Anthropic's EU-Driven Watermarking Spurs Unverifiable Removal Market
Days after Anthropic began watermarking all Claude-processed content to comply with the EU AI Act, a market of removal tools emerged—yet none can be verified.
This article was drafted with AI assistance from multiple sources and was reviewed and approved by a human editor before publication.
Anthropic's decision to watermark all content processed by its Claude models—not just AI-generated text—was driven by the EU AI Act, which has been in force since August 2. The regulation obliges providers to mark AI-generated or manipulated content, with penalties up to 15 million euros or 3% of global turnover. Anthropic extended the requirement globally, applying watermarks to every new model released after the deadline. Text carries an invisible watermark woven into word choice, while supported file types receive signed C2PA metadata. The marks appear across the API, claude.ai, Claude Code, Claude Cowork, Claude Tag, and through cloud partners AWS, Google Cloud, and Microsoft Foundry. The company acknowledges that the mark indicates Claude processed the content, not necessarily authored it—grammar checks, translations, and summaries are all marked.
Within days of the disclosure, a market for removing these marks emerged. Guillaume Meyer, founder of Memo, released watermarks-remover, an MIT-licensed tool that began as a Claude-only agent skill and now claims support for Gemini, SynthID-Text, OpenAI provenance surfaces, and open-weight models with Kirchenbauer-style marks. His social media post announcing the tool drew over 2 million views. Other repositories—claude-watermark-cleaner, remove-ai-watermarks, noai-watermark—and websites such as claudewatermark.com, claudewatermark.rip, gptcleanup.com, and claudewatermarkremover.app have appeared. Commercial services joined: StealthGPT added a Claude watermark remover to its use-case pages, and Human Writes advertises bypassing Turnitin and GPTZero while claiming to strip Claude's watermark. StealthGPT cautions that no tool guarantees 100% bypass because detector models update regularly.
What these tools actually achieve is unclear. Meyer posted on Wednesday that his tool removes only metadata for now; stripping actual marks may come later but is not available today. Stripping hidden characters such as zero-width spaces, bidirectional controls, Unicode tags, and lookalike spaces does work, as does removing C2PA, EXIF, and XMP metadata from PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, and Markdown files. However, metadata does not survive re-saves, format conversions, or screenshots. The deeper text watermark lives in the model's word choices, and the only known removal is heavy rewriting using a second model. Meyer's README argues that such rewriting substitutes a cheaper model's choices for the original, questioning why one would pay for a premium model only to run its output through an inferior one. Commercial sites promise clean, undetectable output, but their scores are measured against ordinary AI detectors, not Anthropic's watermark, since no public detector exists.
Independent verification is difficult. Pasquale Pillitteri, who cloned major projects and read their code, found that one popular text cleaner let the most common hidden-payload technique pass through—the payload decoded intact after cleaning. This contradicts claims like that of Emad Ghorbaninia, whose tool allegedly strips provenance marks from three vendors in one pass, a capability the repository itself contradicts. Ghorbaninia dismissed watermarking as a "compliance checkbox, not a real defense," and Meyer replied that it is "pure compliance to stay in the EU market." Anthropic has committed to supporting third-party detection as EU transparency rules require and to publishing technical documentation later. For now, the effectiveness of these tools remains unverified; BleepingComputer has not audited or tested any of them.