Anthropic's Claude watermark has a one-parameter loophole on two models

Anthropic is expanding its text watermark to four more Claude models, and on two of them developers can defeat the mark by changing a single sampling parameter. That loophole sits at the center of the company's push to meet the EU AI Act's December deadline, and it involves the model Anthropic itself still ranks as its best writer.

The company announced the change in an email to API customers. The watermark will now cover Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6, and Claude Sonnet 4.6. Newer models, including Claude Opus 5.5, already carry the mark. Anthropic noted that the rollout on Amazon Bedrock may take a few extra days to complete.

What does the watermark actually do?

Anthropic describes the watermark as an "imperceptible pattern in word choice" that doesn't change a text's meaning, quality, or readability. The company's claims are specific and, on their face, narrowly scoped.

• It adds no extra characters or tokens.
• It doesn't affect pricing.
• It doesn't change request or response formats.
• It barely slows output speed.
• It "contains no information about the user, their organization, or their conversations with Claude," according to Anthropic.

The last point matters for enterprises worried that watermarking could double as covert tracking. Anthropic is explicitly telling customers the mark is not a fingerprint of who made the request.

Under the hood, the system is a variant of Google DeepMind's SynthID text method. SynthID works by tweaking the randomness behind word selection so the output carries a statistically detectable pattern. Google DeepMind open-sourced SynthID for text and built it into the Gemini models. Anthropic's variant applies the same core idea to the Claude family.

Why can users dodge the watermark on two models?

The gap sits in the sampling settings. On Claude Opus 4.6 and Claude Sonnet 4.6, Anthropic says the watermark only kicks in when developers leave three sampling parameters — temperature, top_p, and top_k — at their default values. These parameters control how much randomness the model uses when picking its next word. A minor tweak to any one of the three is enough to dodge the mark entirely.

Anthropic flags this directly in its customer email: "If you rely on the watermark for your own compliance, keep these settings at their defaults."

The email doesn't attach that caveat to Claude Mythos 5 or Claude Opus 4.7. That silence suggests the watermark on those two models applies regardless of sampling settings. Anthropic hasn't spelled out the technical difference, but the practical split is clear: newer and mid-generation models get a robust mark, while the two older ones get a conditional one.

The loophole is notable for a competitive reason. Opus 4.6 remains Anthropic's best writing model, ahead of even Opus 5.5 in the company's own framing. That means the Claude model most likely to produce polished prose is also one of the two where the watermark can be switched off by accident — or on purpose — with a one-line config change.

For developers building detection-based compliance workflows, the risk is straightforward. A team that assumes all Claude output carries the watermark could see false negatives whenever a pipeline tunes temperature for creative variety or tunes top_p for tighter output. Anthropic's warning amounts to an acknowledgment that its mark is not universal across its catalog.

How does this connect to the EU AI Act?

Anthropic points to the EU AI Act's December deadline as the reason it is watermarking older models now. The regulation creates the compliance pressure; the watermark is the company's answer to transparency requirements for AI-generated text.

The rollout follows a clear generational divide. Every model released after Aug. 2, 2026, shipped with the watermark on day one. Older models are getting it in stages, which is what this week's expansion to four more models represents.

There's a second structural point in Anthropic's favor. Because the watermark is embedded at the model level, it works on every platform that hosts these models — Amazon Web Services, Google Cloud, and Microsoft Foundry included. Customers can't turn it off. That stands in contrast to opt-in schemes, where the mark depends on the goodwill of whoever holds the API keys.

Anthropic also has a detection API in private preview for verifying the watermark, and it publishes more details on its content labeling information page. The detection piece is the other half of the equation: a watermark only has value if someone can reliably check for it.

How does this compare to OpenAI and Google?

Anthropic is not alone in retrofitting watermarking, but its approach is the most aggressive of the three major players.

• OpenAI launched its own system, textGrain, in October 2026. It only activates by default for ChatGPT and Codex users in the EU. API customers worldwide can flip it on or off, and it ships disabled.
• Google DeepMind open-sourced SynthID for text and built it into the Gemini models.
• Anthropic embeds the watermark at the model level across platforms, with no customer opt-out — with the partial exception of the two older models at non-default settings.

The contrast with OpenAI is sharp. OpenAI's textGrain defaults off outside the EU and gives API customers full control. Anthropic's mark defaults on everywhere, on every hosting platform, and can't be disabled. The Opus 4.6 and Sonnet 4.6 sampling caveat is the one seam in that policy — and it's a seam that exists only because of how those older models were built.

Does watermarking really leave quality untouched?

Whether watermarking truly leaves text quality untouched is disputed, and the disagreement comes from more than one direction.

Blogger John Gruber argues the premise is flawed at its root: no two synonyms mean exactly the same thing. If the model picks words by a watermark key instead of semantic fit, precision inevitably degrades — even if the damage is subtle. On this view, "imperceptible" and "harmless" are not the same claim.

The legal trade outlet Artificial Lawyer raises a separate concern aimed at law firms. Clients who've banned AI use could discover the mark in work product and draw their own conclusions. And multiple watermarks layered inside one document — say, one firm's Claude-drafted section inside another provider's output — could create complications for attribution and review.

Both critiques target the same weak point: a watermark is only as trustworthy as the claim that word choice is semantically neutral. Anthropic asserts that neutrality. Its critics argue the assertion is doing all the work.

What happens next?

The December EU AI Act deadline now drives the calendar. Anthropic is staging older models into compliance, Bedrock catches up in a few days, and the detection API sits in private preview — three moving pieces that determine whether the watermark becomes a real compliance tool or a box checked on paper. The Opus 4.6 loophole, sitting on the company's best writing model, is the detail compliance teams will watch most closely.