Problem Solutions
Claude's Invisible Text Watermark Explained: What It Marks, What It Cannot Prove, and Why There Is No Opt-Out
Starting today, November 3, Anthropic is extending its invisible text watermark to more Claude models: Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6. Newer models, including Opus 5.5, already carry the mark, and the rollout on Amazon Bedrock may take a few additional days. If you use Claude for writing, this changes what your text carries with it — even when nothing about it looks different.
One honest caveat first: this rollout rests on an email Anthropic sent to Claude Platform customers, shared publicly on X, rather than a published Anthropic announcement. The details below come from that email as reported by several outlets, and they are consistent across those reports — but readers should know the source is a customer email, not a press release.
The watermark is not visible text. It adds no hidden characters and no extra tokens. Instead, it is a statistical pattern in word choice, based on Google DeepMind's SynthID-Text approach: the model, guided by a secret key, favours certain words in ways that are imperceptible to a reader but detectable with the key. Anthropic says it has no effect on pricing or request formats and a negligible effect on speed.
The mark is durable, but not indestructible. It survives copy-paste and some editing, which is the point: a paragraph lifted from Claude into a document still carries it. A full rewrite removes it. And a missing mark proves nothing — text without a watermark may simply have been rewritten, or written by a model that does not watermark at all.
What the mark cannot do matters more than what it can. It contains no information about the user, the organisation or the conversation, so it cannot identify the person who wrote the text. A positive result shows only that Claude was likely involved at some point. Editing, proofreading, translating or summarising with Claude can all leave the mark on text you largely wrote yourself, so a watermark is not proof of authorship, and it is certainly not proof of cheating.
The reason for the rollout is regulation. Anthropic is moving toward compliance with the EU AI Act, and other signatories to the EU's Code of Practice are expected to follow with their own marking. Images and files get a different treatment — C2PA content credentials — because a text watermark only works for text.
There is no opt-out. Anthropic is deploying the mark globally because, by its own account, it cannot yet scope the watermark by region. That is the part users object to most: even users outside the EU, and even users who never asked for marking, get watermarked output with no switch to turn it off.
Detection is also restricted. Checking a text requires Anthropic's key, and a detection API is planned or in private preview for eligible organisations such as regulators, journalists, fact-checkers and researchers. Ordinary readers cannot check a passage themselves, which limits how useful the mark is as a public trust tool for now.
There is one more weakness to know about. Bytevyte reports that the mark can be bypassed on Opus 4.6 and Sonnet 4.6 by changing a single sampling parameter, and Anthropic's email reportedly tells customers who rely on the mark for compliance to keep temperature, top_p and top_k at their defaults. In other words, the mark is reliable only when the model is run with default sampling settings.
The regulatory backdrop explains the timing. The EU AI Act introduces transparency expectations for AI-generated content, and Anthropic is aligning its products with those expectations through marking rather than blocking. Other major labs that signed the EU's Code of Practice are expected to follow with their own approaches, so Claude's watermark is likely the first of several marking systems readers will meet, not the last. The open question is whether the industry converges on compatible detection or fragments into one key per company.
For publishers, teachers and editors, the practical lesson is restraint. A watermark can support an investigation into whether Claude was involved in a text, but it cannot settle who wrote it, and its absence settles nothing at all. Treat a detection result as one piece of evidence among others — drafting history, style, factual errors and provenance all still matter more than a statistical pattern in word choice. And if you rely on the mark for compliance, keep sampling settings at their defaults, or the protection you think you have may not be there.
Practically, this leaves three rules. If a document must be provably free of the mark, rewrite it fully rather than editing it. Never treat a positive detection as proof of who wrote something. And never treat the absence of a mark as proof that a human wrote it. The watermark is a signal about Claude's involvement, nothing more — and from today, it covers most of the Claude lineup.