A new market for tools claiming to remove AI-generated watermarks has emerged following Anthropic's recent announcement that its Claude models now embed invisible watermarks in all generated text. These tools include a GitHub project with over 4,500 stars, several recently registered web services, and an established AI detection evasion service. However, the efficacy of these tools in defeating Anthropic's text watermarks cannot currently be verified, as Anthropic has not yet released technical details of its watermarking method or a public detector.
Anthropic confirmed this week that text from models launched on or after August 2, 2026, incorporates an imperceptible watermark into the wording. Additionally, supported file types receive signed C2PA metadata. This marking is applied at the model level, affecting output across the API, claude.ai, Claude Code, Claude Cowork, Claude Tag, and integrations with AWS, Google Cloud, and Microsoft Foundry. The company stated that this initiative is in response to Article 50 of the EU AI Act, which became enforceable on August 2, carrying potential penalties up to 15 million euros or 3% of global turnover.
Among the most prominent "watermark removers" is "watermarks-remover," an MIT-licensed tool developed by Guillaume Meyer, founder of Memo. Initially designed for Claude, it now claims to support watermarks from Claude, Gemini, SynthID-Text, OpenAI provenance surfaces, and open-weight models using Kirchenbauer-style marks. Meyer's social media post announcing expanded support quickly garnered over 2 million views. Other GitHub repositories include "claude-watermark-cleaner," "remove-ai-watermarks," and "noai-watermark." New web tools such as claudewatermark.com, claudewatermark.rip, gptcleanup.com, and claudewatermarkremover.app have also appeared. StealthGPT, a service specializing in AI detection evasion, has added a Claude watermark remover to its offerings, while Human Writes claims to strip Claude's watermark in addition to bypassing Turnitin and GPTZero.
The tools generally perform three types of actions. They can strip hidden characters from text, such as zero-width characters, bidirectional controls, Unicode tag characters, and lookalike spaces. They also remove C2PA, EXIF, and XMP metadata from files including PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, and Markdown. While these actions are verifiable, file metadata is easily lost through re-saving, format conversion, or screenshots, making its removal a less significant achievement.
The core challenge lies in removing the watermark itself, which is embedded in the model's word choices, not in hidden characters. The only known method to remove such a watermark is to substantially rewrite the text, typically using a second AI model. Meyer has been transparent about this limitation, stating that his tool currently only removes metadata and that actual watermark stripping may be implemented later. His README further questions the utility of running premium model output through a "worse" model for rewriting.
In contrast, some commercial sites are less forthcoming, promising "clean, undetectable output." Their reported scores are often measured against general AI detectors rather than against Anthropic's specific watermark, for which no public detector is available. Independent analysis by Pasquale Pillitteri, who examined the code of popular text cleaners, revealed that one tool failed to remove a common hidden-payload technique, allowing the payload to decode intact after supposed cleaning.
Anthropic's support page clarifies that a detected mark indicates content was processed by Claude, not necessarily written by it. Running existing human-written text through Claude for grammar checks, translation, or summarization will result in marked output. The company also acknowledges that heavy editing, paraphrasing, and translation can cause the watermark to disappear. Anthropic has committed to supporting third-party detection as required by EU transparency rules and plans to release technical documentation in the future.
The online reaction to watermarking has been mixed. Emad Ghorbaninia characterized watermarking as a "compliance checkbox, not a real defense," a sentiment echoed by Meyer, who described it as "pure compliance to stay in the EU market." The "watermarks-remover" tool is distributed as an agent skill, installed by symlinking a directory and invoked with a slash command. Its optional scoring setup clones a third-party research repository and pulls a 220MB artifact. This pattern of tools being directly integrated into agent pipelines and used to process documents raises concerns about potential supply chain vulnerabilities.
