Three more Claude models started watermarking their text on 3 Nov, and Grok’s API follows on 7 Nov. The rest of the week circles the same question: who made this, and can you prove it?
I read the release notes, docs, model card, paper and blog posts behind each story. I did not run FlashProve, the Kimi weights, SWE-2 Flash or any watermark detector. Everything below is what the companies say, linked at the source.
💧 Is your Claude text already watermarked?
Claude: three more models, nothing to switch on
Anthropic’s release notes say that from 3 Nov 2026, text from Claude Mythos 5, Claude Opus 4.7 and Claude Sonnet 4.6 carries Anthropic’s text watermark. Newer models like Fable 5.1 and Mythos 5.1 already had it.
The watermark docs say it “doesn’t change the meaning, quality, or readability”, adds no tokens or hidden characters and carries nothing about you or your organization. No request changes needed.
The catch is on Sonnet 4.6. Requests that set temperature, top_p or top_k to a non-default value might not carry the mark. If you rely on it, Anthropic says to omit all three, including any a framework sets for you.
Per the Help Center, it applies worldwide across the API, Claude apps, Claude Code, Claude Cowork and Claude Tag, plus AWS, Google Cloud and Microsoft Foundry (Bedrock done by 10 Nov). Files get C2PA Content Credentials where supported. The mark travels with copy and paste and “may persist through some editing”.
Detection is gated: a private preview for eligible organizations such as regulators, media, fact-checkers and researchers, plus enterprises checking their own outputs. Ordinary users can’t check text. I found no documented opt-out on Anthropic’s pages.
The EU angle is explicit. Anthropic says it signed the EU AI Act’s Article 50(2) Code of Practice on marking AI-generated content, and the law gives models launched before 2 Aug 2026 a transition period. That is why older models are getting the mark now.
Grok: on by default from 7 Nov
xAI’s Output Watermarking docs, now appearing under the name SpaceXSI, say that starting 7 Nov 2026 text from grok-4.7, grok-4.6, grok-4.5, grok-4.3, grok-4.20-reasoning, grok-4.20-non-reasoning and grok-4.20-multi-agent is watermarked by default to comply with the EU AI Act. That holds on every endpoint, global api.x.ai and regional. Not EU only.
It covers the Responses API and Chat Completions, tool call arguments included, so your JSON gets marked too. Token choice is shaped slightly during generation. Detection is statistical, and longer text gives a stronger signal. Detection API access is by application.
Every response carries an x-watermark header (true means watermarked). Team admins can opt out per model in the Console, applying within 5 minutes to every key on the team. Opting out means confirming that a legal exception covers your use, and some models may be locked on.
My take: this is a nudge on word choice, not a hidden character, so stripping Unicode won’t remove it. But both labs gate detection and neither publishes a false positive rate on these pages. Builders: log x-watermark and check what your SDK sets for temperature on Sonnet 4.6. Teachers and editors still can’t run a detector.
🔏 Can a lab prove which model answered you?
Anthropic open-sourced FlashProve on 2 Nov 2026. The problem: when you call a hosted model, you can’t check that the provider served the model it claims and not a cheaper or altered one, because the weights are secret.
The provider publishes a 32-byte fingerprint (“commitment ID”) of one exact set of weights. For each reply its GPU produces a proof that the reply came from that model. Anyone can check it on an ordinary CPU in seconds with cp_verify, without the weights. It’s zero knowledge: the weights stay secret, the architecture doesn’t.
Anthropic’s numbers: Llama 4 Maverick (400B-parameter MoE, 4-bit quantization, about 232 GB) at full size on a single NVIDIA H100, 1,024-token context. About 110 tokens per second of prefill at 24 requests per batch. A proof is about 19 MB per 1,024-token request, checked in seconds on a 24-core CPU. The bill is about 70 to 95 times the GPU time vLLM needs for prompts of the same length.
The paper is careful. Protocol soundness is proved in Lean 4, as in the 3-SAT work we covered, but not the C++/CUDA programs. That they hide the weights is “our judgement, not a proof”. Side channels are out of scope, and the proofs concern a quantized integer model under greedy decoding.
The repo is an Apache 2.0 research prototype. Anthropic states no plan to run it on Claude.
My take: a watermark answers “did an AI write this?”. FlashProve answers “which model wrote this?”. The overhead keeps it in the lab for now, but it’s a concrete next step after the formal verification work in our 19 to 25 Oct weekly.
🧱 Kimi K3.1 Pro weights are out. Who can actually run them?
When we covered the launch in the 19 to 25 Oct weekly, the weights were only promised. Around 4 Nov they reached Hugging Face.
Moonshot’s model card describes a natively multimodal agentic MoE: 2.8T total parameters, 104B activated, 896 experts with 16 per token and a 1,048,576-token context. Weights are MXFP4 from quantization-aware training. The license is a bespoke “Kimi K3.1 Pro License”, not Apache 2.0 or MIT. The API is on platform.kimi.ai (kimi-k3.1-pro) with OpenAI and Anthropic compatible endpoints.
Scores are Moonshot’s own: Terminal-Bench 4.0 65.7 (Claude Opus 5.5 66.4 in the same table), BrowseComp 92.1, GPQA-Diamond 94.2 and ExploitBench 74.7 (GPT-6 Astra 100). Many ran on the Claude Code harness and several rows are internal benchmarks.
Agent builders, note this: in multi-turn and tool calls you must pass the full assistant message back, reasoning_content and tool_calls included. Reasoning effort is low, high or max.
vLLM’s day-0 post adds support on NVIDIA, AMD, Google TPU and Alibaba T-Head chips, with up to 375.9 tok/s per user on GB300 and 815.6 on Rubin, by vLLM’s numbers.
My take: “open weights” at 2.8T means open for whoever has a rack of GB300s. As with Meituan’s LongCat 2.5, read the card slowly, and read the license before you build on it.
| What it is | Key number | Can you get it? | |
|---|---|---|---|
| Claude watermark | Invisible mark in text | Now on Mythos 5, Opus 4.7, Sonnet 4.6 | On by default, detector gated |
| Grok watermark | Invisible mark in API text | 7 models from 7 Nov | On by default, admins can opt out |
| FlashProve | Proof of which model answered | about 19 MB proof, CPU check in seconds | Yes, Apache 2.0 prototype |
| Kimi K3.1 Pro | 2.8T MoE, 104B active | Terminal-Bench 4.0 65.7 (self-reported) | Weights on HF, custom license |
| SWE-2 Flash | Coding model, 12B active | 3x faster, one-fifth the price of SWE-2 | In Devin, weights partner-only |
⚡ Why is Cognition keeping SWE-2 Flash weights back?
Cognition launched SWE-2 Flash on 4 Nov, calling it “a fully American coding model”. It’s 276B total, 12B active, built on Inkling-Small from Thinking Machines, and it’s the first time Cognition added a mid-training stage (a few trillion tokens) before reinforcement learning.
By Cognition’s numbers, that moved Terminal-Bench 4.0 from 0.9% on the base model to 20.0% and FrontierCode 2.0 from 3.2% to 24.0%. ExploitBench rose from 11.3% to 34.8%, since they trained for defensive cyber work. Cognition claims it beats all American open-weight models on its evals, though its own table has Claude Haiku 5.5 ahead on Terminal-Bench 4.0 (39.2) and FrontierCode 2.0 (27.7).
It’s in Devin Desktop and the CLI at one-fifth the price and 3x the speed of SWE-2, about 200 vs 60 tok/s in their demo. No per-token price on the page.
The weights stay private, because the same cyber skills help attackers. Cognition is “building a program to securely share the weights with trusted industry partners and research labs. More on this in a few weeks.”
My take: one lab ships 2.8T weights to everyone. Another holds back a 12B-active model over ExploitBench. The cyber question now decides what “open” means.
🌳 Why does OpenAI want Pierre?
OpenAI will acquire Pierre Computer Company, it said on 4 Nov. Pierre makes Code Storage (Git-based storage for code and its history) and the open-source Trees and Diffs libraries that already power file browsing and change review in the Codex app.
OpenAI says the open-source projects stay open source and Code Storage customers can keep using it after closing. The deal needs regulatory approval and terms weren’t disclosed. Earlier that week OpenAI described Pando, its in-house source control backend for engineers and agents.
My take: Git was built for humans making a few branches. Agents make hundreds in parallel. OpenAI is buying the review layer, which is where the human still sits. Same direction as the agent monitoring story in Monday’s digest.
What I’m watching next
- Who gets watermark detection access, and whether false positive rates get published.
- The Bedrock watermark rollout, due by 10 Nov.
- Tencent Hy4 weights and system card, promised “in the coming days” in Tencent’s 4 Nov post.
- Cognition’s weight-sharing program, “in a few weeks”.
- The Pierre deal closing.
Sources
- Claude release notes
- Claude text watermark docs
- Claude Help Center: How Claude marks AI-generated content
- xAI docs: Output Watermarking
- Anthropic: FlashProve research post
- FlashProve repo
- FlashProve paper (PDF)
- Kimi K3.1 Pro model card
- vLLM: Kimi K3.1 Pro day-0 support
- Cognition: SWE-2 Flash
- OpenAI to acquire Pierre
- Tencent launches Hy4
