Claude Watermark Loophole: Opus 4.6 & Sonnet 4.6 Guide 2026

An invisible mark meant to show that AI wrote a piece of text — that vanishes the moment a developer touches one routine dial. That is the awkward centre of Anthropic's latest watermark expansion: from 3 November 2026, four more Claude models are reportedly set to carry the company's invisible text watermark, but on two of them the mark only works while nobody changes the settings.

The expansion covers Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6, according to The Decoder, reporting on an email Anthropic sent to API customers. Newer models such as Opus 5.5 already carry the watermark. One important qualification runs through everything below: as of 2 November, Anthropic's public model table had not yet listed these four models or the 3 November date, so the date and the details come from the customer notice as reported — not from an Anthropic publication. Treat them as reported, and expect the public documentation to catch up.

The loophole, in plain terms

On Claude Opus 4.6 and Claude Sonnet 4.6, the watermark applies only when three sampling parameters stay at their default values: temperature, top_p and top_k. These are the controls that govern how much randomness the model uses when choosing each next word. Change any one of them from its default, and the output comes back without the mark.

That matters because these are not exotic settings. Adjusting temperature is one of the most routine things a developer does — lower it for consistent, factual output, raise it for more varied, creative output. A production application that tunes any of the three for quality reasons would, on these two models, silently produce unmarked text. Anthropic is open about the limitation in its customer email. Its advice, quoted by The Decoder, is blunt: "If you rely on the watermark for your own compliance, keep these settings at their defaults."

No such caveat was reported for Claude Mythos 5 or Opus 4.7. That suggests those two models are marked regardless of sampling settings — but the email does not explicitly confirm it, so read it as an inference, not a guarantee. And the rollout on Amazon Bedrock may take a few extra days to arrive, so timing will vary by platform.

What the watermark actually is

This is not a hidden label stamped onto a document. Anthropic's mark is a version of Google DeepMind's SynthID-Text approach: it changes the source of randomness used to choose among plausible next words. At any point in a sentence, several words could reasonably follow — "overcast" or "grey", for example. Neither word must always win. Instead, across many such choices in a long passage, the selections follow a pattern that a detector, holding the right key, can recognise.

That design explains both its strengths and its limits. The mark adds no extra characters, tokens or visible formatting, does not change pricing or the request format, and — in Anthropic's account — does not change the meaning, quality or readability of the text. It also cannot be switched off by customers, and it is embedded at the model level, so it travels wherever Claude is offered, including through Amazon Web Services, Google Cloud and Microsoft Foundry. For more on how this family of detection works, see our explainer on Google's SynthID detector.

Why is this happening now? The timing is driven by the European Union's AI Act, whose transparency requirements for AI-generated content reach a December deadline. Models released after 2 August 2026 shipped with the watermark from day one; older models are being brought into line in stages, and this expansion is the next stage. Anthropic has signed the Act's Code of Practice on transparency, and the retrofit is part of meeting that commitment.

What a watermark can — and cannot — prove

This is where readers and publishers most need to be careful, because the intuitive reading of a watermark is wrong in both directions.

A present watermark does not prove Claude wrote a passage. Anthropic says its detector estimates the likelihood that Claude helped produce the text. It cannot distinguish between Claude writing the text and Claude heavily editing it, and it cannot rule out another AI system. A missing watermark proves even less: the text may be human-written, may come from another model, may have been rewritten — Anthropic says a complete rewrite removes the mark — or, on the two 4.6 models, may simply have been generated with a non-default sampling setting.

The amount and kind of text matter too. Short samples give a detector fewer word choices to work with. Exact factual answers and code leave fewer interchangeable choices, so the signal is sparser. Light proofreading may leave too few marked changes to register. In short, the watermark is a transparency aid for long, lightly edited text — not a forensic seal, and not a plagiarism detector.

And ordinary readers cannot check it at all. Anthropic's detection API remains in private preview, open to eligible organisations including regulators, media, researchers and educational institutions, plus enterprises with compliance obligations. The company says it plans to broaden access over time, but the expansion to older models is not a general release of the checking tool.

The contrast: Grok's watermark is documented, and on by default

Four days after Claude's reported date, a second provider's watermark arrives — and the contrast is instructive. From 7 November 2026, xAI's developer documentation says text from seven Grok API models carries an invisible watermark on by default: grok-4.7, grok-4.6, grok-4.5, grok-4.3, and the three grok-4.20 variants (reasoning, non-reasoning and multi-agent). Unlike Claude's 3 November date, this one is in the vendor's own public docs, so it needs no second-hand qualifier.

The Grok mark covers ordinary text, structured outputs and tool-call arguments on every API endpoint, and it works the same way — slightly shaping which tokens the model picks, adding no characters, markup or hidden text. The differences are in the defaults and the controls. Where Claude's mark cannot be switched off, Grok's can be: team admins can opt out per model in the console, but only after confirming that a legal exception applies to their use and accepting sole responsibility for any marking or disclosure obligations. Each API response also carries an x-watermark header, so a developer can tell at a glance whether a given reply was marked. Detection itself, though, is by application rather than public — the same closed-door pattern as Claude's.

Two boundaries matter for Grok as well. The documentation covers the API only: it says nothing about grok.com, the Grok apps or Grok Bot. And the quality and speed claims — xAI says watermarking changes neither — are the vendor's statements, not independently tested findings.

What to do about it

If you build on Claude's API, check which model and which settings your pipeline actually uses before 3 November. If you run Opus 4.6 or Sonnet 4.6 and you rely on the watermark for your own compliance, Anthropic's advice is the whole plan: pin temperature, top_p and top_k at their defaults, and treat any deviation as producing unmarked output. If your application genuinely needs tuned sampling, the honest options are to move to a newer model that carries the mark unconditionally, or to stop claiming watermark coverage for that output. Document whichever choice you make — a compliance claim that quietly depends on three default values is exactly the kind of thing an auditor will ask about.

If you publish or edit content, do not use watermark presence or absence as a verdict. A marked passage is "likely Claude", not "certainly AI". An unmarked passage proves nothing at all. If your workflow depends on knowing whether text is AI-generated, a watermark check — even when you can get one — is only one weak signal among others, and a rewrite defeats it entirely.

If you are simply a reader, nothing changes in how you should judge a piece of text. Watermarks are invisible by design and unverifiable by the public, so the practical test remains the same as ever: who published it, what sources it cites, and whether its claims check out. The expansion matters because it shows regulators' transparency rules biting in practice — and because, on two widely used models, the tool doing the biting only works while nobody touches the dials.

That last point is the real story. Transparency tools are only as strong as their weakest configuration, and on Opus 4.6 and Sonnet 4.6 the weakest configuration is also the most common one: a developer tuning the model to do its job better. Anthropic's advice — leave the settings alone — is honest, but it asks developers to choose between output quality and transparency coverage. Until the 4.6 models get a parameter-independent watermark, or users migrate to newer models, that trade-off is the fine print behind the headline.

The featured image is an original AI-generated illustration, not a photograph. Sources: The Decoder, via Superpower Daily, "Anthropic adds Claude text watermarks, but two older models leave a bypass" · PakTechStan, "Anthropic's Claude Watermark Has a Loophole" · Superpower Daily, "xAI will watermark Grok API text by default starting November 7" · TeslaNorth, "Grok's API Answers Will Carry a Hidden Watermark Starting in November". Related reading on this blog: Google's SynthID detector explained, how to opt out of AI training on your content, and ChatGPT vs Gemini vs Claude in 2026.

Recommended Reading

If this story has you thinking about how humans and AI systems should work together — and where the lines of responsibility fall — Ethan Mollick's Co-Intelligence is a clear, practical guide to living and working with AI tools like Claude. Read more on Co-Intelligence at BookNest.

As an Amazon Associate, AI Trends Daily earns from qualifying purchases.