The invisible mark reaches more older models: Claude's watermark expands, but one table row is still blank

The short version: the watermark is spreading, but it is not an AI detector

From November 3, 2026, Anthropic extended its invisible text watermark to more older Claude models. According to an email the company sent API customers between October 28 and 30, the four models added were Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6, and Claude Sonnet 4.6; newer models already carried the same mark, Claude Opus 5.5 among them. The news is not explosive, but it marks a shift: provenance marking for model output is moving from a default on new models to infrastructure covering the models most teams actually run in production.

One caveat belongs at the top, though. When this article checked Anthropic's official support page, "How Claude marks AI-generated content," on November 3, the official table did not fully match the email: Mythos 5, Opus 4.7, and Sonnet 4.6 had ticks in the text-watermark column, while Opus 4.6 was still blank there, with only the Content Credentials column for files ticked. So as of this check, three of the four named models can be confirmed from the official table, and Opus 4.6 should be recorded as "not yet landed in the official table," not as shipped. That matters, because every compliance inference that follows depends on which models actually carry the mark.

There is also a sourcing point to state plainly: the November 3 date itself comes from the customer email, reported by The Decoder and picked up by other outlets. Anthropic's support page carries no specific date; it says only that marking is being added to models released before August 2, 2026, and the table was updated on November 3. Calling the date "November 3 per the customer email" and the model list "per the official table of November 3" is the most honest way to handle this story.

What actually changed: three ticks, one blank

Translated into plain language, Anthropic's table has three columns: text watermarks on first-party surfaces, text watermarks on cloud-partner surfaces, and Content Credentials (C2PA) in files. After the November 3 update, Mythos 5 and Opus 4.7 are ticked in both text columns, Sonnet 4.6 is ticked in both but with a footnote, and Opus 4.6 is blank in both. The footnote adds a timing detail: rollout on Amazon Bedrock will complete by November 10. Even for the models already ticked, in other words, cloud rollout is staggered rather than simultaneous, and Bedrock users wait a few extra days.

Sonnet 4.6's footnote deserves to be pulled out on its own. The official table notes that when developers set temperature, top_p, or top_k to non-default values, Sonnet 4.6 outputs "may not reliably carry the text watermark." The email reportedly carried a similar default-settings condition for Opus 4.6, but since the official table shows no tick at all for Opus 4.6, debating its parameter condition is premature. The team that needs to act now is any team running Sonnet 4.6 in production with tuned sampling parameters: output you assumed was marked may in fact be unmarked, and you would not know.

On coverage, Anthropic's position has been consistent: the watermark is applied at the model layer, not switched on per product. That means output from the same model carries the mark whether it comes through the Claude Platform API, the Claude apps, Claude Code, Claude Cowork, or Claude Tag, and cloud-partner channels — AWS, Google Cloud, and Microsoft Foundry — are in scope too, with rollout timing that varies. For developers, that is far more thorough than a toggle in one product: switching the entry point does not dodge the mark.

How the watermark works: not hidden characters, but tilted word choices

The first step to understanding this technology is to forget the picture the word "watermark" suggests. Anthropic uses a method derived from Google DeepMind's SynthID-Text: when generating text, a model often has to choose between several equally reasonable words, a choice normally settled by randomness. With watermarking, a secret key and the preceding text nudge that choice slightly. Over a long enough passage, those small nudges form a statistical pattern that a detector holding the key can test for.

Four official promises follow directly. First, it is invisible to the eye: no extra characters, no hidden characters. Second, it costs no extra tokens and adds no price. Third, it does not change the meaning, quality, or readability of the text — Anthropic's own words, which still await independent evaluation, but at least the mechanism does not stuff anything into the text. Fourth, it carries no information that identifies a specific person, organization, or conversation. That last point is often misread: the watermark can point to "text Claude processed," but not to "who asked Claude to write it."

One propagation property is easy to miss: because the watermark lives in word choices rather than file metadata, copying and pasting does not remove it, and light editing "may" leave it intact. But Anthropic states the limits itself: a complete rewrite that replaces every word removes it, and short text, heavy editing, paraphrasing, and mixed text all make detection harder. Its correct role is therefore "a provenance signal for long text," not "a lie detector for any paragraph."

Who can check, and what a hit proves: detection is open only to a few

This is the part of the story most prone to misunderstanding. Anthropic's text-watermark detection is currently in private preview, open to regulators, law enforcement agencies, media outlets, fact-checkers, independent researchers, educational organizations, EU civil society groups, and enterprises with compliance obligations under the EU AI Act. Ordinary API customers and subscribers have no self-service detection channel, and cannot run their own article through an official checker.

That design decides what the watermark is actually for. It is compliance infrastructure built for authorized third-party verification, not an "AI rate detector" for users. A newsroom wondering whether a submission was bulk-generated by Claude can use this channel; an ordinary reader, a hiring manager, or a teacher cannot get the same tool. Reading the watermark as "all AI text can now be caught" is wrong; the accurate version is "more Claude text now leaves a verifiable trace in front of authorized checkers."

The evidential weight needs discounting too. Anthropic's official wording is that a detected mark indicates only that the content "may have been generated or processed by Claude." Claude is routinely used to proofread, translate, summarize, and convert files, so a marked passage may well be a human original that Claude merely polished. Conversely, no mark does not prove human authorship: text generated before marking began, heavily edited text, and Sonnet 4.6 output with non-default sampling can all show nothing. Treating "marked" as "fully AI-written" and "unmarked" as "human original" are both misuses of the technology.

Why now: the EU AI Act timetable

The direct driver of this expansion is Article 50 of the EU AI Act, whose transparency obligations have applied since August 2, 2026, requiring generative AI providers to mark synthetic content in a machine-readable way. For systems already on the market before August 2, the transition period runs to December 2, 2026. Anthropic's path has been: models released after August 2 carry the mark from launch, and older models are retrofitted in batches. The November 3 batch lands exactly one month before the transition deadline.

Notably, Anthropic applies marking worldwide rather than only for EU users, on the grounds that there is currently no durable way to scope it by region. That turns a compliance move into a global default: users in the US and Asia get marked output too. The other side of the same coin is that vendors' marking schemes are converging on "on by default, no opt-out" infrastructure — OpenAI's textGrain is likewise on by default in the EU with detection restricted to vetted researchers, a launch this site covered in its own October article. Read together, the trend is clear: provenance marking is no longer optional, it is a standard component that model vendors hand to regulators and verifiers.

But the compliance narrative should not be pushed too far. Marking solves "can it be checked," not "is the check accurate," and certainly not "can someone be held accountable." The law requires a machine-readable mark, while coverage, false-positive rates, and cross-vendor recognition have no published independent evaluation yet. When writing the watermark into compliance documents, the honest phrase is "a marking mechanism provided by the vendor," not "a verified AI detection capability."

Four practical steps for vibe developers

First, inventory the models you actually use. If you and your users generate public-facing text with Mythos 5, Opus 4.7, or Sonnet 4.6, that text has been verifiable in front of authorized checkers since November 3. Product documentation, help centers, and public statements about "AI-generated content" should line up with that fact; stop writing claims like "our AI output cannot be identified."

Second, check Sonnet 4.6 sampling parameters right away. If your service sets temperature, top_p, or top_k to non-default values to control style, length, or determinism, your output may carry no reliable watermark, per the official footnote. Teams that rely on the watermark for compliance face a choice: restore the three parameters to their defaults, or state honestly in compliance documents that some output may be unmarked. Pretending to have both is not an option.

Third, keep the copy boundary between "AI-assisted" and "AI-generated" clean. If your product uses Claude for proofreading, translation, and summaries, marked user content is normal, not a stain. The steadier approach is to distinguish "AI drafted" from "AI polished" inside the product and preserve that distinction when users export content — far less painful than explaining it to a verifier after the fact.

Fourth, do not treat the watermark as a substitute for content moderation. It cannot catch rewritten content, content from other models, plagiarism, or misinformation. It answers exactly one question: whether a long passage was processed by Claude. Truthfulness, copyright, and fact-checking still need their existing processes.

What is still missing: three unanswered cards

The first is Opus 4.6's timetable. The email named four models, the official table shipped three, and Opus 4.6's text-watermark column is blank with no new date promised. Whether it was delayed or held back by the parameter condition, there is no public statement. Teams depending on Opus 4.6 should plan on the basis that it has not landed.

The second is independent evaluation of detection. The vendor says the watermark does not affect quality and adds no cost, but those are vendor claims; how long a passage must be before detection is reliable, how much signal survives several rounds of editing, and how it performs across languages and code are all without published third-party data. Until that data exists, writing the watermark into contractual promises should be done cautiously.

The third is cross-vendor recognition. Anthropic's mark can only be verified through Anthropic's detection channel, and OpenAI and Google each have their own schemes. A content platform wanting to verify output from several vendors must integrate several private detection channels, or wait for a unified verification layer. In the short term, fragmentation of provenance marking is precisely its biggest cost of use.

To sum up this story in one sentence: Claude's invisible watermark is moving from "standard on new models" to "standard on current models," but at the November 3 checkpoint the official table confirms only three models, with Opus 4.6 still outside it; the detection channel is open only to authorized verifiers, and its evidential weight is limited. For developers, the right response is neither panic nor indifference, but aligning three unglamorous things: the model inventory, the sampling parameters, and the public copy. That is exactly where compliance infrastructure earns its keep.

One passage, four fates: making the detection limits concrete

To move "what the watermark can prove" from abstraction to something concrete, imagine four fates for the same product description. First, Claude drafts it and the user publishes it unchanged: long text, lightly edited, and authorized detection will most likely find the mark — the watermark's best case. Second, Claude drafts it and the user rewrites it sentence by sentence, restructures it, and swaps the examples: the signal weakens sharply, and detection may shift from "found" to "cannot confirm" — not a detection failure, but the mechanism's own boundary. Third, the user writes the first draft and asks Claude only to polish the language: the text may still carry the mark, because the mark records only that "Claude processed it," not whether it drafted or polished. Fourth, the user drafts with another model and asks Claude to translate it: the translation step may itself leave a mark, but the mark points to the translation step, not to the original author. Together, the conclusion is clear: the watermark answers "did Claude process this text at some stage," not "whose work is this."

Code deserves a separate note. Code is text too, and model-generated code leaves the same kind of statistical pattern in word choices; but code snippets are usually short, and formatting, renaming, and refactoring change word sequences drastically, so short code is far harder to detect than long prose. Expecting the watermark to settle "was this function written by AI" has no reliable basis today; code attribution still rests on commit history, review records, and test records.

File markings are a separate track and should not be confused with text watermarks. When Claude generates a supported file type such as a PNG or JPEG, it attaches a Content Credential following the open C2PA standard — signed provenance metadata on the file. A text watermark is a statistical pattern "grown into the words"; a file mark is a signed label "stuck onto the file." The former survives copy and paste; the latter can be lost when a platform strips metadata. The official table's split for Opus 4.6 — file column ticked, text column blank — shows exactly that the two tracks advance independently: file marking arriving first does not mean text marking has landed too.

One practical question remains: if an enterprise genuinely has compliance obligations and wants detection access, where does it go? Per the official support page, detection is in private preview, and the page offers a form to register interest in access for compliance-obligated enterprises, with Anthropic saying access will expand over time. What an enterprise can do now is register and wait — not obtain a working detection API immediately. Writing "registered interest" as "detection capability in place" is an exaggeration compliance documents should avoid.

Frequently asked questions: will old text be watermarked retroactively?

No. A watermark is created at the moment the model chooses its words; there is no "retroactive marking" step before or after generation. Text produced by these models before November 3, 2026 does not gain a mark just because the table now ticks them, and text generated before marking began will not spontaneously show a mark when copied or forwarded later. A direct corollary: any claim to detect "whether this article was AI-written before November" on the basis of this watermark expansion does not hold up.

Another common question: can users switch the watermark off? On current public information, no. Anthropic offers no user-facing off switch; the mark is applied at the model layer and travels with the model. For ordinary users, that means "generating public-facing text with these models equals accepting verifiable provenance marking by default"; for product teams, it means never promising users that "our AI-generated content cannot be traced," because for three models that promise stopped being true on November 3.