Glonce

Anthropic's Claude watermark bypassed within hours, coders say

policyThe Glonce editorsWired🔥76Glonce rating76Impact70Novelty72Relevance88Surprise73Players77Credibility82
Anthropic's Claude watermark bypassed within hours, coders say

Anthropic confirmed that Claude models would begin globally embedding invisible, machine-readable watermarks into all AI-generated content, in order to comply with the European Union's AI Act. Within four hours of that confirmation, developer Guillaume Meyer had already published code, which he calls an override, that strips the watermark out of Claude-generated text. The tool went viral: it has been bookmarked more than 20,000 times on X and has drawn more than 100 contributors on GitHub, with many more developers folding it into their own projects. One AI specialist captured the mood in a post on X: "Anthropic is embedding watermarks in its Claude texts ... the issue is practically history just one day later," accompanying the post with an image of Meyer breaking free of chains while standing on crumpled EU and Anthropic flags.

Meyer and others began investigating how the watermarking worked as soon as Anthropic announced the plan the week before. Some are trying to defeat it because they object to the idea that all AI-generated content should be labeled; others, including Meyer, say they are simply drawn to the technical challenge. Freelance writers and social media creators have also contacted Meyer asking for help using his code. The EU rules behind the mandate, which took effect earlier this month, require model providers such as Anthropic and OpenAI to label synthetic audio, image, video or text so the material can be machine-detected as AI-generated, or face fines of up to 3 percent of annual turnover. The rules bar providers from marketing circumvention tools, but building an independent one, like Meyer's, is not illegal.

Meyer says he is not against transparency or content attribution: "I just think watermarking in itself is a really bad solution, because it has major drawbacks and risks." His central worry is false positives. He says the watermark may not distinguish light AI use from heavy use, a concern that is personal to him: as a native French speaker, he routinely uses Claude and tools like Grammarly to edit his own writing. Treating the watermark as evidence is especially risky, he argues, given that even Anthropic admits it can only generate a probability that a text was touched by Claude, not certainty. Used that way, he says, it could lead employers to unfairly reject candidates or trigger overblown accusations against researchers simply because a detector flagged their work.

Anthropic's watermark works invisibly, leaving a pattern in Claude's choice of words and phrasing that a human reader cannot detect but a machine that knows how to look for it can. Because the technique shapes Claude's output, some users worry it will degrade response quality, though Anthropic maintains it will not. The underlying method is called SynthID, developed by Google, which has used it to watermark its own AI-generated content since 2023. Computer scientist Scott Aaronson proposed a similar approach while working at OpenAI, but he says OpenAI never deployed it, because the company worried watermarks would put customers off the product.

Meyer's removal method works by feeding Claude's output to a separate, non-watermarking large language model, which generates multiple rewrites, swapping in synonyms and lightly reorganizing the content. That approach depends on other large language models continuing not to watermark their own output, which may not be a safe bet: 190 organizations, including OpenAI, Microsoft and Meta, have signed the EU's transparency code of practice, under which watermarks must appear in all new models released from August and be integrated into existing models by December. There is no certainty that Meyer's tool actually works, since Anthropic has not yet released the software it uses to detect its own watermark. Still, Wayne Pan, chief technology officer and cofounder of the Silicon Valley-based sovereign AI startup Haimaker, says that understanding the underlying SynthID-text approach leaves him fairly confident the method holds up. Pan folded Meyer's open source tool into his own platform, because, like Meyer, he objected to Claude's watermark applying even to lightly edited content and to the mark being invisible to users.

Other developers have built their own removal tools. Software engineer Erik Hughes says it took him 15 minutes to build a tool with Claude that strips invisible and look-alike characters, reorders sentences within paragraphs and swaps in synonyms. Leon Chlon, a Visiting Fellow at the University of Oxford, says the watermark can also be removed by condensing Claude's response, translating it into a dialect such as Arabic, whose semantics differ sharply from English, and then translating it back. Anthropic itself has acknowledged that content which is heavily edited, paraphrased or translated might not carry a watermark at all. In a statement to WIRED, an Anthropic spokesperson said: "We're adding marking to Claude's output to comply with the EU AI Act, and other labs are taking similar steps. It's hard to identify AI-generated text, and this gives people better tools for identification. Text from supported Claude models, including output from Claude Code, will carry an invisible watermark, and it doesn't change the meaning, quality, or readability of Claude's responses. We also plan to ship a text-detection API so users can do more of this themselves." Anthropic says it is still working out how to implement text-watermark detection and plans to release a tool soon, at which point developers will finally learn whether their workarounds hold up; the company says it is also continuing to refine the watermarking system itself. As Pan put it: "I think they wanted to show that they're in good faith doing it, but I don't think you can ever have a watermark that will withstand everything."

Key facts

  • Developer Guillaume Meyer published watermark-removal code within four hours of Anthropic confirming Claude would embed invisible EU AI Act watermarks; the tool has been bookmarked more than 20,000 times on X and drawn more than 100 GitHub contributors.
  • The EU rules behind the watermark, in effect since earlier this month, require providers like Anthropic and OpenAI to label AI-generated audio, image, video or text for machine detection, with fines of up to 3 percent of annual turnover for noncompliance; marketing circumvention tools is barred, but building independent ones is not illegal.
  • Anthropic's watermark uses Google's SynthID technique, which Google has used since 2023; computer scientist Scott Aaronson proposed a similar method at OpenAI, which never shipped it for fear of putting off customers.
  • Other coders built their own removal tools: software engineer Erik Hughes needed 15 minutes to build one with Claude's help, and Oxford Visiting Fellow Leon Chlon says translating Claude's output into Arabic and back strips the mark; Haimaker cofounder Wayne Pan folded Meyer's open source tool into his own platform.
  • Nobody can fully confirm the workarounds succeed: Anthropic has not yet released its watermark-detection software, and 190 signatories of the EU's code of practice, including OpenAI, Microsoft and Meta, must add watermarks to new models from August and to existing ones by December.

Why it matters

This is a live test of whether a regulation-mandated technical safeguard can survive contact with the developer community. The EU AI Act pushed Anthropic to add invisible watermarking to Claude's text output, and within four hours of the rollout being confirmed, independent coders had already published tools that claim to defeat it. That gap between what a law requires and what a determined developer can undo is the real story: it suggests labeling requirements built into a single company's product can be routed around by anyone willing to run the output through another model, which cuts against the EU's underlying goal of making AI-generated content reliably identifiable.

Who it affects

Anthropic carries the compliance burden and the reputational hit of being a watermarking scheme publicly picked apart. The same exposure extends to the other signatories of the EU's transparency code of practice, 190 organizations including OpenAI, Microsoft and Meta, who face the same August and December deadlines and, if Meyer's technique generalizes, a similar vulnerability. Freelance writers and social media creators who want to hide AI assistance are direct beneficiaries of the removal tools. On the other side are employers, universities and researchers who might lean on watermark detection as evidence of AI use, a use case Meyer specifically warns is fragile.

How to use it

Meyer's code, released as an open source tool on GitHub, works by routing Claude's text through a separate, non-watermarking large language model that produces several rewrites, swapping synonyms and lightly reshuffling the content. Erik Hughes built an alternative in 15 minutes with Claude's own help: it strips invisible and look-alike characters, reorders sentences within paragraphs and substitutes some words for synonyms. Leon Chlon describes a third, low-tech route: condense Claude's response, translate it into a dialect such as Arabic, whose semantics differ sharply from English, then translate it back. Anthropic itself has acknowledged that content which is heavily edited, paraphrased or translated might end up without a detectable watermark regardless of intent.

How solid is it

The reporting is well sourced: named developers speaking on the record (Meyer, Hughes, Chlon, Pan), an on-record statement from an Anthropic spokesperson, and independently checkable numbers in the form of GitHub's contributor count and X's bookmark count. The unresolved piece is the central technical claim itself: the article is explicit that there is no certainty any of these removal tools actually defeats detection, because Anthropic has not yet published the software it uses to detect its own watermark. Pan's own confidence rests on understanding how the underlying SynthID-text approach works, not on a confirmed test against Anthropic's detector, and he says as much.

Risks and caveats

Meyer's biggest objection is upstream of the workaround entirely: he argues watermark detection only ever yields a probability, not a certainty, that text passed through Claude, and treating that probability as evidence risks unfairly rejecting job candidates or accusing researchers of AI use they did not engage in. His removal method also carries its own fragility: it depends on other large language models staying watermark-free, and 190 organizations, OpenAI, Microsoft and Meta among them, have committed to adding their own watermarks to new models from August and to existing ones by December, which would narrow the pool of clean models to rewrite through. Whether the watermark subtly changes the quality of Claude's output is also still disputed: some users think it does, Anthropic says it does not, and neither claim is independently tested in this reporting.

“I just think watermarking in itself is a really bad solution, because it has major drawbacks and risks.”

— Guillaume Meyer, the developer who built the watermark-removal tool