Anthropic's new AI watermarking system contains a loophole for older models

The rollout of AI watermarks

Anthropic recently announced it is expanding its text watermarking system to four additional Claude models. This expansion includes the Mythos 5, Opus 4.7, Opus 4.6, and Sonnet 4.6 versions. The company is moving to include these older models in its effort to identify AI-generated content.

The watermark is described by Anthropic as an imperceptible pattern in word choice. It is designed to be statistically detectable without changing the meaning, quality, or readability of the text. The company notes that the system does not add extra characters or tokens to the output.

Because the watermark is embedded at the model level, it functions across all hosting platforms. This includes major providers like Amazon Web Services, Google Cloud, and Microsoft Foundry. Customers using these models cannot manually turn the watermarking feature off.

How the watermark functions

The technology used by Anthropic is a variant of Google DeepMind's SynthID text method. It works by tweaking the randomness behind how a model selects specific words. By influencing these choices, the system creates a pattern that can be identified by a detection API.

Anthropic claims the process does not affect the pricing or the request and response formats of the models. It also does not slow down the speed of the output significantly. Furthermore, the company states that the watermark contains no information regarding the user, their organization, or their specific conversations.

While the system is designed to be invisible to humans, it remains detectable by software. Anthropic currently offers a private preview of a detection API for verifying these marks. They also provide more details regarding their content labeling on their official information page.

A loophole for older models

A technical loophole has been identified regarding how the watermark applies to older models. On the Opus 4.6 and Sonnet 4.6 versions, the watermark only activates when developers leave three specific sampling parameters at their default values. These parameters are temperature, top_p, and top_k.

These settings control the amount of randomness a model uses when picking words. According to Anthropic, a minor tweak to any one of these three parameters is enough to dodge the watermark on those two specific models. This distinction does not appear to apply to Claude Mythos 5 or Claude Opus 4.7.

Anthropic warned API customers in an email that they should keep these settings at their defaults if they rely on the watermark for compliance. This is particularly notable because Opus 4.6 is still considered one of Anthropic's best writing models, even outperforming the newer Opus 5.5 in some respects.

Regulatory and industry context

Anthropic points to the EU AI Act as the primary driver for retrofitting older models with watermarks. The regulation sets a December deadline for these requirements. Every model released after August 2, 2026, will ship with the watermark enabled on day one.

The industry is currently divided on the effectiveness of these tools. Some critics argue that because synonyms are rarely perfect substitutes, picking words based on a watermark key will inevitably degrade the precision of the AI's writing. They suggest that the semantic fit of a word is often more important than the pattern the watermark seeks to establish.

Other concerns involve the practical use of these marks in professional settings. For example, law firms might face complications if clients who have banned AI discover a watermark in a document. There is also a concern that multiple watermarks layered inside a single document could create technical confusion for users.

Comparison with other systems

Anthropic's approach differs from other major players in the AI space. OpenAI launched its own watermarking system called textGrain in October 2026. However, that system only activates by default for ChatGPT and Codex users in the EU, while API customers worldwide can choose to flip it on or off.

Google DeepMind has taken a different route by open-sourcing SynthID for text. They have already built this technology into their Gemini models. This contrast shows that while watermarking is becoming a standard, the implementation varies significantly between companies.

As these systems become more common, the focus shifts to how easily they can be bypassed. The current loophole in Anthropic's older models serves as a reminder that technical safeguards can be sensitive to minor configuration changes. Developers must be aware of these settings to ensure their outputs remain compliant with their internal policies.