Claude now invisibly watermarks your text on older models too

What's happening

When you write with Claude, the text you get back has its origin built in, and that now applies to older models too. Every Claude model released since August 2, 2026 carries an invisible watermark. Now Anthropic is retrofitting the earlier models. According to an email to API customers reported by The Decoder, Claude Mythos 5, Opus 4.7 and Sonnet 4.6 have been marking their responses since November 3. The model table on Anthropic's help page already lists all three as watermarked.

Opus 4.6 was also supposed to switch over on November 3. Anthropic pushed it back to November 16 without saying why. Opus 4.5, Sonnet 4.5 and Haiku 4.5 join on the same day. None of those three were in the original announcement. On Amazon Bedrock, the switch takes a few days longer.

The EU AI Act is behind it

The trigger is the EU AI Act, Europe's AI regulation. Anthropic has signed the code of practice for Article 50, which requires machine-readable labels on AI-generated content. According to The Decoder, the company says it's retrofitting older models because of a December deadline.

The watermark isn't limited to the EU, though. It applies worldwide and in every product: the Claude app, Claude Code, Cowork and the API. Because the watermark is generated inside the model itself, The Decoder reports that it's also present in text produced through Amazon Web Services, Google Cloud or Microsoft Foundry. Customers can't turn it off.

A blogger on note.com points out a detail on the official help page: for the older models, the table only lists Claude's own services. The columns for cloud partners like AWS and Google Cloud, and for C2PA provenance data, are blank. So it isn't entirely clear whether the watermark applies to these models on partner platforms.

How the watermark works

Technically, Claude shifts its word choice very slightly. A language model picks each next word from several suitable candidates, with some randomness involved. The watermark nudges that choice using a secret key. The result is a statistical pattern you won't notice when reading, but detection software can pick it up. According to The Decoder, Anthropic uses a modified version of SynthID, a technique from Google DeepMind that Google has open-sourced for text and built into its Gemini models.

Anthropic describes the watermark as an "imperceptible pattern in word choice" that doesn't change meaning, quality or readability. It says the watermark adds no extra characters or tokens, doesn't change pricing or the format of requests and responses, and barely slows down output. On privacy, the email says:

"The watermark contains no information about the user, their organization, or their conversations with Claude."

The pattern travels with the text when you copy it, and according to the help page it can survive some editing. Heavily rewritten, translated or very short passages, on the other hand, often no longer carry a detectable signal. Worth knowing: even if you only use Claude to proofread or translate, the text you get back is watermarked. Anthropic says a match doesn't prove authorship, though. It only shows that Claude processed the text.

Who can check for the watermark

Hardly anyone. Detection runs as a closed preview through a detection API. Access is by application for government agencies, law enforcement, media, fact-checkers, researchers, educational institutions and companies with their own obligations under the law. So regular users can't check whether their own text is watermarked.

Files are a different story. For PNG and JPEG images, Claude also attaches Content Credentials based on the C2PA standard. That's provenance information stored in the file's metadata. Anyone can read it with the free Claude Content Checker.

The loophole for developers

Several models come with a significant limitation. According to Anthropic, on Sonnet 4.6 and Opus 4.6 the watermark only works when the three sampling parameters temperature, top_p and top_k are at their default values. These settings control how much randomness the model allows when choosing words. According to The Decoder, the same limitation applies to all four second-wave models: Opus 4.6, Opus 4.5, Sonnet 4.5 and Haiku 4.5. The email doesn't mention this limitation for Mythos 5 and Opus 4.7, so the watermark there probably works regardless of the settings.

That means if you tweak even one of these values slightly through the API, you get text that won't be reliably detected. Anthropic itself warns that anyone relying on the watermark for their own compliance should keep the defaults. In the Claude app, you can't change these parameters anyway. The Decoder calls the loophole notable because, in its view, Opus 4.6 is still Anthropic's best model for writing, ahead of Opus 5.5.

What it means for users in practice

A developer on the blogging platform note.com counted what this looks like in practice. He analyzed 30 days of his Claude Code session logs: 1,055 sessions. Newly affected were 219 sessions with Haiku 4.5 and one with Sonnet 4.5. The Haiku sessions were pure checking jobs that produce no external output. His biggest surprise: the --model haiku flag still pointed to the old Haiku 4.5 rather than the newer Haiku 5.5. His advice: the number of sessions doesn't matter, what goes out the door does. If you use older models to write text for clients or submissions, think ahead about how you'll disclose your AI use. By the way, he couldn't find the November 3 start date on the help page itself. It comes from the customer email and reports on Reddit.

OpenAI takes a different approach

In October 2026, OpenAI launched its own text watermark called textGrain. According to The Decoder, it's only on by default for ChatGPT and Codex users in the EU. API customers worldwide can switch it on or off themselves, and it's off by default. With a global watermark you can't turn off, Anthropic goes considerably further.

Our take

By retrofitting older models, Anthropic closes the gap that left them unwatermarked. For most app users, little changes day to day. They won't notice the watermark and can't check for it either. It matters mainly if you pass on Claude-generated text professionally.

There's criticism all the same. Blogger John Gruber argues that no two synonyms mean exactly the same thing, so if you choose words based on a watermark key instead of the best fit, you inevitably lose precision. The legal trade publication Artificial Lawyer sees problems for law firms: clients who have banned AI use could detect the watermark, and multiple overlapping watermarks in one document could cause complications.

How robust the system is remains an open question. Translation, heavy rewriting and, on many models, even a changed temperature setting can defeat the watermark. That makes it useful for EU AI Act compliance only as long as nobody deliberately tries to get around it. And so far there's no independent evaluation of its detection rate.