Anthropic expands invisible watermarks to older Claude models

Expanding the provenance system

Anthropic has announced that it will begin applying invisible text watermarks to its older Claude models starting November 3. This expansion follows a policy first introduced in August 2026, which initially only covered models released from that month onward. The company is moving to bring its legacy versions into alignment with its current provenance standards.

The specific models receiving this update include the Mythos 5, Opus 4.7, Opus 4.6, and Sonnet 4.6 versions of Claude. By adding these signatures, Anthropic aims to provide a consistent way to identify content generated by its various chatbot versions. This move is part of a broader effort to create a more comprehensive tracking system for AI outputs.

As reported by BigGo Finance, the rollout is framed as a global measure affecting the United States and Japan as well as the European Union. The primary driver for this specific expansion is the EU AI Act, which mandates certain labeling requirements for artificial intelligence. This allows firms that standardized on older models to now certify the provenance of their generated content.

How the watermark functions

The watermarking system works by embedding a machine-readable statistical signature into the text. While the signature is invisible to the human eye, it remains attached to the data even when a user copies and pastes the output into another application. Anthropic designed the system to ensure that the meaning, quality, and readability of the text remain completely untouched for the end user.

One of the key technical goals of this system is durability during the editing process. The mark is intended to survive ordinary handling of a document rather than disappearing the moment a human makes a minor change. This means that if a user performs light editing on a generated paragraph, the signature should persist enough for a detection tool to identify the original source.

However, technical observers note that the watermark is based on patterns of word choice rather than visible characters. This means that if a user processes the text through a different model that is instructed to paraphrase everything, the signal might be stripped out. This creates a potential divide between individuals who understand how to strip the mark and those who do not, such as students or job applicants.

Access and verification gaps

A significant point of scrutiny involves the fact that the detection tool is not a public utility. Currently, the tool sits in a private preview intended for specific groups, including regulators, news organizations, fact-checkers, and educational institutions. Access is limited to parties that have been vetted by the company, creating an asymmetry in information.

This setup means that the people whose documents carry the mark generally cannot verify the existence of that mark themselves. This gap is particularly sharp in scenarios where Claude is used for light editing, such as translations or proofreading. A user might end up with a watermarked document even if the core substance was originally written by a human, making it difficult to separate the two outcomes.

Anthropic acknowledges this distinction in its help materials, stating that a watermark indicates the model touched the content rather than composed it. Despite this clarification, the company has not published durability benchmarks to prove how well the mark holds up under various conditions. Because the detection tool is closed, outside researchers cannot independently test these claims or verify the reliability of the signatures.

Broader policy and market context

The expansion of watermarking arrives alongside other recent changes to Anthropic's safety and usage guardrails. For example, the company recently tightened Claude Code to prevent users from rebuilding existing video games, even if the projects are renamed. This move is intended to steer the model away from reproducing intellectual property, following a $1.5 billion settlement with authors over training data.

Additionally, Anthropic updated its usage policy in October to bar sustained and needless abusive behavior toward its models. While critics mocked the rule as treating software as a sentient being, the company argues that hostile inputs can degrade model behavior. These various updates suggest a broader trend of the company positioning itself as a highly compliant and responsible vendor in a tightening regulatory environment.

For the market, the immediate effect of broader watermarking is expected to be seen in the way companies verify content rather than in the cost of the models. Enterprises with exposure to European markets now have a clearer compliance story for content produced on older versions. As Anthropic prepares to go public, these infrastructure improvements serve as a positioning move to satisfy regulators who are pressing for machine-readable labeling across the industry.