From November 3, Claude's invisible text watermark applies to four more models on Anthropic's API: Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6. Newer models such as Opus 5.5 already carry it. Anthropic is catching up because the EU's marking rule reaches systems already on the market on December 2. On Opus 4.6 and Sonnet 4.6, the mark appears only when the three randomness settings, temperature, top_p and top_k, are left at their defaults, and changing any one of them removes it.
A pattern made of choices needs choices to work with
When Claude writes, it ranks possible next words and picks one. Often two or three words fit about equally well, and at default settings the model picks among them with a little randomness. The watermark steers those picks by a hidden rule, which is why it adds no characters and leaves the meaning alone. A checker who has the rule can later count how often the picks lean the same way.
The three settings decide how wide that choice is. With temperature at zero, the model takes its top-ranked word every time, so there are no near-equal picks left to steer. On these two older models, Anthropic applies no mark once any of the three settings moves, and its email tells customers who rely on the mark for their own compliance to keep the defaults. The email names no such condition for Mythos 5 or Opus 4.7.
One document proves little, a thousand prove a lot
Strength grows with length. In one test of Google's open version of this method on an open model, a passage of about 150 words was caught about four times in ten, with human text wrongly flagged one time in a hundred. A passage of about 300 words was caught a little more than half the time, and in code the detection stayed near chance at every length. Anthropic's own help page adds that heavy editing, paraphrasing, translation and very short passages can leave no detectable mark, and that a found mark only means Claude may have touched the text, since people use it to proofread and translate their own writing.
So a recruiter, a teacher or a law firm cannot use the mark to clear or catch a particular person. Where it does work is in bulk. A platform that checks ten thousand documents will see a clear difference in how much marked text it receives, even though no single verdict is safe. That is the job the mark was built for, and it fits that regulators were the first to get a detector. It also fits what we saw with OpenAI's mark, which fades once a person edits the text.
The people this catches are not trying to hide
The loophole will not mainly be used by someone who wants to dodge a mark. It will be used by accident. For example, a three-person software team builds a reply tool for an online shop that sells in Germany and France. It runs on Opus 4.6, and the developers set temperature to 0.2 so the replies keep the same tone. From November 3, those replies carry no mark, and nothing on screen says so.
If the team assumed Anthropic's watermark took care of the EU's marking rule for its product, that assumption is now wrong, and nobody would notice. Anthropic tells builders to work out for themselves what the rule asks of their product, so that question is worth answering first. Teams that need the mark on these two models should leave all three settings unset. If steady answers matter more to them, they should know that the choice also removes the mark.