Claude Text Watermark Loophole: Change One Sampling Setting on Opus 4.6 or Sonnet 4.6 and the Mark May Vanish

Anthropic's own help center now says that Claude Opus 4.6 and Sonnet 4.6 may not carry the text watermark when temperature, top_p or top_k is set to a non-default value. The Decoder reported the loophole on November 4, 2026, and Anthropic's Claude Help Center page on how Claude marks AI-generated content confirms it in plain words. Four more older models get marks starting November 16. If you build with Claude and rely on the mark for EU compliance, keep the sampling settings at their defaults.

This is a follow-up to our earlier coverage of Anthropic's invisible watermarks and C2PA rollout. That post covered the launch. This one covers the retrofit to older models and the first public weakness in it.

TL;DR: what is confirmed

What exactly did Anthropic announce?

Anthropic emailed API customers about the rollout. According to The Decoder, the mail describes the watermark as an "imperceptible pattern in word choice." It adds no extra characters or tokens, does not change pricing or request and response formats, and barely slows output. Anthropic also says the mark "contains no information about the user, their organization, or their conversations with Claude."

The first wave landed around October 31 and November 3. The Decoder lists Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6. The second wave, per the same report, covers Opus 4.6, Opus 4.5, Sonnet 4.5 and Haiku 4.5 from November 16. Opus 4.6 was originally due November 3 and was delayed. Anthropic gave no reason in the material The Decoder quotes, so treat any explanation as speculation.

Newer models already carry the mark. The help center table lists Fable 5.1, Fable 5, Mythos 5.1, Opus 5.5, Opus 5, Opus 4.8, Sonnet 5.5, Sonnet 5 and Haiku 5.5 as supported on first-party surfaces. That follows from Anthropic's rule that models launched on or after August 2, 2026 mark output from day one.

The loophole in plain language

Anthropic uses a variant of Google DeepMind's SynthID-style text watermarking, according to The Decoder. The idea: when a model picks the next word, it samples from a probability distribution. A watermark nudges that sampling with a secret key, so the chosen words carry a statistical pattern. A detector that knows the key can test for the pattern. For a deeper walkthrough, read our explainer on how AI text watermarking works.

That design depends on the sampler behaving as the watermark expects. On Opus 4.6 and Sonnet 4.6, Anthropic's help center footnote says outputs "may not reliably carry the text watermark when temperature, top_p, or top_k is set to a non-default value." The limitations section repeats it: content from those two models with a non-default setting may not carry a detectable mark.

So the bypass is not a hack. It is a documented condition. Any API user who sets temperature: 0.2 for a deterministic extraction job, for example, may already be producing unmarked text without knowing it. The Decoder's headline calls it easy to bypass, and that fits: no tooling is needed, only a parameter.

Two details are still unclear from public material:

• The Decoder says Anthropic's email did not repeat the caveat for Mythos 5 or Opus 4.7. The help center table shows a plain check for those, with an asterisk only for the Bedrock rollout timing. Whether they hold the mark at any sampling setting is not stated.
• The Decoder says the restriction applies to all four second-wave models. The help center footnotes we read name only Opus 4.6 and Sonnet 4.6 explicitly. Check the current page before you rely on either reading.

Why is Anthropic doing this now?

A rulebook topped by a ring of stars, standing for the EU AI Act duties behind the Claude text watermark rollout

The EU AI Act's Article 50 sets transparency duties for providers of generative AI. Anthropic says it signed the Article 50(2) Code of Practice on Transparency of AI-Generated Content. The help center explains the transition: new models mark from launch, and "the law includes a transition period for AI systems launched before August 2, 2026." The Decoder ties the retrofit to a December deadline.

We explain the legal timeline in our guide to what changes after EU AI Act enforcement, and the umbrella view in the AI regulation and EU AI Act policy guide. A related wrinkle: a translation error in one language version of the Act raised questions about a compute threshold, covered in Article 51(2) and the "per second" mistranslation.

The point for Anthropic is regulatory cover, not forensic certainty. A watermark that works on default settings of older models still shows effort to comply. A watermark that a parameter change defeats is a weaker tool for catching misuse, but the Code of Practice does not demand perfection.

How does this compare with OpenAI and Meta?

The Decoder notes that OpenAI launched its own system, textGrain, in October 2026. It is on by default only for ChatGPT and Codex users in the EU, while API customers worldwide can switch it on or off, and it ships disabled. We covered it in OpenAI textGrain: the opt-in text watermark.

Meta published research on a different approach, described in our post on Meta TextSeal2, a distortion-free LLM watermark. Distortion-free designs try to keep the output distribution intact. That is the direction that could, in theory, survive different sampling settings. We have not tested whether TextSeal2 does, so take that as a research direction rather than a result.

What do critics say?

The Decoder reports two critiques. Blogger John Gruber argues that synonyms never mean exactly the same thing, so choosing words by a watermark key rather than meaning can reduce precision. Our own coverage of that debate is in Gruber on Anthropic's watermark. Artificial Lawyer warns that law firms could run into trouble if clients who banned AI use detect the mark, and that layered watermarks may create complications.

Anthropic's help center answers part of this. It says the mark does not change meaning, quality or readability, and it admits the mark is "not fully conclusive." Claude might only have proofread or translated text that someone else wrote, and the output can still carry a mark.

What builders should do

1. Audit your sampling settings. Search your code and configs for temperature, top_p and top_k on any Opus 4.6 or Sonnet 4.6 calls. If a legal or compliance team assumes outputs are marked, a non-default value breaks that assumption.
2. Decide whether you need the mark. If you must label AI text, do not depend only on a model-level watermark. Add visible disclosure or your own metadata. Anthropic itself tells deployers to "independently assess what Article 50 requires" of their products.
3. Do not use the loophole to hide AI use. Evading marks may breach customer contracts, school rules or, in some settings, the law. Our guide to whether removing AI watermarks is illegal covers the legal angle, and the right and wrong ways to remove AI watermarks covers practice.
4. Plan for model migration. Newer models carry the mark with no sampling caveat in the help center table. If marking matters, moving off Opus 4.6 or Sonnet 4.6 removes the caveat.
5. Test detection once you can. Apply to the detection preview if you are eligible. For files, the free Claude Content Checker reads C2PA credentials; our walkthrough is how to detect a Claude watermark and verify C2PA.

If your agents act on generated text, pair provenance with action controls. AgentBeam, built by the explainx.ai team, is an agent security platform that stops AI agents before they take dangerous actions. A watermark labels output after the fact. It does not stop an agent from doing something harmful.

Who is affected most?

Developers who tune sampling are the obvious group: extraction pipelines, classification, code generation at low temperature, and creative tools at high temperature. Enterprises that bought Claude through AWS, Google Cloud or Microsoft Foundry are also in scope, because the help center says the mark applies on those platforms. Note the asterisk: Bedrock rollout for Mythos 5, Opus 4.7 and Sonnet 4.6 completes by November 10.

Students and teachers face a different problem. A mark that appears only at default settings and fails after paraphrase cannot prove authorship. Our posts on watermarking for students and teachers and for developers go through the practical limits.

Anthropic's help center lists when an absent mark proves nothing: older unsupported models, heavy editing, paraphrase or translation, very short passages, stripped file metadata, and the Opus 4.6 and Sonnet 4.6 sampling case. That list matters more than the headline. Anyone using detection results against a person should read it first.

What is still open

• Why Opus 4.6 slipped from November 3, and whether the November 16 date holds.
• Whether Anthropic will fix the sampling dependency or only document it.
• Whether Mythos 5 and Opus 4.7 behave the same under non-default sampling.
• When detection opens beyond the private preview, and what its false-positive rate is. Anthropic has published no accuracy number in the pages we read.

We will update this post if Anthropic changes the help center page or the dates move.

Related reading

• Anthropic Claude invisible watermarks and C2PA (August 2026)
• How AI text watermarking works
• OpenAI textGrain text watermark
• Meta TextSeal2 distortion-free watermark
• Detect a Claude watermark and verify C2PA
• What changes after EU AI Act enforcement

Details reflect Anthropic's help center and press reporting as of November 4, 2026. Model lists and dates may change.