Since August 2, 2026, Anthropic has been attaching an invisible, machine-readable watermark to every Claude output worldwide. The trigger is Article 50 of the EU AI Act, which requires labeling AI-generated content as of that date. What Anthropic frames as a contribution to transparency triggered a counter-movement within hours: several freely available tools now circulate on GitHub claiming to strip exactly that watermark back out, the most prominent one with more than 15,000 stars.
Key takeaways
- Anthropic has marked Claude outputs since August 2, 2026 with an invisible watermark based on statistical patterns in word choice, with no visible quality loss.
- Paris-based developer Guillaume Meyer released the best-known countermeasure, Watermarks Remover, on GitHub; it now has more than 15,000 stars and roughly 1,700 forks, and has since been extended to Claude, Gemini, and other watermarking systems.
- Security experts warn that many of these tools currently only strip metadata, while the actual watermark lives in word choice and would require substantially rewriting the text.
- A test by security researcher Pasquale Pillitteri found that a popular removal tool let hidden malicious payloads pass through unchanged, an added security risk beyond the watermark question itself.
- Violations of the underlying EU labeling requirement can carry fines of up to 15 million euros or 3 percent of global annual revenue.
Why Anthropic started marking text at all
By Anthropic’s own description, its watermark works in an intentionally subtle way: whenever multiple words would fit equally well, the model consistently leans toward one of them. Across many sentences, that produces a statistical pattern a machine can detect, without inserting extra characters or noticeably hurting quality for readers. The trigger was Article 50 of the EU AI Act, which has required identifiable labeling of AI-generated content since August 2, 2026. Anthropic rolled out its watermark right on the deadline and officially frames it as evidence that a text was “processed” by Claude, explicitly not as a guarantee that the AI wrote the entire thing. That careful phrasing leaves the company deliberate room to maneuver: heavily edited, summarized, or translated text can lose the watermark entirely, according to Anthropic itself.
The arms race: how fast the tools arrived
The developer community’s response didn’t take long. Within hours of Anthropic’s announcement, the first counter-tools appeared on GitHub. The fastest and most successful was Guillaume Meyer, founder of the Paris-based startup Memo: his project Watermarks Remover analyzes watermark-free reference text and iteratively swaps words for synonyms in suspicious passages to blur the statistical pattern. A tweet Meyer posted on August 11 crossed two million views within a short time, and the project briefly gained about 72 new GitHub stars a day. Other projects followed in parallel, including claude-watermark-cleaner by developer mikiane, plus commercial offerings like claudewatermark.com and gptcleanup.com. Oxford researcher Leon Chlon is also working on an alternative approach using back-translation. Meyer himself told Wired that he isn’t against transparency, quite the opposite, he says he actually favors real content attribution, but considers an invisible watermark “the wrong answer to a real problem” because it treats authorship as a purely binary question.
Do the tools actually work?
A closer look shows a mixed track record for these removal tools. Meyer himself admits that his first version essentially only strips hidden metadata and special characters, leaving the actual pattern encoded in word choice untouched for now, which would require deeply rewriting the entire text to remove. Security researcher Pasquale Pillitteri tested several tools and found a further problem: one popular removal tool let hidden malicious payloads pass through the text unchanged, a security risk that goes well beyond the watermark question itself. A researcher at ETH Zurich also voiced skepticism about the whole approach, though in both directions: there will always be ways to remove a watermark, in his assessment, which cuts against both Anthropic’s method and the expectations of critics who consider watermarking a particularly effective solution.
What this means for EU regulation
For European regulators, this is a setback before the labeling requirement has even properly gotten underway. Violations of Article 50 can carry fines of up to 15 million euros or 3 percent of global annual revenue, but the rule’s effectiveness ultimately depends on the technical robustness of the labeling itself, and that’s exactly what’s now in question. Developer Sabrina Ramonov summed up much of the criticism: AI watermarks mainly punish ordinary users, not the actual bad actors who go looking for workarounds anyway. We saw a similar tension play out in our coverage of Anthropic’s secret Model 2, where the company also struggled to balance transparency against competitive pressure. Whether Anthropic improves the technology or leans on the inherent bypassability of watermarks as an explanation will likely become clear once the first cases under the new EU rule actually reach regulators. Until then, the labeling requirement remains mostly one thing: an arms race between providers and a developer community that reacts within hours.