AI Watermark 'Removers' Multiply Despite Unverifiable Claims

Days after Anthropic revealed it had quietly switched on invisible watermarking for all Claude-generated text, a cottage industry of supposed countermeasures has materialized online. A GitHub project has racked up over 4,500 stars, a cluster of new web tools has appeared, and at least one established AI-detection-evasion service has pivoted to advertise Claude watermark removal.

But none of these claims can currently be checked, because Anthropic has not yet published the technical details of its watermark or released the detector tool that would prove whether a cleaned document still carries the mark.

What the market looks like

The most prominent offering is watermarks-remover, an MIT-licensed tool by software developer Guillaume Meyer, founder of Memo. Meyer's project began as a Claude-only agent skill but now advertises support for Claude, Gemini and SynthID-Text, OpenAI provenance surfaces, and open-weight models using Kirchenbauer-style marks. His social media announcement of the expansion went viral, surpassing 2 million views.

Alongside his repository sit several other projects with similar goals: claude-watermark-cleaner, remove-ai-watermarks, and noai-watermark. A cluster of domain names has also sprung up — claudewatermark.com, claudewatermark.rip, gptcleanup.com, and claudewatermarkremover.app — all purporting to offer similar services.

StealthGPT, a service that sells AI detection evasion, has added a Claude watermark remover to its use-case pages. Another service, Human Writes, advertises bypassing academic-integrity tools like Turnitin and GPTZero on essays and assignments, claims to strip Claude's watermark, and carries a footer stating it must only be used in compliance with academic integrity policies.

What these tools actually do

The reality behind these tools is more varied than their marketing suggests. The methods fall into three buckets, only some of which are verifiable.

First, there's stripping hidden characters from text — a technique that works and can be counted. These tools remove zero-width characters, bidirectional controls, Unicode tag characters, and lookalike spaces. This is straightforward and effective, but it only addresses one part of the watermarking scheme.

Second, there's stripping metadata. Tools can remove C2PA, EXIF, and XMP metadata from files across PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, and Markdown formats. This touches Anthropic's signed provenance data directly, but it's also not much of an achievement — file metadata doesn't survive a re-save, a format conversion, or a screenshot anyway.

Third is the hard part: the watermark itself. The watermark doesn't live in hidden characters. It lives in which words the model picked, which means the only known way to remove it is to rewrite the text heavily using a second model. That's a computationally expensive and semantically risky approach.

Honesty from one developer

Meyer is unusually candid about the limitations of his own tool. He posted on Wednesday that his tool removes metadata only for now, and that stripping the actual marks may come later but is not available today. His README goes further, arguing that a rewrite swaps the original model's word choices for the cheaper model's, and asking why anyone paying for a premium model would then run its output through a worse one.

Meyer's project also links to a research paper on Kirchenbauer-style marks, which describes a specific watermarking technique used by some open-weight models. The README's honesty stands in contrast to the commercial sites, which are less careful. Several promise clean, undetectable output, and the scores some of them return are measured against ordinary AI detectors rather than against Anthropic's watermark — for which no public detector exists.

Independent testing finds gaps

Independent testing has already found gaps in these tools' claims. Pasquale Pillitteri cloned the main projects and read the code rather than the READMEs, finding that one popular text cleaner let the most common hidden-payload technique through untouched. The hidden payload decoded back intact after the tool had supposedly cleaned the text.

This suggests that at least some of these tools are doing little more than cosmetic cleaning, and that their marketing overstates their effectiveness. Without a detector to test against, users have no way to verify whether the watermark has actually been removed.

Why Claude is marking text

Anthropic's own support page explains the rationale behind the watermark. Text from models launched on or after August 2, 2026 carries an imperceptible watermark woven into the wording. Supported file types get signed C2PA metadata. Marking is applied at the model level, so it appears across the API, claude.ai, Claude Code, Claude Cowork, and Claude Tag, and through AWS, Google Cloud, and Microsoft Foundry.

The trigger is Article 50 of the EU AI Act, enforceable since August 2, with penalties reaching 15 million euros or 3% of global turnover.

Anthropic also notes that a detected mark doesn't necessarily mean the text was written by Claude. It only indicates that the content was processed by Claude, which could include grammar checking, translation, or summarization. The company says it will support third-party detection as the EU transparency rules require, and will publish technical documentation later.

Anthropic's page also lists the ways a mark disappears, including heavy editing, paraphrasing, and translation — which aligns with the fundamental difficulty of removing a watermark that's embedded in word choice.

The reaction online

The online reaction has been skeptical. Responding to Meyer's post, one user, Emad Ghorbaninia, called watermarking a "compliance checkbox, not a real defense." Meyer agreed on the first half, replying that it is "pure compliance to stay in the EU market."

Ghorbaninia's stronger claim — that a single tool strips provenance marks from three vendors in one pass — doesn't survive contact with the repository, which says the opposite. The tools are less capable than their most enthusiastic advocates claim.

The supply chain risk

The watermarks-remover tool ships as an agent skill, installed by symlinking a directory into a local skills folder and invoked with a slash command. Its optional scoring setup clones a third-party research repository and pulls a roughly 220MB artifact.

That pattern is worth watching. Whatever the merits of the underlying argument about provenance and privacy, a fast-moving category of tools that people wire directly into agent pipelines, and then feed their documents through, is a supply chain surface. The projects currently in the space are at least open and readable, even where they ship no license at all.

BleepingComputer has not audited or tested any of the tools named in this article. Readers should treat them with the same caution as any other unvetted code from the internet.

Why it matters

The rapid proliferation of unverifiable watermark removers could create a dangerous dynamic. With no public detector to test against, buyers are taking these tools at their word — and many are likely falling short of their claims. That means users may be building workflows around tools that don't actually work, while potentially introducing untrusted code into their agent pipelines.

This suggests the real risk isn't just circumvention of provenance, but the supply chain exposure that comes with a market where demand is proven (over four thousand stars) yet no one can verify any claim. The next wave of tools, arriving into that vacuum, may not be as openly readable as the current ones. As this space matures, buyers should be cautious about what these tools actually do, and whether they're worth the risk of running unvetted code on their systems.