It only took a few days from the announcement Anthropic communicated that it had activated invisible brands in everything Claude he writes so that a market dedicated to removing them could be created. A project with over has already appeared on GitHub 4,500 stars which promises to be able to remove “hidden” markings.
However, it should be noted immediately that none of the promises of removal can be verified today. Anthropic has not published how the text watermark works or released the detector which would tell if a cleaned document still bears the mark. The company declares that it will publish the technical documentation later and that it will support the detection by third parties, as required by European transparency rules.
The support page published this week by Anthropic sets the perimeter: the texts produced by the models launched by the August 2, 2026 onwards they carry an imperceptible watermark woven into the very formulation of the sentences. It is imposed by theSection 50 of the AI Act European Union, applicable from August 2nd, with sanctions reaching up to 15 million euros or 3% of global turnover.
The markup is applied at the model level, so it appears wherever the model is used: APIsclaude.ai, Claude Code, Claude Cowork and Claude Tag, and third-party channels such as AWS, Google Cloud And Microsoft Foundry. Anthropic adds metadata to the supported file types C2PA signed.
What do the tools out there really remove
The tools that have appeared these days can do one of three different things, and only two of them can actually be verified. Removing hidden characters from text works and can be counted on: zero-width characters, directionality controls, Unicode tag characters, spaces visually identical to ordinary ones. They are items that are found and deleted deterministically, and the result occurs by reopening the file.
Cleaning of C2PA, EXIF and XMP metadata from files also works, on PNG, JPEG, SVG, PDF, DOCX, ODT, HTML and Markdown. It is the part that directly affects the source data signed by Anthropic, and it is also the least demanding: the metadata of a file does not survive a new save, a format conversion or a screenshot.
?watermarks-remover now supports watermarks from OpenAI and Gemini in addition to Claude.https://t.co/OxSdnAjEGe
— Guillaume Meyer (@guillaumemeyer) August 11, 2026
The hard part is the real watermark, which does not live in invisible characters. It lives in the choice of words that the model has made, and the only known way to erase it is to rewrite the text in depth by relying on a second model. Guillaume Meyerdeveloper and founder of Memo, author of the most followed project, is unusually explicit on this point: on Wednesday he wrote that for now his tool only removes metadata and that the elimination of real brands could come later, but today it isn’t there. The README adds the economic argument: a rewrite replaces the lexical choices of the original model with those of a cheaper model, and those who pay for a high-end model have little reason to have the result revised by a worse one.
Commercial sites are less cautious. Several promise clean, undetectable text, and the scores they return are measured against regular generated text detectors, not against Anthropic’s watermark, for which a public detector does not exist. StealthGPTwhich sells detector bypass services, has added a watermark remover for Claude to its pages, and warns in the same comparison table that “no tool guarantees 100% bypass, detection models update regularly.” A second service, Human Writes, advertises the bypass of Turnitin and GPTZero on topics and assignments, claims to remove Claude’s trademark and closes the page reminding you that the service must be used in compliance with academic integrity policies.
An independent audit has already found holes. The Italian developer Pasquale Pillitteri cloned the main projects and read their code instead of READMEs, discovering that one of the most popular text cleaners let the most common hidden payload technique pass through intact: after the supposed scrubbing, the payload still decoded in full.
A brand that says less than it seems
Watermarking AI output was always a compliance checkbox, not a real defense. A single open source tool that strips provenance marks from three different vendors in one pass is proof the threat model never accounted for someone who reads GitHub.
— Emad Ghorbaninia (@emadgnia) August 13, 2026
Anthropic itself recognizes that a detected trademark indicates that the content was processed by Claude, not that it was written by Claude. Simply pass your own text through the model for a grammatical correction, a translation or a summary for the output to return marked. The same page lists the circumstances in which the trademark disappears: heavy revision, paraphrase, translation. Under Meyer’s post, Emad Ghorbaninia dismissed the entire mechanism as “a compliance box to tick, not a real defense,” and Meyer agreed on the first half, responding that it is “pure compliance to stay in the European market.” Its strongest claim, that a single tool would erase the trademarks of three different vendors in one pass, however, contradicts what the repository itself claims.
The code that ends up in agent pipelines
The most popular project comes packaged as an agent skill: it is installed by creating a symbolic link of a folder inside your skills folder and is invoked with a slash command. The optional scoring setup clones a third-party research repository and downloads an artifact from approximately 220MB. None of the tools mentioned have been independently verified, and it is best to treat them with the same caution that you would use any uninspected code taken from the net: they are components that users hook directly into their pipelines and through which they then pass documents, which effectively makes them a link in the software supply chain. The projects in circulation today are at least open and readable, even when they do not carry any license.
