Anthropic watermark loophole found on two older Claude models

What happened

Anthropic is extending its text watermark to four more Claude models, but developers can still bypass it on two of the older ones. According to The Decoder, the affected models are Claude Opus 4.6 and Sonnet 4.6, and the workaround involves changing a single sampling parameter.

The expansion is aimed at meeting the EU AI Act's December deadline. Rather than closing the gap on the older models with a technical change, Anthropic has addressed the loophole with a compliance warning, as the report describes it.

The story sits at the intersection of AI governance and product design. It shows how a watermarking commitment can be only as strong as the weakest model version still in use.

Why it matters

Watermarking is one of the few provenance tools available to organisations that want to show whether AI-generated text came from a given system. When a mark can be removed through a routine configuration change, its value as a verification signal weakens for every party relying on it, from regulators to enterprise customers building downstream products.

For leaders deploying AI in service channels, the lesson is operational. Model estates are rarely uniform, and older versions often remain in production long after newer ones launch. Governance needs to cover which model versions are live, how their parameters are set, and whether controls behave the same across all of them.

By the numbers

• Four additional Claude models are included in the watermark expansion.
• Two older models, Claude Opus 4.6 and Sonnet 4.6, are reported to be bypassable.
• One sampling parameter is all that is needed to circumvent the watermark on those models.

The Renascence take

Most readers will focus on the regulatory deadline and miss the design lesson. A compliance warning is a disclosure, and disclosures depend on someone reading them at the right moment, which is a weak control in a fast-moving developer environment.

Defaults shape behaviour far more than warnings do, so a safeguard that can be switched off with one setting is not really a safeguard for most teams. Customer-obsessed operators should treat provenance as a product requirement, not a checkbox: audit which model versions and parameter settings sit in production, and make the compliant configuration the path of least resistance. If your AI service depends on a mark that anyone can remove, you have a trust problem wearing a compliance badge.