Lightly edited human drafts leave little space for the mark to attach to.
Why is Anthropic watermarking Claude now?
The EU AI Act's transparency rules apply from 2 August 2026. Article 50 requires providers to mark AI-generated content in a machine-readable way. It also requires deployers to label deepfakes and certain AI-generated publications.
That split matters. Anthropic's watermark is a provider-side mark in the text. A company that publishes Claude output may still have its own duty to add a visible label.
Anthropic signed the Commission's Code of Practice on Transparency of AI-Generated Content in July 2026. The company says around 190 organisations signed the voluntary code. The Commission and the AI Board have assessed the code as an adequate tool for demonstrating compliance.
The code is not law, but regulators treat it as evidence. Signatories can rely on its measures, while non-signatories must show that their own approach is adequate. Morrison Foerster notes that authorities may ask non-signatories for more information.
The code also asks providers to offer free marking-detection tools and to ban tampering in their terms. Anthropic's text detector is a private preview limited to eligible organisations, so the code's free-tool requirement reaches a narrow audience.
Providers that already sold AI systems in the EU before 2 August have until 2 December. That transition period is why older Claude models are being retrofitted now. The financial stakes are real. Article 99 allows fines of up to EUR 15 million or 3% of global turnover, whichever is higher. That applies to breaches of the transparency rules.
Retrofitting is harder than launching with a mark. The watermark sits at the model level, so an older model must be updated rather than wrapped by a product feature.
Anthropic applies the mark worldwide, not only in the EU. It says it lacks "a durable way to scope it by region." Users outside Europe therefore receive marked text too.
The EU rules are not the only pressure. OpenAI and Google have also built text marking, which makes provenance a competitive norm rather than a European compliance chore.
What can a Claude watermark actually prove?
Anthropic is careful about what a positive result means. Its help page calls a detected mark a signal that content may have been processed by Claude. It does not, on its own, confirm the full provenance of the content.
Claude may have proofread, translated or summarised human work. In that case the output can carry a mark even when the ideas and underlying text came from someone else.
The reverse is also true, and Anthropic says so plainly. "Lack of a detected mark doesn't mean the content wasn't AI-generated or processed."
Several ordinary actions can erase the signal. Heavy editing, paraphrasing, translation, short passages and stripped metadata all reduce detectability. A screenshot of a file removes its C2PA metadata.
OpenAI's testing shows how fragile text marks can be. Replacing 10% of words with synonyms cut detection from about 92% to 66%, according to TechCrunch. Short passages, maths answers and translated text are also harder to detect, OpenAI said.
Consider a student essay drafted by hand and lightly edited with Claude. Anthropic says the mark may not be detectable, because most words are the student's. Now consider a translated report: the translation can carry a mark even if the original was human.
Both cases show why a binary AI-or-not verdict is misleading. A detector hit is weak evidence on its own, and a miss is weaker still. A false positive can punish legitimate work, while a false negative can let copied AI text pass as human.
Access is limited to organisations with legal or editorial duties, not the general public. A regulator can apply for access; an individual writer cannot. That restriction reflects the technology's limits as much as any policy choice.
The company's own wording is cautious for a reason. A watermark records that Claude was probably involved, not who is responsible for the final document.
Can the Claude watermark be removed?
The Decoder found a concrete gap in the rollout. On Opus 4.6 and Sonnet 4.6, the mark will apply only when three sampling settings stay at their defaults. Those settings are temperature, top_p and top_k, which control how much randomness the model uses when choosing words.
The Decoder reported that a small change to any one of them is enough to avoid the watermark. Anthropic's public help page does not mention that condition. The customer email reportedly told developers to keep the defaults if they rely on the mark for compliance.
The Decoder notes that the email did not mention the caveat for Mythos 5 or Opus 4.7. That suggests those models mark output regardless of sampling settings.
The sampling caveat is a reminder that watermarks are probabilistic. A developer who changes temperature for creative writing may inadvertently drop the mark. Anthropic's warning to keep defaults shows that compliance and customisation can conflict.
Editing is the simpler route for anyone who wants to remove a mark. Paraphrasing, translation and mixing AI text with human writing all weaken detection. Anthropic's own documentation describes those limits.
Removing a mark is not the same as escaping the law. Deployers still have labelling duties, and contracts may require disclosure. The mark is one signal in a wider compliance stack.
Critics also dispute the quality claim. John Gruber disputes the idea that the mark leaves prose unchanged. He argues it will, in his words, "adulterate and corrupt the semantics" of Claude's writing.
The Decoder also relays a concern from Artificial Lawyer about law firms, where several marks layered in one document could complicate review. Some users objected when the programme started. TechCrunch reported complaints that the mark would expose people who use AI for routine editing at work or school.
Anthropic maintains that readers cannot tell marked text from unmarked text. It also says the mark carries no information about the user or the conversation.
The practical effect is that detection is a signal to be weighed, not a switch to be trusted.
How does Claude compare with OpenAI and Google?
OpenAI announced its text watermark, called textGrain, on 5 October. It applies to eligible ChatGPT and Codex text generated in the EU and rolls out over the coming weeks.
OpenAI's API version is opt-in and off by default. Developers anywhere can enable it for select models, but it is not a global default. OpenAI limits its detector to approved researchers and expert organisations. It says that restriction reflects uncertainty about reliability and responsible use.
The company published a technical report with researchers from the University of Pennsylvania and Yale. It describes using a secret key to sort next-word predictions, then adding hundreds of nudges until a detector can spot the pattern.
That is close to Anthropic's description, which is unsurprising given the shared research lineage. The difference is governance, not just mathematics. OpenAI restricts detection to approved researchers; Anthropic restricts it to obligated organisations.
Google DeepMind's SynthID-Text is the other reference point. The technique was published in Nature in October 2024, and a reference implementation is on GitHub. Google's SynthID programme covers several media types, including text and video.
The rollouts differ in scope. Anthropic marks output worldwide, while OpenAI starts in the EU. Anthropic's detector is broader in eligibility but still private. Neither company offers a public checker for arbitrary text.
There is no single public tool that reads every provider's mark. Each scheme uses its own key and detector, so verification is fragmented. A publisher that wants to check a document may need access to several systems, or none at all.
The EU code asks each provider to offer free detection tools. That leaves platforms to negotiate access separately with each model maker. Fragmentation is likely to persist while the code remains voluntary.
What should teams watch next?
The first test is 2 December. Anthropic must finish retrofitting older models by then. The help page must also show text marks, not just file credentials, for the four added this week. Cloud partners must follow once the text rollout reaches them.
Watch the detection API. Broader access would let more newsrooms, universities and compliance teams test text. It would also invite scrutiny of error rates and false positives.
Watch enforcement. National market surveillance authorities can ask providers for evidence of compliance. The Code of Practice gives them a benchmark for those requests.
Watch the research on robustness. If a 10% synonym swap can cut detection by 26 percentage points, determined rewriting will defeat most text marks. Layered marks are another open question, because a document that passes through several AI tools may carry several signals, or none.
For teams that rely on the mark, the practical steps are simple. Keep sampling defaults where compliance depends on watermarking, and document where AI was used. Keep records of human editing, not just the final text.
Do not treat a detector result as proof. Anthropic's own guidance calls the mark a signal about possible involvement, not a verdict on authorship.
The larger question is whether marking builds trust or merely creates the appearance of it. Watermarks make AI text easier to spot in bulk, but they cannot settle who wrote what.