Claude's new watermark slips off older models if you touch one sampling setting

Anthropic is stamping an invisible watermark onto text from more of its Claude models, and on several of them developers can make it vanish by changing one number. Matthias Bastian has the details for The Decoder, from emails Anthropic sent its API customers.

What's being marked

Every model Anthropic released after August 2, 2026 carried the watermark from launch. Older ones are being retrofitted in stages, and the EU AI Act, whose deadline arrives in December, is Anthropic's stated reason for the timing.

The first wave, announced October 31, covered four models: Opus 4.7, Sonnet 4.6, Opus 4.6 and Mythos 5. A second email this week added three more from the 4.5 generation, Haiku, Sonnet and Opus, starting November 16. Opus 4.6 was due on November 3; Anthropic confirms it slipped to the 16th and doesn't say why. On Amazon Bedrock, things may run a few days behind.

Because the mark lives in the model itself, it follows Claude to AWS, Google Cloud and Microsoft Foundry, and customers can't switch it off. The method is a variant of Google DeepMind's SynthID for text: it nudges the randomness behind word choice so the output carries a pattern a detector can find statistically. Anthropic says it adds no characters or tokens, leaves pricing and formats alone, barely slows output, and holds nothing about the user or their chats. A detection API is in private preview.

The loophole

The catch is in the sampling settings. On Opus 4.6, Sonnet 4.6 and all four second-wave models, the mark is applied only if you leave temperature, top_p and top_k on their defaults. Nudge any one of them and the mark is gone. Anthropic's own advice: "If you rely on the watermark for your own compliance, keep these settings at their defaults."

The emails don't attach that caveat to Mythos 5 or Opus 4.7, which suggests those two are marked whatever the settings. The gap still matters, because by The Decoder's assessment Opus 4.6 is still the strongest writer Anthropic has, better even than Opus 5.5.

What it means for builders

If your compliance story depends on Claude output being detectable, audit your request code. One tuned temperature in a shared config could quietly put you outside it. And if you planned to detect AI text in submissions, anyone calling the older models can opt out, by accident or on purpose.

Not everyone thinks the mark is free, either. John Gruber argues that picking words by watermark key instead of best fit has to cost some precision. The legal outlet Artificial Lawyer flags another headache: clients who banned AI could spot the mark in a law firm's work, and documents carrying several watermarks may get messy.

For comparison, OpenAI's textGrain, launched in October, is switched on by default only for EU users of ChatGPT and Codex, and ships switched off for API customers.

Scoreboard update: Draw. More Claude text gets labeled as AI, and on older models one setting peels the label off.

Stay undead.