Anthropic adds watermarks to older Claude models but leaves an API loophole
Anthropic is watermarking older Claude models for EU compliance, but developers can bypass it by tweaking a single API setting.
Models · Source: The Decoder
What happened
Anthropic is expanding its invisible text watermark to four older Claude models. The rollout takes effect on November 3, 2026. It covers Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6, and Claude Sonnet 4.6. Newer models like Claude Opus 5.5 already include this tracking feature. Anthropic says older models launched before August 2, 2026, are being brought into line over the coming months to meet the December deadline for the EU AI Act. The rollout on Amazon Bedrock will take a few extra days.
The watermark uses a variant of Google DeepMind's SynthID-Text to embed a hidden pattern in the model's word choices. Anthropic claims this does not change the text quality, cost, or output speed. It adds no extra characters or tokens to the response. The company also states the watermark contains no information that could trace text back to a specific user or organization. However, there is a massive loophole for API users on Opus 4.6 and Sonnet 4.6.
On those two models, the watermark only works if developers leave sampling parameters at their default values. Changing the temperature, top_p, or top_k settings instantly disables the tracking because those parameters control the randomness the model uses to pick words. Anthropic explicitly warned API customers to keep defaults if they rely on the watermark for compliance. The email did not mention this caveat for Mythos 5 or Opus 4.7, suggesting the watermark applies to those models regardless of settings.
Key facts
- November 3, 2026 — Rollout date for the expanded text watermark
- August 2, 2026 — Cutoff date after which all new models launched with watermarks
- SynthID-Text — Google DeepMind method used for the watermark
- Opus 4.6 — Anthropic's best writing model, which contains the API loophole
Why it matters
Builders relying on Anthropic's watermarks for EU AI Act compliance now face a fragile technical dependency. If you adjust the temperature to make Claude Opus 4.6 more creative for a marketing tool, you instantly lose your compliance safeguard. You have to choose between model performance tuning and regulatory safety. This is especially critical because Opus 4.6 remains Anthropic's best writing model, beating even the newer Opus 5.5.
This exposes the limits of current watermarking technology. Because the watermark relies on manipulating randomness with a secret digital key, overriding that randomness breaks the entire system. As regulators demand stricter AI tracking, providers will be forced to either lock down API parameters entirely or build new detection methods that survive parameter tuning. Furthermore, a positive detection only proves Claude was involved, not whether it wrote or just edited the text.
For builders
Compliance risk on tweaked models
If you change temperature or top_p on Opus 4.6 or Sonnet 4.6, you lose the watermark. Builders who need EU AI Act compliance will pay the price in regulatory fines if they forget to lock these settings to default.
No public verification tools
You cannot verify the watermark yourself. Anthropic restricts its detection API to a private preview for regulators, media, and researchers, meaning founders cannot build automated checks for their own platforms.
Model quality debates will escalate
Anthropic claims watermarking does not hurt text quality, but critics argue forcing word choices degrades precision. Builders using Mythos 5 or Opus 4.7 cannot disable the watermark, meaning they absorb any potential quality drop without a choice.
My take
I find it hilarious that a major AI safety feature can be defeated by changing the temperature setting by a fraction of a point. Anthropic is checking a regulatory box for the EU AI Act, but this implementation is practically useless for real-world API developers. If safety depends on nobody touching the default settings, you do not have a safety feature.
Original reporting: The Decoder. This is my rewrite and opinion.