Anthropic begins watermarking text from three Claude models

The latest:

Text produced by three Claude models now ships with an invisible watermark, Anthropic said in its November 3, 2026 developer platform release notes. The marking covers Claude Mythos 5, Opus 4.7 and Sonnet 4.6. Anthropic said the watermark changes neither the meaning, quality nor readability of outputs, adds no tokens or hidden characters, and carries no information about the user.

Details:

• The exception: On Sonnet 4.6, output may not carry the watermark if a request sets temperature, top_p or top_k to a non-default value. Anthropic advises anyone relying on the mark to remove all three parameters, including values set automatically by frameworks or client libraries.
• Where it applies: The Claude developer platform (API), Claude, Claude Code, Claude Cowork and Claude Tag carry the mark globally, according to Anthropic, alongside text generated on AWS, Google Cloud and Microsoft Foundry. Rollout on Bedrock completes for some models by November 10.
• The regulatory driver: Anthropic said it signed the code of practice under Article 50(2) of the EU AI Act on transparency for generated content. New models launched in the European Union on or after August 2, 2026 support marking at launch, while older models sit in a transition period during which the company adds the watermark.
• Files versus text: Generated files such as PNG and JPEG carry content credentials under the C2PA standard, a separate mechanism from the text watermark. Models listed without a text mark — Opus 4.6, Opus 4.5, Sonnet 4.5 and Haiku 4.5 — still attach C2PA credentials to files.
• Detection access: The free Claude Content Checker verifies file credentials. Text-watermark detection is in a private preview limited to eligible institutions: regulators, law enforcement, media, fact-checkers, independent researchers, educational institutions, European civil society groups and companies verifying their own outputs.
• The limits: Anthropic said a detected watermark makes it likely Claude processed the content but is not conclusive, since the model may only have edited, translated or summarized it. Absence proves nothing either, citing older models, heavy editing or rewriting, and very short passages.
• How it works: In an August 14, 2026 post, Anthropic described replacing the random number that normally breaks ties between closely ranked candidate words with a secret key combined with preceding words. The company identified the method as a version of SynthID-Text, published by Google DeepMind in a 2024 paper.
• Weak spots: Light editing probably does not remove the mark, while a full rewrite does, according to Anthropic. Factual text and code carry a weaker signal, since both leave fewer interchangeable word choices for the mechanism to encode.
• Not yet set: Anthropic said it intends to widen access to the detection interface and publish further technical guidance, without naming a date, a cap on eligible organizations, or the criteria that decide which applicants qualify.

Background:

Article 50(2) of the EU AI Act requires providers to mark machine-generated content in a detectable form. Its code of practice is the voluntary instrument signatories use to show compliance ahead of enforcement.

Between the lines:

The marking’s usefulness runs in one direction only. Because detection sits behind a private preview for approved institutions, and because the signal weakens on factual text, code and short passages, a newsroom or school can act on a positive hit but cannot treat a clean result as a clearance. The Sonnet 4.6 parameter exception adds a further gap: a routine framework default can silently strip the mark.

What’s next

Watch the November 10 completion of the Bedrock rollout, Anthropic’s promised expansion of detection access and additional technical guidance, and whether EU regulators treat the transition period for older models as compliant.