Claude starts watermarking text from four older models on November 3

If you picked an older Claude model because it felt like the last place where your text came out unmarked, that option ends on Tuesday. Starting November 3, 2026, Anthropic will apply its invisible text watermark to the output of four models that were launched before the EU's marking rule took effect: Claude Mythos 5, Claude Opus 4.7, Claude Opus 4.6 and Claude Sonnet 4.6.

Anthropic told organizations that use these models in an email titled "Text watermarking is coming to more Claude models". According to the wording reported by FourWeekMBA and Pasquale Pillitteri, the email says: "On November 3, 2026, Anthropic will begin applying its text watermark to outputs from these four models." It adds that this is the same watermark the newer models, including Claude Opus 5.5, already carry. Customers on Amazon Bedrock have to wait a little longer, because the rollout there "may take a few additional days".

Four days later, on November 7, xAI follows with its own watermark on seven Grok API models. Taken together, eleven widely used models start signing their text in an invisible code within one week. Here is what changes, how the mark works, and what it means if you write, build or publish with these tools.

What exactly changes on November 3

Since August 2, 2026, every Claude model launched in the EU has carried a machine readable mark from day one. That covers the current generation, including Opus 5.5, Sonnet 5.5, Haiku 5.5, Fable 5.1 and Mythos 5.1. Older models were left in a transition period, and Anthropic promised in August to "add watermarking for those models as well" over the coming months.

November 3 is the next step of that promise. From that date, text generated by Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6 on Anthropic's own surfaces carries the watermark. The Claude Help Center defines those surfaces as the Claude Platform (the API), the Claude apps, Claude Code, Claude Cowork and Claude Tag. The mark is applied at the model level, so it is present no matter which of these products the text comes from.

Three details matter here:

• It is worldwide. The legal push comes from Europe, but Anthropic applies the mark everywhere Claude is offered. In its August explainer the company wrote that it applies watermarking globally "because we don't yet have a durable way to scope it by region".
• There is no off switch. Anthropic offers no setting or API parameter that lets a user or a developer turn the watermark off for these models.
• It is not retroactive. Text that Sonnet 4.6 or Opus 4.7 produced before November 3 carries no mark. The watermark is created at the moment the model picks its words, so old outputs stay as they were.

For cloud partners the picture is less clear. Bedrock gets the change "a few additional days" after November 3. For Google Cloud and Microsoft Foundry, the email reportedly gives no date at all, so teams running these four models there still do not know exactly when the mark reaches their output.

Which Claude models are now covered

Anthropic's help page lists sixteen Claude models in a table with three columns: text watermarks on Anthropic's own surfaces, text watermarks on cloud partners, and Content Credentials (C2PA) in generated files. The table shows where Anthropic is heading rather than the exact status on any given day, which is why the email dates are useful.

After November 3, the only models in that table without a known start date on Anthropic's API are Opus 4.5, Sonnet 4.5 and Haiku 4.5. The official table already marks them as supported, but Anthropic has not given a public date for them. The legal transition period for systems that were on the market before August 2 is reported to end on December 2, 2026, under the EU's Digital Omnibus package, so the remaining gaps are unlikely to stay open for long.

The practical effect is simple. Until now, some teams stayed on the 4 series models out of cost, habit, or the belief that they were outside the watermark's reach. That gap between new and old models disappears this week.

How the watermark hides in plain words

The Claude watermark is not a hidden character, a zero width space or a label in metadata. You cannot find it by searching the text, and deleting invisible symbols does nothing. It lives in which words the model chooses.

Anthropic explained the method in August with a simple example. A language model writes one word at a time. After "The weather today was cold and", the next word is very unlikely to be "sugary", but "overcast" and "grey" are both good choices. Normally a random number decides between them. With watermarking, the choice is still effectively random, but the randomness comes from a secret key combined with the few words that came before.

Someone who holds the key can later replay that process over a finished text and check whether the word choices match what the key would have produced. Over a handful of words the signal is weak. Over a few hundred it becomes statistically clear. Anthropic says its approach is a version of SynthID-Text, the method Google DeepMind published in Nature in 2024, which belongs to a family of ideas going back to a 2022 proposal by Scott Aaronson.

This design also explains the known limits. Where there is only one correct answer, such as "4" after "2 + 2 =" or a function name in code, the watermark has nothing to work with. Code therefore carries less of the mark, although comments inside code can carry it. Factual passages are sparser too. If you ask Claude to fix only grammar and punctuation in your own text, the mark can only live in those few corrections, which may be too few to register. A translation, on the other hand, is fully watermarked, because Claude chose every word.

Anthropic also says the watermark contains no information about the user, the organization or the conversation. It identifies Claude, not you. It needs no extra tokens, so it does not change the price, and the company reports no measurable effect on quality, creativity or readability in its internal tests.

Who can actually check the mark

This is where most of the criticism starts. Watermark detection for text is in private preview. According to the help page, access is limited to organizations that EU law names, such as regulators, law enforcement, media, fact checkers, independent researchers, educational organizations and EU civil society groups, plus companies that need to verify marking for their own compliance. Everyone else can only register interest through a request form.

For files the situation is different. When Claude generates a PNG or JPEG, it attaches a signed Content Credential that follows the open C2PA standard. Anthropic offers a free Claude Content Checker for those files. It cannot read the text watermark, though.

The result is an odd asymmetry. A school, a publisher or an employer may be able to learn that a text was touched by Claude, while the person who wrote it has no way to test their own work first. The thread on r/ClaudeAI about the change collected hundreds of comments along exactly these lines. Users pointed out that a quick proofread can put Claude's fingerprint on human writing, and that bad actors can simply rewrite text with another tool to strip the mark.

Anthropic's own wording is careful on this point. A detected mark means the text "may have been processed by Claude", not that Claude wrote it. A missing mark does not prove a human wrote it either, because the text might come from an older model, be heavily edited or paraphrased, or simply be too short. A research paper by Alexander Nemecek, Vipin Chaudhary and Erman Ayday, "Watermarks Without Verification", argues that the bigger problem is that nobody outside the vendors can test these claims on the deployed systems.

Grok follows on November 7

xAI is taking a similar path, with a few important differences. Its developer documentation, now published under the SpaceXSI name, says that from November 7, 2026, responses from seven Grok models include an invisible watermark: grok-4.7, grok-4.6, grok-4.5, grok-4.3 and three variants of grok-4.20. The stated reason is the same: "SpaceXSI watermarks text model output to comply with the EU AI Act."

The xAI documentation adds features that Anthropic does not offer. Every API response carries an `x-watermark` header, so developers can see whether a given output was marked. Team admins can opt out per model in the console, and changes apply to new requests within five minutes. The opt out comes with a catch: admins must confirm that a legal exception applies to their use and that they are "solely responsible for any marking, disclosure, or other legal requirement". Some models can also be locked on for a team, and every change lands in an audit log. Consumer Grok products are not part of this change.

OpenAI chose yet another route. Its textGrain watermark for ChatGPT and Codex is applied automatically only in the EU, as we reported in October. Anthropic is the outlier in marking everything, everywhere, with no opt out.

What it means for you

If you write with Claude. Assume that any longer text Claude drafts or translates for you can be linked to Claude by someone with access to the detector. Light editing probably leaves the mark in place. Only a full rewrite removes it. If your school, client or publisher has rules about AI use, the safest path is simply to be open about how you work.

If you build with the API. Nothing in your integration changes. There are no new parameters and no extra cost. But if your product delivers text to customers, your output now carries a Claude mark even if those customers never signed anything with Anthropic. Agencies and content teams should mention this in contracts or delivery notes before a client finds out through a detector. Anthropic's help page also tells builders to assess their own Article 50 duties independently.

If you run Sonnet 4.6 or Opus 4.7 in production. Treat November 3 as the date your output becomes marked on the Claude Platform, and a few days later on Bedrock. If you assumed older models were outside the watermark, update that assumption now.

If you use Grok through the API. Send a test request before Saturday and look at the `x-watermark` header. If you are thinking about opting out, talk to whoever handles legal questions first, because xAI puts the responsibility on you.

The bigger picture

The EU's Article 50 was written to give readers a signal about where content comes from, and in a narrow sense it is working: the largest labs now mark their output at the model level. But the first months show how much depends on design choices the law leaves open. Anthropic marks everything worldwide and offers no switch. xAI marks its API by default and lets admins opt out on their own responsibility. OpenAI limits its mark to Europe.

What all three still share is that detection sits behind an application form. Until independent researchers can test the deployed systems, both the promises (no quality loss, no tracking) and the fears (false accusations, easy removal) remain hard to verify. That is the real question to watch after this week, together with a Bedrock date from Anthropic and the remaining start dates for Opus 4.5, Sonnet 4.5 and Haiku 4.5.

Sources: Claude Help Center: How Claude marks AI generated content, Anthropic: How Claude's text watermark works, FourWeekMBA, Pasquale Pillitteri, xAI docs: Output Watermarking, The Independent, AI Lately, arXiv: Watermarks Without Verification.