More than 4,500 stars now sit on a single GitHub project whose raison d’être arrived only days after Anthropic said it had switched on imperceptible marks in everything Claude writes.
Guillaume Meyer and the emergence of watermarks-remover
A fast-moving market coalesced almost immediately. At the center is watermarks-remover, an MIT‑licensed tool from software developer Guillaume Meyer, founder of Memo. Meyer's social post announcing the project "surpass[ed] 2 million views" and included the claim that the tool "now supports watermarks from OpenAI and Gemini in addition to Claude." The project began as a Claude-only agent skill and expanded its stated coverage to include Claude, Gemini, SynthID-Text, OpenAI provenance surfaces, and open‑weight models using Kirchenbauer‑style marks.
Other public repositories proliferated alongside it — names in the public record include claude-watermark-cleaner, remove-ai-watermarks, and noai-watermark — and a cluster of newly registered web tools appeared: claudewatermark.com, claudewatermark.rip, gptcleanup.com and claudewatermarkremover.app. Commercial operators added Claude removers to their pitches: StealthGPT updated its use‑case pages, and Human Writes advertises bypassing Turnitin and GPTZero and claims to strip Claude's watermark while carrying a footer that the tool "must only be used in compliance with academic integrity policies."
What the so‑called watermark removers actually do
The vendors and projects in this space perform three different, distinguishable actions — and only some are verifiable.
- They can and do strip hidden characters reliably. Zero‑width characters, bidirectional controls, Unicode tag characters and lookalike spaces can be removed and counted.
- They can and do strip file metadata: signed C2PA metadata, EXIF and XMP across file types including PNG, JPEG, SVG, PDF, DOCX, ODT, HTML and Markdown. The article notes that file metadata is ephemeral in many workflows — it does not survive a re‑save, format conversion, or a screenshot.
- The actual watermark — the one Anthropic says is "woven into the wording" and therefore lives in the model's word choices — is not something these simple cleansers remove. The only known way to defeat that mark is to heavily rewrite the text, typically by running it through a second model; that approach replaces the original model’s word choices with those of the cheaper model, a point Meyer acknowledges in his README and social posts.
Commercial sites are less cautious in their marketing. Several promise "clean, undetectable output," and some score cleaned pages against ordinary AI detectors rather than an Anthropic watermark detector — a detector that Anthropic has not yet published.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAnthropic’s watermarking: scope, limits, and disclosure plans
Anthropic published a support page setting out that text from models launched on or after August 2, 2026 carries an imperceptible watermark at the model level. The mark appears across the API, claude.ai, Claude Code, Claude Cowork and Claude Tag, and through AWS, Google Cloud and Microsoft Foundry. Supported file types receive signed C2PA metadata. The company says the trigger for the change is Article 50 of the EU AI Act, enforceable since August 2, with penalties of up to 15 million euros or 3% of global turnover.
Anthropic cautions that a detected mark indicates content was processed by Claude, not necessarily authored by it, and lists ways a mark disappears — heavy editing, paraphrasing and translation among them. The company also says it will support third‑party detection as the EU transparency rules require and will publish technical documentation later. Until that detector and documentation are public, claims about removing Anthropic’s watermark cannot be checked directly.
Supply‑chain risk: agent skills, artifacts, and unread code
Several of the projects are designed as agent skills that users wire into local pipelines. watermarks-remover, for example, ships as an agent skill installed by symlinking a directory into a local skills folder and is invoked with a slash command. Its optional scoring setup clones a third‑party research repository and pulls a roughly 220MB artifact. BleepingComputer warns it has not audited these tools and that readers should treat them as unvetted code.
The broader pattern is what the article flags as the part that should worry defenders: people can and will mount these tools directly into agent pipelines and feed documents through them. That creates a supply‑chain surface where artifacts, repositories and binaries get executed in production workflows. The article cites the Blue Report 2026 in noting that overall prevention scores can mask what happens after initial access and that defenses measured across 338 million simulations show technique‑by‑technique variability.
What this means for technologists, policymakers, and students
- Technologists and security teams: watch for agent skills and cloned artifacts entering pipelines. The projects are public and readable today, but the article warns the next wave may not be. The practical risk is a supply‑chain vector rather than a simple detector evasion.
- Policymakers and regulators: Anthropic ties the rollout to Article 50 of the EU AI Act and has signaled it will publish detection tooling to meet transparency requirements; until that detector is public, claims of successful removal cannot be independently verified.
- Students and academic institutions: commercial services such as Human Writes explicitly advertise bypassing Turnitin and GPTZero and claim to strip Claude's watermark. One vendor's footer nevertheless reminds users the tool "must only be used in compliance with academic integrity policies." StealthGPT's marketing also carries a caveat: "no tool guarantees 100% bypass, detector models update regularly."
Independent testing has already found gaps: researcher Pasquale Pillitteri cloned several projects and read the code, finding that a popular text cleaner left a hidden payload technique intact and the payload decoded back after the cleaning step. Emad Ghorbaninia summarized some reactions online as viewing watermarking as "a compliance checkbox, not a real defense," a comment Meyer partially endorsed by calling it "pure compliance to stay in the EU market."
The facts on the table are simple and consequential: public tooling is proliferating, some of it only removes metadata and hidden characters, the underlying mark Anthropic described is embedded in word choice and not yet testable by outsiders, and agentized code paths create a supply‑chain surface defenders will need to monitor closely.
