Claude's watermark launches and a 14.8k-star project fires back

The bottom line

Did Claude’s watermarks become useless overnight?

Don't rush yet.

Things are more lively than "another GitHub artifact cracking company": Anthropic has just introduced watermarks to the world, and the open source community has immediately launched tools to disrupt it; some people unsubscribed, and some cheered "Claude lost," but at the same time, Google allowed users to turn off some visible watermarks. The most dramatic reversal is that the project that rushed to 14.8K Star did not dare to say that it had really cracked Claude.

A more accurate statement is: Anthropic has just brought machine-readable markup to the world. An open source project rushed to 14.8K stars in a few days, publicly demonstrating how to clean hidden characters, file metadata, and destroy statistical text signals with rewriting. But the project's own README is also very cautious: before the manufacturer discloses the detector and key, no tool can honestly guarantee that "official detection is no longer possible."

This is not a hack with a winner already decided, but a public stress test. It puts a more difficult question in front of all AI users: If AI participated, does it mean it was written by AI?

Anthropic has just installed the lock, and people are already queuing up to remove it.

On August 14, Anthropic released a technical description of Claude’s text watermark. It says that future supported Claude models will include invisible statistical signals when generating text; supported files will come with signed provenance metadata. The Claude Help Center further explains that the markup will cover the output of supported models in products such as Claude, API, Claude Code, Claude Cowork, etc., and will be applied globally in the regions where Claude provides services.

There are two points in time that cannot be confused:

• Transparency obligations related to Article 50 of the EU AI Act apply from 2 August 2026.
• Anthropic chose global deployment because there is currently no durable switching solution by region. This is Anthropic’s product decision, not the European Union’s direct order for users around the world to add watermarks uniformly.

Older models were not all switched over on the same day. The Anthropic Help Center notes that markup support is still being gradually added to models launched before August 2. Therefore, "all Claude's answers after August 2 are watermarked" is too absolute.

14.8K people watched, but the project itself stepped on the brakes first

watermarks-remover started by Guillaume Meyer. The GitHub API query found 14,838 stars and 1,647 forks on August 19, 2026; the GitHub page shows approximately 14.8K stars and 1.6K forks. This number shows that the project has gained developer attention very quickly, but it does not mean that it has been verified by Anthropic's official detector.

The project is now no longer just a small script to "delete special characters", but a multi-layered tool for user-owned content:

• Layer A: Clean up text hygiene issues such as invisible Unicode, abnormal spaces, and bidirectional control characters.
• Layer B: Rewrite the text through another model in an attempt to destroy the word selection distribution of the statistical watermark.
• File layer: Clean up C2PA, EXIF, XMP and document properties in some PNG, JPEG, SVG, PDF, DOCX and other containers.
• Verification layer: The project provides optional research tools such as MarkLLM for conducting experiments on research detectors with the same configuration; this is not a substitute for the manufacturer's detector.

This is also the most easily replaced part of the title: the project "can clean up certain visible or operable traces" and "Claude's official detection must have failed" are two different things.

How on earth did Claude secretly "stamp" in one sentence?

It's not a zero-width space, or a special character that disappears when copied.

Every time a large language model generates a word, it will choose among multiple reasonable candidates. For example, the sentence "Today's weather is very..." can be followed by "cold", "overcast" or "cool". As long as it does not affect the meaning, there is a certain degree of freedom in the choice. Anthropic's scheme takes advantage of these low-risk options: altering the random process with a key that only the detector has, so that a piece of text long enough leaves a statistically identifiable trace.

This signal has three important characteristics:

• Readers cannot see it, and there will not be a string of hidden characters appearing out of thin air in the text.
• It does not contain identifying information about specific users, organizations or chat history.
• What it proves is only that "Claude may have participated", not "this article was independently created by Claude".

Anthropic itself admits the boundaries: the detection effect is weak when the amount of short text information is insufficient; sentences and codes with strong factuality do not have much room for free word selection and can carry fewer statistical signals; if Claude is only asked to change punctuation and grammar, the watermark may be too weak to be judged.

The first reversal: rewriting can destroy the signal and may also destroy the original text

Anthropic says that minor edits may not completely remove the watermark, while a complete rewrite may remove the original signal. But a complete rewrite also changes the words, sounds, and details of the original text. At this point, whether it is still the same text generated by Claude becomes an authorial question in itself.

Layer B of watermarks-remover is therefore more like an "adversarial rewriting" or a "research experiment" than a universal eraser. The project README clearly reminds: before the manufacturer discloses the detector and key, there is no guarantee that the processed content will not pass official inspection.

There is also a real cost: if the article is completely rewritten by another model in order to remove Claude's statistical signal, what is left in the end may not be the original manuscript, nor a reliable "human proof", but just another paragraph of text rewritten by AI.

The second reversal: deleting the file "ID card" does not mean erasing all traces

What makes this topic confusing is that "watermark" is often used to refer to three different things:

1. Text Statistical Watermark: The signal is hidden in the word selection when the model is generated.
2. C2PA provenance metadata: The signature information is placed in the metadata of the file, recording that a certain tool participated in the generation or processing.
3. Visible tags: Tags visible to the naked eye in pictures, videos or search results.

C2PA can be removed by editing tools, platform upload processes, or format conversions; watermarks embedded in content may remain after partial transformations. Conversely, removing C2PA does not remove the signal from the content itself.

OpenAI's public notes currently discuss supported image and audio source signals: C2PA provides context, and SynthID embeds media content directly. OpenAI also clearly reminds that detecting source signals does not equate to proving that the content is accurate, has not been edited, is legally owned, or was created by a specific person. The Verge's report on Google shows that users can turn off some visible watermarks, but invisible SynthID and C2PA will still remain in supported media.

Therefore, "OpenAI's picture/audio source signal" and "Claude's text statistical watermark" cannot be written as the same set of technologies that have been uniformly cracked.

What’s even more magical is that Google did the opposite in the same week

In the same week as the Claude watermark controversy raged, Google began allowing Gemini and Flow users to turn off visible watermarks on some AI-generated content.

But this isn’t Google giving up on source tracking. The Verge reports that the underlying invisible SynthID and C2PA will still remain in supported images, videos, and music. Google simply separates "marks that users must see with their naked eyes" from "source signals that machines can still check."

This makes the differences in the routes of several companies suddenly become very dramatic:

• Anthropic puts statistical signals into Claude's word selection process.
• Google allows hiding part of the visible markup, but retaining invisible watermarks and source metadata.
• OpenAI's current public description mainly covers supported images and audio, and provides corresponding verification capabilities.

They all answer "how to prove that AI has participated", but no one really solves "how much AI participation is considered AI creation".

Someone really unsubscribed, but this is not yet the "Great Escape"

Business Insider reported that the first version of the project took about five hours to complete and quickly gained more than 14,000 GitHub stars; the report also mentioned that some users canceled Claude subscriptions because they were worried about watermarks following their work results. Another report interviewed four users who claimed to have canceled their subscriptions, while noting that Anthropic said it was not seeing an overall cancellation trend.

Neither set of information can be overstated as a "mass exodus of users from Claude." They are better understood as two signals:

• Individual professional users are worried that clients, schools or companies may misinterpret "Claude participated" as "the content is entirely written by AI".
• Anthropic believes there is currently insufficient data to prove that overall subscriptions have been significantly affected.

Both sides touch on the same reality: today’s AI workflow is often “people research and write first, and AI then translates, proofreads, organizes or rewrites”. A binary label hardly describes this collaboration accurately.

The real war is not the watermark, but "who counts as the author"

The reason why this matter is really worth publishing is not whether a watermark removal project can be won, but that the content source proof is entering the "language generation process" from "file attributes".

For Anthropic, watermarks are a transparency and compliance tool; for users, watermarks may become new evidence for customers, platforms, schools, or review processes. If the user directly regards the probability signal as the author's judgment, they will mistakenly translate "AI participated" into "Humans did not create".

To the watermarks-remover, 14.8K Star is not proof that Claude has lost. It proves three more concrete things: users are willing to study source tags; statistical tags must be open to attack and defense once they face rewriting; and the open source community will require vendors to disclose verification methods instead of just accepting "watermarked."

In the short term, the safest approach is not to look for "absolutely clean" tools, but to keep a record of your work: original material, version history, manual modifications, AI usage scope, and final review. Provenance should help explain the creative process, not replace it.

The real drama hasn’t started yet

• When will Anthropic make the detection API, keys, and false positive instructions available to users and third parties.
• How to set the thresholds of the official detector for short text, code, translation, proofreading and long text respectively.
• Whether the research benchmark of watermarks-remover can be stably reproduced on detectors with the same configuration, not just valid for a certain rewrite.
• How much authorial judgment schools, clients and platforms will interpret "possibly involving Claude".
• Whether EU transparency obligations are implemented in such a way that different providers have completely different marking and detection experiences.

FAQ

Are all Claude answers now watermarked?

It cannot be expressed absolutely like this. Anthropic explains that new models that support markup will add watermarks starting from release; models launched before August 2 are still gradually adding support. Specific products, models and file types may also vary.

Did watermarks-remover really crack Claude’s watermark?

It cannot be proven at this time. It can clean up some hidden characters and file metadata, and can also try to destroy statistical signals through rewriting; but the official detector and key have not yet been fully disclosed, and the project itself describes the results as best-effort.

Can Claude watermark prove that the article was written by AI?

cannot. Anthropic's original words are to determine whether Claude may have participated. It cannot distinguish between "Claude wrote it" and "Claude significantly edited it", nor can it prove that humans were not involved.

Is deleting C2PA equivalent to deleting AI watermarks?

Not equal to. C2PA is signature metadata, statistical watermarks or SynthID-like signals that may be embedded directly in the content. After metadata is removed, signals from the content itself may still be present.

What should the user do now?

If the content involves customers, schools, compliance or copyright, keeping research materials, version history and AI usage records is more reliable than looking for a "remove watermark button". Do not rely on test results as the only evidence of authorship.