Anthropic had barely confirmed that Claude outputs now carry invisible, machine-readable watermarks before developers began publishing ways they believe can remove them. The rapid response illustrates a central problem for text provenance: a signal hidden in word choice may survive ordinary use, but it can be weakened by the same rewriting tools that generated the text.
Developer Guillaume Meyer released an override within four hours of Anthropic’s confirmation, according to WIRED. The code spread on GitHub, drew more than 100 contributors and was bookmarked more than 20,000 times on X. Its effectiveness cannot yet be independently confirmed because Anthropic has not released the public detector needed to test the result.
Statistical patterns replace visible labels
Anthropic adopted the watermark as part of its compliance with the European Union’s AI Act. The new rules require synthetic text, audio, images and video to carry machine-detectable labels, with potential fines reaching 3% of annual turnover. Independent tools designed to circumvent those labels are not themselves prohibited by the law, WIRED reports.
Claude’s text watermark uses Google’s SynthID technology, which influences the model’s selection of words and phrases to create a statistical pattern invisible to readers. Anthropic says this does not reduce output quality. Google developed SynthID and has applied it to generated content since 2023.
Unlike a visible warning, the watermark does not sit in one removable location. Detection depends on finding a probabilistic signal distributed through the text. That design can make unedited output identifiable, but it also means a detector cannot always offer a simple, certain verdict.
Meyer worries that such uncertainty may produce false positives or label text that received only light AI assistance. His concern is not evidence that Anthropic’s detector currently makes those errors; without public access, its accuracy and thresholds cannot yet be assessed.
Rewriting attacks the pattern rather than the message
Meyer’s method sends watermarked text through a model that does not apply the same signal, asking for repeated rewrites, synonym substitutions and structural changes. Other techniques discussed by WIRED include rearranging sentences, condensing passages and translating text into Arabic and back again. Simpler tools can remove invisible or lookalike characters, although a statistical watermark does not depend only on hidden characters.
Anthropic acknowledges that heavy editing, paraphrasing or translation may remove its watermark. This is an important limitation because those transformations are inexpensive and preserve much of a passage’s meaning. The attacker does not need to discover the secret statistical rule if enough wording can be changed to erase the original distribution.
At the same time, the published workarounds remain claims rather than verified defeats. Until Anthropic provides its detector, developers cannot reliably measure whether a rewritten sample has crossed the detection threshold. A method that appears visually different may still retain enough signal to be identified.
Regulation creates an uneven transparency contest
Around 190 organisations have signed a voluntary code supporting the EU transparency requirements. Anthropic plans to watermark new models from August and existing models by December, while also releasing a text-detection API and improving the system over time.
The availability of models without compatible watermarks may determine how easily users can automate removal. If many remain accessible, one model can repeatedly rewrite another’s output. If watermarking becomes widespread, developers may still use manual edits or transformation methods, but at greater effort.
The episode does not make provenance technology pointless. A signal that survives routine copying could still help platforms analyse large volumes of content or identify unmodified output. It does show why watermarking should not be treated as proof of authorship or absence of AI use. Detection is probabilistic, and adversarial editing changes the evidence being measured.
Anthropic’s planned API will make the debate testable. Its value will depend on measured false-positive rates, resilience to realistic editing and clear communication about uncertainty. The first wave of workaround code has arrived before that evidence, leaving both the watermark’s defenders and its critics with claims that the public detector must now resolve.
