A marketplace for eradicating AI watermarks has sprung up days after Anthropic disclosed switching on invisible marks in every part Claude writes, spanning a GitHub mission with over 4,500 stars, a cluster of newly registered net instruments, and not less than one established AI detection evasion service.
Not one of the claims about defeating the textual content watermark can at the moment be checked, although, as a result of Anthropic has not but revealed the way it works or launched the detector that might present whether or not a cleaned doc nonetheless carries the mark.
Who’s providing what
Among the many largest is watermarks-remover, an MIT-licensed instrument from software program developer Guillaume Meyer, founding father of Memo.
It started as a Claude-only agent talent and now advertises protection of Claude, Gemini and SynthID-Textual content, OpenAI provenance surfaces, and open-weight fashions utilizing Kirchenbauer-style marks.
Meyer’s submit on social media rapidly gained momentum surpassing 2 million views:
watermarks-remover now helps watermarks from OpenAI and Gemini along with Claude.https://t.co/OxSdnAjEGe
— Guillaume Meyer (@guillaumemeyer) August 11, 2026
Alongside it sit repositories together with claude-watermark-cleaner, remove-ai-watermarks, and noai-watermark, plus a cluster of net instruments which have appeared since: claudewatermark.com, claudewatermark.rip, gptcleanup.com and claudewatermarkremover.app.
StealthGPT, which sells AI detection evasion, added a Claude watermark remover to its use-case pages. One other, Human Writes, advertises bypassing Turnitin and GPTZero on essays and assignments, claims to strip Claude’s watermark, and carries a footer telling customers it should solely be utilized in compliance with educational integrity insurance policies.
StealthGPT’s personal comparability desk caveats that “no instrument ensures 100% bypass, detector fashions replace commonly,” on the identical web page the place it publicizes it now removes Claude watermarks.
What ‘watermark removers’ really do
The instruments do three various things, and solely a few of it’s verifiable.
Stripping hidden characters from textual content works and could be counted: zero-width characters, bidirectional controls, Unicode tag characters and lookalike areas.
Stripping C2PA, EXIF and XMP metadata from information works too, throughout PNG, JPEG, SVG, PDF, DOCX, ODT, HTML and Markdown. That’s the half that touches Anthropic’s signed provenance knowledge instantly, and it is usually not a lot of an achievement. File metadata doesn’t survive a re-save, a format conversion or a screenshot anyway.
The onerous half is the watermark itself. It doesn’t reside in hidden characters.
The watermark lives in which phrases the mannequin picked, which suggests the one recognized solution to take away it’s to rewrite the textual content closely, utilizing a second mannequin.
Meyer is unusually candid about this, posting on Wednesday that his instrument removes metadata just for now, and that stripping the precise marks might come later however shouldn’t be accessible in the present day. His README goes additional, arguing {that a} rewrite swaps the unique mannequin’s phrase selections for the cheaper mannequin’s, and asking why anybody paying for a premium mannequin would then run its output by way of a worse one.
The industrial websites are much less cautious. A number of promise clear, undetectable output, and the scores a few of them return are measured in opposition to odd AI detectors somewhat than in opposition to Anthropic’s watermark, for which no public detector exists.
Impartial testing has already discovered gaps.
Pasquale Pillitteri cloned the main projects and browse the code somewhat than the READMEs, discovering that one well-liked textual content cleaner let the commonest hidden-payload method by way of untouched. The hidden payload decoded again intact after the instrument had supposedly cleaned the textual content.
Why Claude is marking textual content in any respect
Anthropic published a support page this week setting out its method.
Textual content from fashions launched on or after August 2, 2026 carries an imperceptible watermark woven into the wording.
Supported file sorts get signed C2PA metadata. Marking is utilized on the mannequin stage, so it seems throughout the API, claude.ai, Claude Code, Claude Cowork and Claude Tag, and thru AWS, Google Cloud and Microsoft Foundry.
The set off is Article 50 of the EU AI Act, enforceable since August 2, with penalties reaching 15 million euros or 3% of worldwide turnover.
A detected mark additionally means lower than it seems to. Anthropic acknowledges that it signifies content material was processed by Claude, not essentially written by it.
Run your personal prose by way of the mannequin for a grammar cross, a translation or a abstract and the output comes again marked.
Anthropic’s web page additionally lists the methods a mark disappears, together with heavy modifying, paraphrasing and translation.
The corporate says it should help third-party detection because the EU transparency guidelines require and can publish technical documentation later.
The response on-line has been much less charitable.
Responding to Meyer’s submit, one person, Emad Ghorbaninia, referred to as watermarking a “compliance checkbox, not an actual protection.” Meyer agreed on the primary half, replying that it’s “pure compliance to remain within the EU market.”
Ghorbaninia’s stronger declare, {that a} single instrument strips provenance marks from three distributors in a single cross, doesn’t survive contact with the repository, which says the other.
The half that ought to fear defenders
watermarks-remover ships as an agent skill, put in by symlinking a listing into a neighborhood abilities folder and invoked with a slash command. Its elective scoring setup clones a third-party analysis repository and pulls a roughly 220MB artifact.
Notice: BleepingComputer has not audited or examined any of the instruments named on this article. Readers ought to deal with them with the identical warning as some other unvetted code from the web.
That’s the sample price watching.
Regardless of the deserves of the underlying argument about provenance and privateness, a fast-moving class of instruments that individuals wire instantly into agent pipelines, after which feed their paperwork by way of, is a provide chain floor.
The tasks at the moment within the house are not less than open and readable, even the place they ship no licence in any respect.
The subsequent wave, arriving right into a market with over 4 thousand stars of confirmed demand and no method for consumers to confirm any declare, will not be.
General prevention scores can disguise what occurs after preliminary entry. As soon as attackers are utilizing legitimate credentials, prevention drops sharply.
The Blue Report 2026 measures defenses method by method throughout 338 million simulations run in buyer manufacturing environments.
