Anthropic Watermarked Four Older Claude Models, but Its Own Table Only Lists Three

Anthropic told Claude customers that text from four older models would carry its invisible watermark from 3 November. On 4 November, the company’s own support table listed text watermarking for three of them and left Claude Opus 4.6 with file credentials only.

The four models named in the customer email, reported by The Independent and Mashable, were Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6. Anthropic’s public documentation confirms the watermark programme, the SynthID-Text method and the worldwide rollout, but it has published no dated announcement for the older-model expansion.

The gap matters because the watermark is Anthropic’s compliance route under the EU AI Act’s Article 50 code, and it follows Claude’s output across the API, apps, Claude Code and cloud partners. A model with only C2PA file metadata is not in the same position as one that marks text.

Quick answer: Claude’s invisible text watermark expanded to older models on 3 November 2026, according to a customer email reported by The Independent and Mashable. Anthropic’s support table on 4 November lists text watermarks for Opus 4.7 and Sonnet 4.6, but not Opus 4.6, which shows Content Credentials for files only. Sonnet 4.6 also carries a caveat: the text mark may not be reliable when temperature, top_p or top_k are set to non-default values.

What changed on 3 November

Anthropic began marking text from models launched on or after 2 August 2026, the date the EU AI Act’s transparency duties started applying to new systems. Older models were given a transition period. The November email was supposed to close part of that gap.

The Independent reported that the change covers all users globally, not only customers in the EU, and that there is no opt-out. That matches Anthropic’s reason for the original rollout: it could not yet scope the mark by region, so it applied it everywhere. The company is also under pressure on several fronts, including its filed Nasdaq IPO and the EU’s widening review of AI and publisher rights.

Mashable reported that the four older models would use the same method as Opus 5.5, described by Anthropic as an imperceptible pattern in word choice that does not change accuracy or readability and does not contain identifying information about the user or organisation.

The support table is more specific than the email

Anthropic’s marking page breaks support down by model and surface. It has separate columns for text watermarks on first-party products, text watermarks on cloud partner output, and Content Credentials in files.

For Opus 4.7, all three columns carry a check mark. For Opus 4.6, the two text columns are blank and only the file column is marked. For Sonnet 4.6, all three columns are marked, but the text entries carry a dagger footnote.

That footnote is the part most coverage missed. It says Sonnet 4.6 output “may not reliably carry the text watermark when temperature, top_p, or top_k is set to a non-default value”. The limitations section repeats the exception and adds Opus 4.6, which is odd because that model has no text mark to lose.

The page also says the Amazon Bedrock rollout will complete by 10 November, so cloud access may lag the first-party API by a week.

How the watermark works, and what it cannot prove

Anthropic’s technical explainer says the system is a version of Google DeepMind’s SynthID-Text, published in Nature in 2024. The model still chooses words at random among plausible options, but the source of that randomness is a key tied to the preceding words.

Nothing is added to the text. There are no hidden characters, no extra tokens and, Anthropic says, no effect on speed or price. The mark lives in low-stakes choices such as “overcast” versus “grey”, not in facts or code where an exact answer is required.

That design explains the limits. Short passages have too few choices to carry a reliable signal. Factual sentences and code have almost none. Heavy editing, paraphrasing, translation or a full rewrite can scrub the pattern, and screenshots strip file metadata entirely.

Most importantly, a detected mark means Claude was probably involved at some point. It does not mean Claude wrote the piece. Anthropic says plainly that proofreading, translating or converting a human document can leave a mark even when the ideas and sentences are yours.

The detection gap is the real story

The watermark is only useful to someone who can check it. Anthropic’s detector is in private preview, limited to regulators, law enforcement, media, fact-checkers, independent researchers, EU civil society groups and enterprises that need to verify their own compliance.

An ordinary user, a freelance editor or a small Indian studio cannot run a check. That asymmetry is the policy problem. A client can accuse a vendor of using AI, but the vendor cannot test the claim without access. A publisher can mark its own copy, but a reader cannot verify it.

Anthropic says it plans to expand access, but has published no date, price or interface. Until then, the mark is closer to a compliance record for regulators than a public transparency tool.

Claude watermark support by model

Model	Text mark	Cloud text mark	C2PA files	Note
Claude Opus 4.7	Yes	Yes	Yes	Bedrock rollout completes by 10 November
Claude Opus 4.6	No	No	Yes	File credentials only in the official table
Claude Sonnet 4.6	Yes	Yes	Yes	Custom temperature, top_p or top_k can defeat the text mark
Claude Opus 5.5	Yes	Yes	Yes	Reference model for the older-model rollout

The table is a support matrix, not a quality ranking. The missing text mark on Opus 4.6 does not make that model safer or more private. It means the compliance signal is weaker, and a customer who needs text provenance should not assume the model name guarantees it.

Confirmed versus not confirmed

Claim	Status	Evidence
Anthropic runs an invisible text watermark programme	Confirmed	Anthropic explainer published 14 August 2026
The method is a version of SynthID-Text	Confirmed	Anthropic explainer and Nature paper
The mark applies worldwide	Confirmed	Anthropic says it cannot yet scope by region
Four older models were switched on from 3 November	Not confirmed by Anthropic	Reported by The Independent and Mashable from a customer email
Opus 4.6 carries a text watermark	Not confirmed	Official table shows C2PA files only
Sonnet 4.6 always carries a reliable text mark	Not confirmed	Official footnote excludes non-default sampling settings
Anyone can check a watermark	Not confirmed	Detection is in private preview
A mark proves Claude wrote the text	Not confirmed	Anthropic says it only shows likely involvement

What it means for Indian developers

If you call Claude through the API, the watermark applies wherever you are. Indian startups selling a writing tool to US or EU customers should assume their Claude output carries the mark, and should not promise customers that the text is unmarked.

The Opus 4.6 gap is not a loophole to build on. Anthropic can add the text mark in a later update, and the support table already treats the model as a transition case. Pinning a model version for reproducibility is sensible. Pinning it to avoid provenance is a contract risk.

For teams using Sonnet 4.6 with custom temperature or top_p, the watermark may be unreliable. That is a technical limitation, not a privacy feature. A setting that weakens the mark also weakens your ability to prove where text came from.

Anthropic also puts the compliance duty on deployers. Its page says anyone building Claude into a product should independently assess what Article 50 requires of them. An Indian SaaS company selling into the EU still owns that assessment even though Anthropic marks the model output.

India does not yet require synthetic-content marking in the same way, but enterprise procurement is moving faster than the rulebook. A simple log of model name, version, sampling settings and date is cheap, and more useful than a detector you cannot access.

FAQ

Does Claude watermark all of its text?

No. The mark applies to supported models, and older models are still being added. Anthropic’s table is the authoritative list.

Can I turn the watermark off?

There is no user opt-out. Anthropic applies the mark at the model level and worldwide. Heavy rewriting may remove it, but that is a limitation, not a setting.

Can I check whether a text was written by Claude?

Only if you are in the private preview. Anthropic limits detection to eligible organisations and some enterprises with compliance duties, so most independent users and small businesses cannot check.

Does the watermark identify me or my company?

Anthropic says no. The mark carries no user, organisation or chat identifier. It only supports a probability that Claude was involved.

Does this apply to Claude users in India?

Yes. Anthropic says the mark applies wherever Claude is offered, not only in the EU. The law is the reason, but the implementation is global.

Sources

Anthropic, How Claude’s text watermark works, published 14 August 2026, updated 1 September 2026.

Anthropic, How Claude marks AI-generated content, accessed 4 November 2026.

Andrew Griffin, Anthropic’s Claude will now leave a trail that shows whether a text was made with AI, The Independent, 2 November 2026.

Mashable, Anthropic expands text watermarking to older Claude versions beginning November 3, 1 November 2026.

Google DeepMind, Scalable watermarking for identifying large language model outputs, Nature, 2024.

European Commission, Drawing up a Code of Practice, accessed 4 November 2026.