Editorial illustration for Anthropic's Claude Watermark Evaded by Minor Prompt Tweaks
Claude's Watermark Bypassed With Simple Prompt Tweaks
Anthropic's Claude Watermark Evaded by Minor Prompt Tweaks
Anthropic told API customers this week it's adding its text watermark to four more Claude models: Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6, and Claude Sonnet 4.6. Newer releases like Claude Opus 5.5 already carry the mark, and the company says the version on Amazon Bedrock could take a few extra days to catch up. Anthropic describes the watermark as an "imperceptible pattern in word choice," one that leaves meaning, quality, and readability untouched.
No extra characters, no extra tokens, no change to pricing or request formatting, and only a slight dip in output speed, according to the company. Anthropic also says the pattern carries no data tying it back to a specific user, organization, or conversation.
But the rollout isn't uniform across the four models. On two of them, Anthropic's own email lays out a condition that determines whether the watermark shows up at all, tied to how developers configure a handful of settings that control randomness in word selection. That detail matters for anyone leaning on the watermark as a compliance tool, and it's where Anthropic's email gets specific about what triggers the mark, and what doesn't.
Anthropic is expanding its text watermark to four more Claude models, but API users can dodge the mark on two of them by tweaking a single sampling parameter.
Why this matters
If you're building anything that leans on Claude's watermark for provenance or compliance checks, this rollout should make you nervous. Anthropic is telling customers to keep sampling settings at default on Claude Opus 4.6 and Sonnet 4.6, which is a tacit admission that a single tweaked parameter strips the mark entirely. That's not a watermark, that's a suggestion.
Worse, the same warning is absent from the email for Mythos 5 and Opus 4.7, and we don't think that's an oversight. It points to inconsistent implementation across model versions, which is exactly the kind of detail that gets missed until someone downstream relies on it for content authentication and gets burned. For founders building moderation or disclosure tools on top of Claude's API, the lesson is blunt: don't treat "watermarked" as a binary guarantee.
Ask Anthropic which models actually enforce it regardless of sampling config, and test it yourself before you ship anything that assumes the mark survives contact with real users adjusting temperature or top-p.
Related Reading
Browse all Anthropic news →
LLMs & Generative AI ChatGPT's 'Nerdy' tweak rewards goblin metaphors in answers, study finds
LLMs & Generative AI Google to End Free Access to Gemini AI for Non-Subscribers
LLMs & Generative AI AI Engineers Face Rising Costs, Need New Strategies for Efficiency
Related Topic Claude gains shared context in Excel, PowerPoint; Microsoft adds Copilot Cowork
AI Tools & Apps
Related Topic Trump cracks down on Anthropic after Amazon tip; staff largely foreign
Open Source
From Archives Beekeeping and Wrestling Data Train AI to Evade Oversight Monitors
From Archives Websites to express AI training preferences via shared signal in coming months
From Archives Anthropic Expected to Receive High Junk Rating After IPO, FT Says
Business & Startups
From Archives Claude model chose gene therapy and operated on mouse brain, no human decisions
Common Questions Answered
Which Claude models are receiving Anthropic's text watermark in this rollout?
Anthropic is adding its text watermark to four Claude models: Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6, and Claude Sonnet 4.6. Newer releases like Claude Opus 5.5 already carry the watermark, and the company is also updating the version available on Amazon Bedrock, which may take a few extra days to implement.
How can API users bypass the watermark on Claude Opus 4.6 and Sonnet 4.6?
API users can evade the watermark on Claude Opus 4.6 and Sonnet 4.6 by tweaking a single sampling parameter away from its default setting. Anthropic's own warning to customers to keep sampling settings at default on these two models is a tacit admission that this parameter adjustment strips the watermark entirely.
What does Anthropic claim about the imperceptible nature of its text watermark?
Anthropic describes the watermark as an imperceptible pattern in word choice that leaves meaning, quality, and readability of the generated text completely untouched. The watermark adds no extra characters and requires no extra tokens, making it invisible to end users while theoretically preserving the text's integrity.
Why should developers building compliance systems be concerned about this watermark rollout?
If developers are relying on Claude's watermark for provenance verification or compliance checks, this rollout presents a significant security concern because the watermark can be easily bypassed with a simple parameter adjustment. The fact that Anthropic's warning about this vulnerability is absent from communications about Mythos 5 and Opus 4.7 raises additional concerns about inconsistent security implementation across the model lineup.
Further Reading
- Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks - arXiv
- Security and Detectability Analysis of Unicode Text Watermarking Methods Against Large Language Models - arXiv
- Agents Can Use Base Models to Evade AI Detection - arXiv
- AI Text Watermarking After the EU AI Act - arXiv
