One day after Anthropic filed the registration statement that would open its shares to public investors, it changed the terms on which people are permitted to use the product those investors are being asked to value. The revision, dated October 31, contains two substantive changes. The first forbids using Claude to reverse-engineer or clone existing games. The second extends the company’s text watermark to four models: Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6.
Neither change costs the company revenue in any direct way, and neither is the sort of announcement a company makes in the week it goes public unless it has decided the alternative is worse. What the two clauses have in common is that both answer a question that has been accumulating around the model business for two years: what a vendor does when the most visible use of its product is the reproduction of somebody else’s work.
The game clause follows a practice that spread through hobbyist forums over the past year, in which a user asks the model to rebuild a game that took a studio years and dozens of employees to finish, and receives something playable in a single session. The technical achievement is real, and so is the exposure. A tool that can reproduce a commercial game on request is a tool that a publisher’s lawyers will describe as a machine for making infringing copies, whatever the terms of service say about the user’s responsibility for the output.
Anthropic’s answer is to put the prohibition in the terms rather than in the model. That choice tells you something about where the company thinks the risk sits. A filter that blocks the request would be visible, arguable and easy to test in public. A clause that shifts responsibility to the user is quieter, cheaper, and enforceable mainly against customers who are worth suing.
The watermark is the more mechanical of the two changes and the more interesting one. Anthropic has been marking text generated by some of its models for months, by embedding a statistical signal in the choices the model makes between equally plausible words. The signal is invisible to a reader and detectable by software holding the corresponding key, which is the property that makes it useful to a platform trying to establish that a document came from a machine.
Extending it to four models at once is an admission about the installed base. A watermark that covers one model tells you little about a market in which customers pick among several, and a detector that works on Sonnet but not on Opus is a detector that produces false negatives for exactly the customers who can afford the better model. Coverage, not strength, is what makes the system credible.
The strength is a separate question, and there is evidence that it is not yet settled. Testing on Opus 4.6 and Sonnet 4.6 has shown that adjusting the sampling settings, the parameters that govern how much randomness the model applies when choosing its next word, can still get around the mark. That is not a flaw unique to this system. Any watermark that survives only under default settings is a watermark that a determined user can strip by changing a number in a configuration file, and the users who care about stripping it are the ones who will read the documentation.
Regulators, meanwhile, have made marking a legal requirement rather than a courtesy. The European Union’s artificial intelligence rules impose transparency obligations on providers of general-purpose systems, including marking synthetic content in a machine-readable form, with the obligations applying from August 2026. A company selling into Europe needs a marking method it can describe to a regulator, and describing a method that a sampling change defeats is an awkward conversation.
Anthropic is not the only company facing it. Every major provider has shipped some version of content provenance. All of them share a structural problem: the mark has to be inserted by the party whose output someone might want to disguise. A competitor with no mark, or with a mark that can be removed, gains an advantage in exactly the market where detection matters most.
Which returns the question to the filing. Registration statements require a company to describe the regulatory regime it operates under and the cost of complying with it, and the disclosure regime for generated content is now part of that description. A terms update that lands the day after the filing is not cover for a weakness. It is evidence the company would rather define the mechanism itself than have one defined for it.
The two clauses also share a customer. Game developers are among the largest buyers of model access in the entertainment industry, and a studio deciding whether to build on a vendor’s API will ask what happens when its own assets are reproduced by someone else’s prompt. The prohibition is a sales document as much as a legal one. It tells a publisher that the vendor will take the reputational hit of restricting users rather than leave the publisher to litigate.
None of this is unusual for a company approaching a listing. The weeks before a filing are when obligations get written down, indemnities get clarified and the terms of service stop being a page nobody reads. What is unusual is the compression. Anthropic filed on October 30 and revised the terms on October 31, so the two documents will be read side by side by anyone doing diligence, and the revision will be dated after the risk factors it is meant to address.
The terms apply to new and existing users. The watermark covers four models and not the company’s full line. Testing on two of those models has shown that sampling settings can still defeat the mark, and the European rules that make marking mandatory take effect in August 2026. Those are the facts the next revision will have to answer for.
