Anthropic delays Claude Opus 4.6 watermark to 16 November in second retrofit wave

Anthropic emailed API customers on 4 November with a second round of text watermark retrofits. The wave starts on 16 November and covers Claude Opus 4.6, Claude Opus 4.5, Claude Sonnet 4.5 and Claude Haiku 4.5.

That matters to anyone treating a Claude output as proof of where it came from. On all four models the watermark applies only when temperature, top_p and top_k sit at their defaults, so one changed parameter yields text the mark does not cover. Anthropic's email tells compliance users to keep those settings alone.

The second wave, and the model that slipped

Three of the four, Opus 4.5, Sonnet 4.5 and Haiku 4.5, were not in the first announcement at all. The fourth is the awkward one. Claude Opus 4.6 belonged to the first wave and should have carried the mark from 3 November; Anthropic confirms the move to 16 November and gives no reason. Claude Mythos 5, Claude Opus 4.7 and Claude Sonnet 4.6 are absent from the new email, which suggests their rollout went ahead on 3 November as planned. On Amazon Bedrock the company warns the rollout may take a few extra days.

That is a 13-day slip. The Decoder still calls Opus 4.6 Anthropic's best writing model, ahead of Opus 5.5.

Anthropic calls the mark an "imperceptible pattern in word choice". It adds no characters or tokens, and pricing and request formats stay the same. The method is a variant of Google DeepMind's SynthID text, which nudges the randomness behind word selection so a detector can find a statistical trace.

A watermark that a setting can switch off

The email carries a blunt warning.

"If you rely on the watermark for your own compliance, keep these settings at your defaults."

In the first wave the default-only limit hit two of the four models, Opus 4.6 and Sonnet 4.6. In the second it hits all four. The email does not attach the caveat to Claude Mythos 5 or Claude Opus 4.7, which suggests the mark holds there whatever sampling settings a developer picks. Anthropic runs a detection API in private preview for verifying the mark, and how it treats text produced at other settings is not public.

Temperature, top_p and top_k control how much randomness the model uses when picking words. A small change to any one of them is enough to avoid the mark, which is why the warning is aimed at compliance teams rather than casual users.

For a compliance team, that is a mark with an off switch.

Why the retrofits are happening now

Anthropic points to the EU AI Act's December deadline. Every model released after 2 August 2026 shipped watermarked on day one, and older models are being retrofitted in stages. The mark is embedded at model level, so it travels to every platform that hosts the model. That includes Amazon Web Services, Google Cloud and Microsoft Foundry, and customers cannot turn it off. The sampling loophole sits underneath all of that: a mark nobody can disable at platform level can still be dodged with one parameter.

The company says the watermark contains no information about the user, their organization or their conversations with Claude. It adds no tokens, so bills do not move.

The retrofit is one half of a wider push on provenance. Anthropic also published FlashProve, a research prototype that uses zero-knowledge proofs to show which model produced an output without revealing its weights. It is not deployed. It currently handles contexts of only 1,024 tokens. Anthropic says it hit a September 2026 target for an inference verification prototype through a separate project that signs inference traffic on a trusted server.

The next date is 16 November. The four models in the second wave are due to carry the mark then, with Bedrock possibly a few days behind.