A new wave of tools designed to remove AI watermarks has quickly materialized following **Anthropic**'s disclosure of invisible marking in **Claude**-generated text. This includes a **GitHub** project boasting over 4,500 stars, a cluster of recently launched web tools, and at least one established AI detection evasion service. Crucially, none of the claims regarding the defeat of these text watermarks can currently be independently verified. **Anthropic** has not yet published the technical specifications of its watermarking process or released a detector that would confirm whether a 'cleaned' document still carries the mark. ## Who is Offering What? Among the most prominent offerings is **watermarks-remover**, an MIT-licensed tool developed by software developer **Guillaume Meyer**, founder of **Memo**. Initially an agent skill for **Claude** only, it now advertises coverage for **Claude**, **Gemini**, **SynthID-Text**, **OpenAI** provenance surfaces, and open-weight models utilizing **Kirchenbauer-style** marks. Meyer's social media post announcing the tool quickly gained significant traction, surpassing 2 million views: > watermarks-remover now supports watermarks from OpenAI and Gemini in addition to Claude. > — Guillaume Meyer (@guillaumemeyer) Other notable repositories include **claude-watermark-cleaner**, **remove-ai-watermarks**, and **noai-watermark**. A number of web tools have also emerged, such as *claudewatermark.com*, *claudewatermark.rip*, *gptcleanup.com*, and *claudewatermarkremover.app*. **StealthGPT**, a service specializing in AI detection evasion, has added a **Claude** watermark remover to its offerings. Similarly, **Human Writes**, which markets itself for bypassing **Turnitin** and **GPTZero** on academic assignments, claims to strip **Claude**'s watermark while cautioning users to comply with academic integrity policies. Notably, **StealthGPT**'s own comparison table includes a caveat: "no tool guarantees 100% bypass, detector models update regularly," even as it announces **Claude** watermark removal capabilities. ## What 'Watermark Removers' Actually Do The functionalities of these tools vary, and only some aspects are verifiable. Stripping hidden characters from text, such as zero-width characters, bidirectional controls, Unicode tag characters, and lookalike spaces, is a verifiable process. Similarly, removing **C2PA**, **EXIF**, and **XMP** metadata from files (including PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, and Markdown) is achievable. This directly addresses **Anthropic**'s signed provenance data, though it's a relatively simple feat, as file metadata often doesn't survive re-saving, format conversion, or screenshots. The true challenge lies in removing the watermark itself, which is not embedded in hidden characters. The watermark is inherent to *which words the model selected*, meaning the only known method for removal is substantial text rewriting, typically employing a second model. **Meyer** clarified on Wednesday that his tool currently only removes metadata, with actual watermark stripping potentially coming later. His **README** further questions the utility of rewriting premium model output with a 'worse' model, arguing it compromises the original quality. Commercial sites, however, are often less cautious. Many promise clean, undetectable output, with their reported 'scores' often measured against generic AI detectors rather than against **Anthropic**'s specific watermark, for which no public detector exists. Independent testing has already uncovered limitations. **Pasquale Pillitteri** cloned and reviewed the code of several main projects, finding that one popular text cleaner failed to address a common hidden-payload technique, allowing the embedded data to remain intact after processing. ## Why Claude is Marking Text at All **Anthropic** published a support page this week detailing its approach to content marking. Text generated by models launched on or after August 2, 2026, will carry an imperceptible watermark woven into the wording. Additionally, supported file types will receive signed **C2PA** metadata. This marking is applied at the model level, affecting the API, claude.ai, **Claude Code**, **Claude Cowork**, and **Claude Tag**, as well as integrations through **AWS**, **Google Cloud**, and **Microsoft Foundry**. This initiative is primarily driven by **Article 50 of the EU AI Act**, which became enforceable on August 2, carrying potential penalties of up to 15 million euros or 3% of global turnover. It's important to note that a detected mark merely indicates content was *processed* by **Claude**, not necessarily *written* by it. Running existing prose through the model for grammar checks, translation, or summarization will result in marked output. **Anthropic** also lists heavy editing, paraphrasing, and translation as ways a mark can disappear. The company has committed to supporting third-party detection as required by EU transparency rules and plans to publish technical documentation in the future. Online reactions have been less forgiving. Responding to Meyer's post, one user characterized watermarking as a "compliance checkbox, not a real defense." Meyer concurred with the first half, stating it's "pure compliance to stay in the EU market." ## The Part That Should Worry Defenders **watermarks-remover** ships as an agent skill, installed by symlinking a directory into a local skills folder and invoked with a slash command. Its optional scoring setup clones a third-party research repository and pulls a roughly 220MB artifact. **Note**: Ghost Protocol has not audited or tested any of the tools named in this article. Readers should exercise caution with any unvetted code from the internet. This pattern is what warrants attention. Regardless of the debate surrounding provenance and privacy, a rapidly evolving category of tools that users integrate directly into agent pipelines and feed their documents through represents a significant supply chain surface. The current projects in this space are, for the most part, open and readable, even if some lack formal licenses. However, the subsequent wave of tools, entering a market with demonstrated demand (over four thousand stars) but no reliable way for buyers to verify claims, may not maintain this level of transparency or trustworthiness.