Claude's text watermark has a loophole on two older models: change the sampling settings and it disappears

Anthropic is putting a statistical watermark into the text its models write, and for two older models the mark can be switched off by changing a sampling setting. The detail comes from a customer email reported by The Decoder on October 31, 2026. It sits inside a broader compliance effort that Anthropic has documented itself.

What Anthropic says it is doing

Anthropic's support page says the company has signed the EU AI Act's Article 50(2) Code of Practice on Transparency of AI-Generated Content, as a provider of both models and systems. Article 50(2) requires providers of AI systems that generate synthetic audio, image, video or text to mark outputs "in a machine-readable format and detectable as artificially generated or manipulated." The rule is published as applying from August 2, 2026, and it asks for solutions that are "effective, interoperable, robust and reliable as far as this is technically feasible," with exemptions for systems that only assist with standard editing.

Claude uses two methods. Text watermarks are embedded at the model level, so they apply regardless of the product used. Files get C2PA Content Credentials, signed provenance metadata, where Claude can generate files such as PNG or JPEG images. Text watermarks apply on Amazon Web Services, Google Cloud and Microsoft Foundry as well as Anthropic's own surfaces.

Models launched in the EU on or after August 2, 2026 are meant to support marking from day one. Older models are on a transition. Anthropic says it is adding watermarks to outputs from models released before that date.

The loophole

The Decoder reports that Anthropic told API customers it will watermark Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6, while Opus 5.5 already carries the mark. For Opus 4.6 and Sonnet 4.6, the report says the watermark applies only if temperature, top_p and top_k stay at their defaults. Changing any one of them avoids it.

The email as quoted says: "If you rely on the watermark for your own compliance, keep these settings at their defaults." The Decoder notes that this caveat is not stated for Mythos 5 or Opus 4.7, which it reads as meaning those models are marked regardless of settings. We have not seen the email, so treat the settings detail as reported, not confirmed.

Anthropic's public support page lists first-party text marking for a wider set of older models, including Opus 4.5 and Sonnet 4.5. It does not describe the sampling-settings condition in the portion we read. The page is also explicit that cloud partner coverage is clearer for newer models than older ones.

How a text watermark works, and why settings matter

The Decoder says Anthropic uses a variant of Google DeepMind's SynthID text method. The idea is to nudge the randomness behind each word choice so that the finished text carries a statistical pattern a detector can test for. Nothing is added to the text, and no extra tokens are used.

That explains the loophole. If the mark is built into how the model samples its next word, then changing the sampling parameters changes the process the mark depends on. A developer who sets a different temperature is, in effect, running a different sampler. It is plausible that older models implement the mark only under default sampling, which is what the email appears to say.

What the mark cannot tell you

Anthropic is candid about limits. A detected mark is a signal, not proof of provenance, since Claude may only have proofread, translated or summarized the content. A missing mark does not prove a human wrote it: marks may be absent if the text came from a model before marking support, was heavily edited or translated, was very short, or had its metadata stripped.

Detection itself is limited. Anyone can check files for a Claude Content Credential with the free Claude Content Checker. Watermark detection, though, is in private preview for eligible organizations such as regulators, law enforcement, media, fact-checkers, researchers, educators and EU civil society groups. The general public cannot test a paragraph.

Critics quoted by The Decoder raise two concerns. One is that picking words by watermark key rather than best fit can reduce precision. The other, from Artificial Lawyer, is that clients who ban AI use could detect the mark in documents from law firms, and that multiple watermarks in one document could create complications.

The competitive picture

The Decoder says OpenAI launched its own system, textGrain, in October 2026, on by default only for ChatGPT and Codex users in the EU, with API customers able to toggle it and a default of off. It adds that Google DeepMind open-sourced SynthID text and built it into Gemini. Compare that with Anthropic's setting: always on, with no customer opt-out, according to the same report. See our EU AI Act deadlines tracker for the dates that drive all three approaches.

What developers should check today

Three practical steps follow from the sources. First, list which Claude models your product calls and compare them with the support page's model table. Second, find out whether your code overrides temperature, top_p or top_k anywhere, including through frameworks that set them for you. Third, decide what you will do if a downstream reader finds no watermark: Anthropic's own guidance says that proves nothing, so build any process on that assumption rather than on the mark.

Our take

Watermarking is a compliance tool and it should be judged as one. On that test Anthropic's rollout is serious: documented, model-level, with file credentials and a detection program. The sampling loophole shows the weak point of any text watermark, which is that a user who controls generation settings can often weaken it.

If you run Claude in a regulated setting, do three things: read Anthropic's page, pin sampling defaults where you depend on the mark, and do not treat an absent mark as evidence of anything. We would watch for Anthropic's promised technical guidance and for whether the EU's code of practice signatories converge on one detection method.