Guillaume Meyer needed four hours to beat the invisible watermark Anthropic is adding to Claude. That was the gap, Wired reported, between Anthropic confirming the watermark and Meyer publishing code to strip it out. His code has since drawn more than 100 contributors on GitHub and been bookmarked over 20,000 times on X.
more
The watermark he went after is a different thing from the faint logo on a stock photo. It lives in the choice of words. Each time a chatbot picks its next word, it often has several good options, and a random number settles which one it uses. A watermarked model swaps that random number for one derived from a secret key and the words just written, so the text reads the same. It carries a pattern that anyone holding the key can test for. Google’s Gemini already marks its text this way, and Anthropic’s version is built on Google’s method.
One reason it is spreading now is a European law. From 2 August 2026, Article 50 of the EU’s AI Act requires the makers of AI systems to mark generated text, images, audio and video in a form machines can read. About 190 organisations had signed the voluntary code that shows how to comply by the end of July. The fear it has stirred is older. It belongs to the people on the other end: students, freelance writers, and anyone who writes in a second language and has already been told their work looks machine-made.
How a chatbot hides a pattern in its words
Anthropic’s own explanation starts with an unfinished sentence: “The weather today was cold and…”. The next word will almost never be “sugary”. It might well be “overcast” or “grey”, and for the reader it hardly matters which. A long reply contains many choices like that, and the watermark lives in them.
The company compares it to playing Monopoly with the digits of pi in place of a die. Every move still looks random to the players. Someone who later sees the whole game, and knows pi, can work out that pi was driving it. The watermark adds no characters and no hidden symbols to the text, Anthropic says, and costs nothing extra to run.
The idea is older than any of the products. Scott Aaronson, a computer scientist at the University of Texas at Austin, described how it could be done in a much-discussed talk in 2022. In January 2023 John Kirchenbauer and colleagues at the University of Maryland published a working version. Before each word, their method picks a random “green” set from the vocabulary and nudges the model towards it. Tom Goldstein, one of the authors, gave MIT Technology Review an example. After “beautiful”, the word “flower” might land on the green list and “orchid” on the red, so a marked model favours “flower”. Human writing scatters across both lists. A passage packed with green words gives the machine away.
Google DeepMind’s SynthID-Text, described in Nature in October 2024, works on the same principle with a different scoring scheme. It changes only how the model samples its next word, never its training, and the detector does not need the model itself to run. To test it at scale, the team watermarked live Gemini traffic and collected feedback from nearly 20 million responses. Users rated the marked replies no worse. The same day, Google and Hugging Face released SynthID-Text for any developer to use.
Two warnings travel with it. The Hugging Face guide says the mark is weaker on factual answers, where there is less room to vary a word without getting something wrong. And a detector’s confidence can collapse when the text is thoroughly rewritten or translated into another language.
Why the companies did it
The case for marking text is about misuse. Nature’s editorial on the DeepMind paper named academic plagiarism and the mass production of misinformation. It also called watermarking a technology that regulators were treating as central to how they would govern AI.
OpenAI got there early and then stopped. In August 2024 the Wall Street Journal reported, and The Verge summarised, that the company had held a working text watermark and a detector for about a year. Internal documents put its accuracy at 99.9%. A survey OpenAI commissioned found people worldwide backed an AI detection tool by four to one. Yet almost 30% of ChatGPT users surveyed said they would use the service less if their text were marked.
OpenAI’s public reasons were different. In an update to its blog on 4 August 2024, it said the watermark held up against local tampering such as paraphrasing. It said translation, or a rewrite by another model, made the mark trivial for a bad actor to remove. It also said its research suggested the mark could fall harder on some groups and stigmatise AI as a writing aid for people whose first language is not English.
Two years on, the law settled the question for the companies that sell in Europe. A provider that misses the marking rules faces fines of up to 3% of annual turnover, Wired reported. Models released before 2 August 2026 have until December to catch up, according to Ars Technica. Anthropic announced in August that new Claude models would mark their text from launch, and that the mark would apply worldwide, not only in the EU. It says it does this to comply with the AI Act.
Google signed the same code and says it is working with other labs, OpenAI among them, to spread SynthID across the industry. OpenAI’s own provenance work now uses SynthID for images, and from 31 July 2026 for audio as well. IEEE Spectrum reported in September that OpenAI had yet to add a text watermark, but planned to.
What people are afraid of
The fear did not start with watermarks. It started with AI detectors, the tools schools bought to read an essay’s style and guess whether a machine wrote it.
A Stanford team ran seven popular detectors over two sets of human writing. One was 88 essays by American eighth-graders. The other was 91 TOEFL essays by non-native English writers, collected from a Chinese education forum. The detectors were close to perfect on the American essays. They labelled the TOEFL essays AI-generated 61.22% of the time on average, and all seven agreed on 18 of the 91. The authors suggest the cause is narrower word choice, which is common among second-language writers.
NBC News found the cost in January 2026. Brittany Carr, studying online at Liberty University in Virginia, failed three assignments after a detector flagged them, even though she showed her revision history. Aldan Creo, a Spanish graduate student at the University of California San Diego, was accused over a report and got his grade back. He now sometimes leaves misspellings in his work on purpose, NBC reported.
A watermark answers a different question from a detector. It checks for a key, not for a style, and Anthropic says that makes it fundamentally different from tools such as Pangram that hunt for a chatbot’s habits of phrasing. But critics see a new version of the old problem.
The sharpest objection concerns editing. The EU rule exempts AI that performs “an assistive function for standard editing”, with grammar correction as the example. Anthropic marks at the level of the model regardless, Ars Technica pointed out. Anthropic’s own help page concedes that output can carry a Claude mark when the ideas or text came from somewhere else, because people use Claude to proofread and translate. Ars put the worry plainly: a teacher should read the mark as no more than “AI touched this”, and it is easy to imagine one reading more into it.
Meyer, the developer who wrote the removal tool, is a native French speaker who uses Claude and Grammarly to edit his writing. He told Wired he feared false positives, and a mark that cannot separate light help from heavy use. Employers might reject candidates on the strength of it, he said. He said freelance content writers and social media creators had asked him for help using his code.
Some users simply left. TechCrunch cited a Business Insider report that dozens of people on X said they had cancelled their Claude subscriptions. John Gruber, the technology writer and co-creator of Markdown, called the watermark a “perversion of writing”. He noted that text replies often run to just dozens or hundreds of words, which leaves little room for a mark that does no harm. Kirchenbauer, now at the Vector Institute, answered that a mark has to change something to be detectable at all. The real question, he told IEEE Spectrum, is whether that change matters to the person using the text.
Does the mark survive a determined user?
Not for long, on the evidence so far. Meyer’s method asks a model that adds no mark to rewrite the text several times, trading in synonyms and shuffling sentences. Software engineer Erik Hughes told Wired he built his own remover with Claude in 15 minutes. Leon Chlon, a visiting fellow at the University of Oxford, described condensing a reply, translating it into Arabic and translating it back.
Researchers saw this coming. A paper first posted in March 2023 showed that repeated paraphrasing cut detection rates sharply, for watermarks and for several other kinds of detector, while doing little harm to the text in many cases. The same paper raised a darker possibility. An attacker could infer a hidden signature without inside access to the detection method, and make human writing look machine-made.
The mark also proves less than people assume. The Conversation noted that a missing mark does not mean no AI was used. Claude’s mark also cannot say whether a different system, such as DeepSeek, wrote a text.
What the companies say back
Anthropic’s answers go to the privacy fear first. The watermark, it says, carries no identifying information and cannot be traced to a person, an organisation or a conversation. On editing, it says lightly proofread text is almost entirely the writer’s own words, which leaves “very little (if anything)” for the mark to attach to. On removal, it concedes that a complete rewrite will erase the mark. It adds that by then it is arguable whether the text is still AI-generated at all.
A spokesperson told Wired that identifying AI text is hard, and that the mark gives people better tools for it. The company plans a detection service so users can check text themselves. Code carries less of the mark than prose, Anthropic says, because working code leaves few equally good choices.
Google backs transparency but warns against the rules piling up. In signing the code, it said a web flooded with overlapping AI labels and legal notices would leave people more confused. Pushmeet Kohli, a vice president of research at Google DeepMind, called SynthID a building block rather than “a silver bullet”.
OpenAI has argued for a different layer altogether. In 2024 it said signed metadata, unlike a watermark, produces no false positives. A watermark with a low error rate, applied to enough text, would still produce a large number of false positives. Its 2026 provenance work pairs that kind of signed metadata, the C2PA standard, with SynthID watermarks, in what it calls a multi-layered approach.
That arithmetic is where the people worried about watermarks end up too. Educators quoted by The Conversation argue that universities should stop hunting for evidence of AI use and look for evidence of learning instead. Australia’s higher education regulator lists oral presentations and supervised tasks among the ways to do it. Aldan Creo, meanwhile, runs all of his material through an AI detector in advance, to head off another accusation.
