A market for removing AI watermarks has sprung up days after Anthropic disclosed switching on invisible marks in everything Claude writes, spanning a GitHub project with over 4,500 stars, a cluster of newly registered web tools, and at least one established AI detection evasion service.
None of the claims about defeating the text watermark can currently be checked, though, because Anthropic has not yet published how it works or released the detector that would show whether a cleaned document still carries the mark.
Who is offering what
Among the largest is watermarks-remover, an MIT-licensed tool from software developer Guillaume Meyer, founder of Memo.
It began as a Claude-only agent skill and now advertises coverage of Claude, Gemini and SynthID-Text, OpenAI provenance surfaces, and open-weight models using Kirchenbauer-style marks.
Meyer’s post on social media quickly gained momentum surpassing 2 million views:
watermarks-remover now supports watermarks from OpenAI and Gemini in addition to Claude.https://t.co/OxSdnAjEGe
— Guillaume Meyer (@guillaumemeyer) August 11, 2026
Alongside it sit repositories including claude-watermark-cleaner, remove-ai-watermarks, and noai-watermark, plus a cluster of web tools that have appeared since: claudewatermark.com, claudewatermark.rip, gptcleanup.com and claudewatermarkremover.app.
StealthGPT, which sells AI detection evasion, added a Claude watermark remover to its use-case pages. Another, Human Writes, advertises bypassing Turnitin and GPTZero on essays and assignments, claims to strip Claude’s watermark, and carries a footer telling users it must only be used in compliance with academic integrity policies.
StealthGPT’s own comparison table caveats that “no tool guarantees 100% bypass, detector models update regularly,” on the same page where it announces it now removes Claude watermarks.
What ‘watermark removers’ actually do
The tools do three different things, and only some of it is verifiable.
Stripping hidden characters from text works and can be counted: zero-width characters, bidirectional controls, Unicode tag characters and lookalike spaces.
Stripping C2PA, EXIF and XMP metadata from files works too, across PNG, JPEG, SVG, PDF, DOCX, ODT, HTML and Markdown. That is the part that touches Anthropic’s signed provenance data directly, and it is also not much of an achievement. File metadata does not survive a re-save, a format conversion or a screenshot anyway.
The hard part is the watermark itself. It does not live in hidden characters.
The watermark lives in which words the model picked, which means the only known way to remove it is to rewrite the text heavily, using a second model.
Meyer is unusually candid about this, posting on Wednesday that his tool removes metadata only for now, and that stripping the actual marks may come later but is not available today. His README goes further, arguing that a rewrite swaps the original model’s word choices for the cheaper model’s, and asking why anyone paying for a premium model would then run its output through a worse one.
The commercial sites are less careful. Several promise clean, undetectable output, and the scores some of them return are measured against ordinary AI detectors rather than against Anthropic’s watermark, for which no public detector exists.
Independent testing has already found gaps.
Pasquale Pillitteri cloned the main projects and read the code rather than the READMEs, finding that one popular text cleaner let the most common hidden-payload technique through untouched. The hidden payload decoded back intact after the tool had supposedly cleaned the text.
Why Claude is marking text at all
Anthropic published a support page this week setting out its approach.
Text from models launched on or after August 2, 2026 carries an imperceptible watermark woven into the wording.
Supported file types get signed C2PA metadata. Marking is applied at the model level, so it appears across the API, claude.ai, Claude Code, Claude Cowork and Claude Tag, and through AWS, Google Cloud and Microsoft Foundry.
The trigger is Article 50 of the EU AI Act, enforceable since August 2, with penalties reaching 15 million euros or 3% of global turnover.
A detected mark also means less than it appears to. Anthropic acknowledges that it indicates content was processed by Claude, not necessarily written by it.
Run your own prose through the model for a grammar pass, a translation or a summary and the output comes back marked.
Anthropic’s page also lists the ways a mark disappears, including heavy editing, paraphrasing and translation.
The company says it will support third-party detection as the EU transparency rules require and will publish technical documentation later.
The reaction online has been less charitable.
Responding to Meyer’s post, one user, Emad Ghorbaninia, called watermarking a “compliance checkbox, not a real defense.” Meyer agreed on the first half, replying that it is “pure compliance to stay in the EU market.”
Ghorbaninia’s stronger claim, that a single tool strips provenance marks from three vendors in one pass, does not survive contact with the repository, which says the opposite.
The part that should worry defenders
watermarks-remover ships as an agent skill, installed by symlinking a directory into a local skills folder and invoked with a slash command. Its optional scoring setup clones a third-party research repository and pulls a roughly 220MB artifact.
Note: BleepingComputer has not audited or tested any of the tools named in this article. Readers should treat them with the same caution as any other unvetted code from the internet.
That is the pattern worth watching.
Whatever the merits of the underlying argument about provenance and privacy, a fast-moving category of tools that people wire directly into agent pipelines, and then feed their documents through, is a supply chain surface.
The projects currently in the space are at least open and readable, even where they ship no licence at all.
The next wave, arriving into a market with over four thousand stars of proven demand and no way for buyers to verify any claim, may not be.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
