Viral Open-Source Tool Strips Claude’s Invisible AI Watermarks Just Hours After Anthropic’s Announcement

Just four hours after Anthropic confirmed it would embed invisible, machine-readable watermarks into all AI-generated content from its Claude models globally, developer Guillaume Meyer released a working workaround to remove the markers. His open-source code for stripping watermarks from Claude output has since gone viral across developer platforms, earning more than 20,000 bookmarks on X, drawing over 100 independent contributors, and being integrated into countless third-party projects.

“Anthropic is embedding watermarks in its Claude texts … the issue is practically history just one day later,” one AI specialist wrote of the tool, sharing an image of Meyer breaking free of chains while standing on crumpled EU and Anthropic flags.

Meyer and other developers began reverse-engineering Claude’s watermarking system shortly after Anthropic announced the change last week, a rollout the company framed as a compliance measure for the European Union’s AI Act. Speaking to WIRED, Meyer explained that motivations for evading watermarking split across two camps: some users oppose the requirement that all AI-generated content be labeled by default, while many others—including himself—are simply motivated by the technical challenge of cracking the system. He added that freelance content writers and social media creators have already reached out to him asking for support to use the code.

The EU AI Act’s new rules, which went into effect earlier this month, mandate that major model providers like Anthropic and OpenAI tag all synthetic audio, image, video, and text content so machines can identify it as AI-generated. Companies that fail to comply face fines of up to 3% of annual global turnover. While the rules prohibit AI providers from marketing circumvention tools, there is no legal ban on independent tools built by outside developers.

“I'm not against transparency, and I'm all for content attribution,” Meyer said. “I just think watermarking in itself is a really bad solution, because it has major drawbacks and risks.”

A native French speaker who regularly uses Claude and AI editing tools like Grammarly to polish his writing, Meyer is particularly concerned about the risk of false positives. Even Anthropic admits its watermark only produces a probability score that text was generated or edited by Claude, and he warns this probabilistic data could lead to serious harm: employers might unfairly reject job candidates whose work gets flagged, or researchers could face unsubstantiated accusations of improper AI use over a false positive result.

Anthropic’s invisible watermarking works by embedding a subtle pattern in Claude’s word and phrase choices that is undetectable to humans but can be spotted by purpose-built detection tools. Because the system alters Claude’s output selection, some users worry it will degrade response quality, though Anthropic insists this is not the case.

The technique Anthropic uses, called SynthID, was originally developed by Google, which has deployed it on its own AI-generated content since 2023. Computer scientist Scott Aaronson proposed a similar method during his tenure at OpenAI, but says the company never deployed it over concerns that watermarking would drive customers away from its products.

Meyer’s removal method works by feeding Claude’s watermarked output into a second, non-watermarking large language model, which generates multiple paraphrased versions of the text that swap in synonyms and slightly restructure content to break the original watermark pattern. The workaround does rely on access to unwatermarked LLMs, however—and that access may not last long term: 190 major AI providers, including OpenAI, Microsoft, and Meta, have signed the EU’s AI transparency code of practice. All new models released starting in August are required to include watermarks, and existing models must add the feature by December, so it remains to be seen how many major providers will forgo watermarking long term.

While there is no definitive proof the tool works until Anthropic releases its official detection software, experts are confident the method is effective based on public knowledge of the SynthID-text system that powers Claude’s watermarking. Wayne Pan, CTO and co-founder of Silicon Valley-based sovereign AI startup Haimaker, has already integrated Meyer’s open-source tool into his platform. Pan shares Meyer’s criticisms: he opposes watermarking content that was only lightly edited by Claude, and disagrees that watermarks should be invisible to end users.

Meyer’s tool is not the only circumvention method to emerge in recent days. Software engineer Erik Hughes built a working removal tool in just 15 minutes using Claude itself; his tool strips invisible duplicate characters, reorders sentences within paragraphs, and swaps common words for synonyms to break the watermark pattern. Leon Chlon, a Visiting Fellow at the University of Oxford, notes watermarks can also be eliminated by condensing Claude’s output, translating it to a semantically distinct language like Arabic, then translating it back to the original language. Even Anthropic has acknowledged that heavily edited, paraphrased, or translated content may not retain the original watermark.

In a statement to WIRED, an Anthropic spokesperson said: "We're adding marking to Claude's output to comply with the EU AI Act, and other labs are taking similar steps. It’s hard to identify AI-generated text, and this gives people better tools for identification. Text from supported Claude models, including output from Claude Code, will carry an invisible watermark, and it doesn't change the meaning, quality, or readability of Claude's responses. We also plan to ship a text-detection API so users can do more of this themselves.”

Anthropic says it is finalizing its watermark detection system and plans to release an official detection tool soon—at which point developers will finally be able to test how foolproof their circumvention methods really are. The company is also continuing to refine its watermarking technology.

Still, Pan argues that no unbeatable watermark can ever exist. “I think they wanted to show that they're in good faith doing it,” Pan said. “but I don't think you can ever have a watermark that will withstand everything.”