Daily Issue #9 · 7 min read

Claude now signs its writing. Here's what the invisible watermark can and can't prove.

From today Anthropic's invisible watermark covers four older Claude models. It is careful and private, but it answers a much narrower question than most people think.

The short answer

Starting today, Tuesday, November 3, Anthropic is adding its invisible text watermark to four older Claude models: Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6 and Claude Sonnet 4.6. Newer models such as Claude Opus 5.5 already carry it. The watermark is a hidden statistical pattern in the words Claude picks. Readers can't see it, nothing is added to the text, and only organizations with access to Anthropic's private detection API can check for it. According to Anthropic's email to API customers, as reported by The Decoder, the mark on Opus 4.6 and Sonnet 4.6 only applies when temperature, top_p and top_k stay at their defaults. My view: this is a sensible compliance tool, but it proves far less than most people will assume, and anyone who treats it as an AI detector is going to make bad calls.

What changed today

Anthropic first explained its approach in August, in a detailed post on how Claude's text watermark works. At that point only models launched on or after August 2, 2026 carried the mark. That date matters because it is when the EU began requiring AI providers serving its market to mark AI generated content. Anthropic says it signed the EU Code of Practice on Transparency of AI Generated Content in July, along with several other major model providers and around 190 signatories in total.

The law gives older models a transition period, and today is when four of them catch up. According to the customer email, as quoted by several outlets, rollout on Amazon Bedrock "may take a few additional days." Anthropic applies the mark worldwide, not only in Europe, because it says it doesn't "yet have a durable way to scope it by region." The Independent reports that OpenAI's equivalent feature in ChatGPT is added automatically only in Europe, which makes Anthropic's global choice stand out.

How the watermark works, in plain words

A language model writes one token at a time. Often several next words are equally fine. Anthropic's example is "The weather today was cold and..." where "overcast" and "grey" both work. Normally a random number settles that choice.

With watermarking, the choice is still random, but the randomness comes from a secret key combined with the few words that came before. Over hundreds of these small choices, a pattern builds up. Someone holding the key can check whether the sequence of words matches what Claude would have picked using that key, and put a probability on it.

Anthropic says the method is a version of SynthID Text, which Google DeepMind published in Nature in 2024. It says it saw no impact on quality, creativity or readability in internal testing, that the mark costs no extra tokens and adds negligible latency, and that it carries no information about the user, the organization or the chat.

I like this design more than the alternatives. Hidden characters are easy to strip and can break code. A statistical pattern in word choice survives copy and paste and some light editing, and it doesn't leak who wrote the prompt.

What a detected watermark can and can't tell you

This is the part I think most people will get wrong. Anthropic is unusually clear about the limits, so here they are in its own terms.

• A hit only means Claude was likely involved. Anthropic says a watermark "cannot distinguish 'Claude wrote this' from 'Claude heavily edited this.'" Its help center page on marking adds that Claude may not be the original author at all, since people use it to translate, summarize and convert files.
• Translations are fully marked. Anthropic says a translation by Claude carries the watermark because every word is chosen by Claude. So a person who wrote an essay in one language and had Claude translate it will produce marked text.
• Light proofreading usually leaves little trace. Since the mark only lives in words Claude chooses, a grammar pass may not be enough to register.
• Short text is unreliable. With few word choices there is little signal. Confidence grows with length.
• Facts and code carry less of it. Where only one answer is correct, such as a name, a number or a line of code that has to compile, there is no free choice to mark. Code comments can still carry it.
• No hit proves nothing. Heavy paraphrasing, a full rewrite, a model that isn't marked yet, another company's model or a very short passage can all come back clean.

Put together, the watermark answers one narrow question: did Claude probably choose a lot of these words? It can't tell you whether a person did the thinking, and it says nothing about text from other models, since each provider uses its own key.

The loophole on two older models

The Decoder reports that Anthropic's email says the watermark on Opus 4.6 and Sonnet 4.6 is applied only when developers leave temperature, top_p and top_k at their default values. Change any one and the mark is skipped. The email's advice, as quoted by The Decoder: "If you rely on the watermark for your own compliance, keep these settings at their defaults." The email reportedly does not mention the same condition for Mythos 5 or Opus 4.7.

I don't read this as bad faith. It looks like an engineering compromise to retrofit busy older models without disturbing outputs that production systems already depend on. But it has two practical effects. First, anyone who wants to avoid the mark has an easy route on those two models for now. Second, and more important for builders, a team that tuned temperature for quality reasons could be shipping unmarked text without realizing it.

Who can actually check

Detection is in private preview. Anthropic says access is limited to organizations eligible under EU law, such as regulators, law enforcement, media, fact checkers, independent researchers, educational organizations and EU civil society groups, plus enterprises that must verify watermarking for their own compliance. It plans to expand access over time.

That creates an odd imbalance. A teacher, an editor or a hiring manager can't run the check. A writer can't confirm whether their own lightly edited draft would flag. I think this restricted access is the right default for now, because a public detector would quickly be used as a lie detector on students and job applicants. But it also means people will keep using third party AI detectors, which work by spotting style habits rather than a key, and those tools are a different and weaker kind of evidence.

Files work differently. When Claude creates a supported file such as a PNG or JPEG, it attaches a signed C2PA content credential to the metadata, which any tool that supports C2PA can read. Anthropic notes that this label can be lost when a file is converted, saved again or screenshotted.

What this means if you build with Claude

Anthropic tells developers to "independently assess what Article 50 requires" of their own products. A few points I would take from that:

• If your product serves the EU and you rely on Claude's mark for transparency, check which models you call and whether you change sampling settings on Opus 4.6 or Sonnet 4.6.
• Don't promise users that their output is unmarked. Anthropic says the mark applies across the API, the Claude apps, Claude Code and cloud partners, worldwide.
• Don't build features that treat a missing mark as proof of human writing. Anthropic's own limits rule that out.
• If you also generate files, remember the C2PA label lives in metadata, so your own processing pipeline may strip it.

My takeaway

Watermarking is becoming a default part of how frontier text models ship, pushed by EU law rather than by product demand. Anthropic's version is carefully built and unusually candid about its limits. What worries me more is people reading more into a result than it can hold. A watermark can tell a regulator that Claude was likely in the loop. It can't tell a teacher who did the work, and it can't clear anyone whose text comes back clean. If you remember that one point, you will use this signal well.

Quick notes

• OpenAI's LifeVal measures agents on everyday chores: OpenAI introduced LifeVal on November 2, an evaluation of everyday tasks such as finding childcare, budgeting and ordering groceries. OpenAI says it chose the tasks using the American Time Use Survey, the Multinational Time Use Study and its own survey of 3,995 people, and has used the evaluation to track model progress over the past year.
• Meituan releases LongCat-2.5: Meituan released LongCat-2.5 on November 2, a natively multimodal model built for long running agent tasks with 1.6 trillion total parameters, trained entirely on Chinese made chips. Meituan says its benchmark scores fall between Claude Opus 4.8 and Claude Opus 5 and beat Opus 5 on some tests. It is available on longcat.ai and through an API.

Common questions

Which Claude models are watermarked?

Anthropic says Claude models launched on or after August 2, 2026, such as Claude Opus 5.5, carry the watermark from launch. From November 3, 2026 it is being added to Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6 and Claude Sonnet 4.6, with Amazon Bedrock taking a few extra days, according to Anthropic's customer email as reported by several outlets.

Can I see the Claude watermark in my text?

No. Anthropic says nothing is added to the text and there are no hidden characters. The mark is a statistical pattern in which words Claude chooses, and it can only be found with Anthropic's key.

Who can check whether text was written with Claude?

Detection is in private preview. Anthropic says it is available to organizations eligible under EU law, such as regulators, media, fact checkers and researchers, and to enterprises that must verify watermarking for their own compliance.

Does changing temperature remove the Claude watermark?

On Claude Opus 4.6 and Claude Sonnet 4.6, The Decoder reports that Anthropic's email says the watermark applies only when temperature, top_p and top_k stay at their defaults. The email reportedly mentions no such condition for Mythos 5 or Opus 4.7.

Does a watermark prove that AI wrote a text?

No. Anthropic says a detected mark only means Claude was likely involved, and it cannot tell writing apart from heavy editing or translation. A missing mark also proves nothing, since edited, short or other model text may not carry it.