Anthropic leaves loophole in Claude text watermark, older models lose AI provenance mark when sampling settings change

Anthropic is extending its text watermark to four more Claude models, but on two of them the mark can be switched off with a single settings change. On Claude Opus 4.6 and Claude Sonnet 4.6, the watermark only activates when developers leave the sampling parameters — temperature, top_p and top_k — at their default values, according to The Decoder. Change any one of them slightly, and the watermark disappears.

Anthropic describes the watermark as an "imperceptible pattern in word choice," a variant of Google DeepMind's open-sourced SynthID method, which nudges the model's random word selection into a statistically detectable signature. The company says it adds no characters, does not alter meaning or readability, barely slows output, and carries no information about the user or their conversations. Because it is embedded at the model level, it survives across hosting platforms — Amazon Web Services, Google Cloud, Microsoft Foundry — and customers cannot turn it off. Except, on those two older models, they can.

The timing is not casual. Anthropic is retrofitting older Claude models to meet an EU AI Act deadline; all models released after August 2, 2026 already ship with the watermark enabled. Newer models in the rollout, Claude Mythos 5 and Claude Opus 4.7, apparently carry the mark regardless of settings — the customer email flagged the sampling caveat only for the two legacy models. Anthropic warns customers who rely on the watermark for compliance to keep the defaults, which amounts to telling auditors the seal is valid only if the bearer promises not to tamper with it.

The competitive landscape rewards the laxer player. OpenAI launched its own watermarking system, textGrain, in October — but it switches on by default only for ChatGPT and Codex users inside the EU, and ships disabled for API customers worldwide. Google DeepMind open-sourced SynthID and built it into Gemini. Three vendors, three watermark regimes, and only one regulator forcing the issue.

There is also a practical wrinkle, flagged by the legal trade outlet Artificial Lawyer: documents assembled from multiple AI sources — drafting, editing, summarising — may end up carrying layered watermarks from rival providers, complicating exactly the provenance verification law firms would want them for.

Opus 4.6, the model where the bypass is easiest, is Anthropic's best writing model — ahead of Opus 5.5, per The Decoder. The watermark's strongest guarantee, meanwhile, applies to whichever model the customer bothers to leave untouched.