Claude Now Watermarks What It Writes. A Tool to Strip the Marks Passed 25,000 Stars. What It Removes, What It Can't, and Better Options

On August 2, 2026, the transparency rules in Article 50 of the EU AI Act started to apply. One of them says that companies offering generative AI must mark what their systems produce in a way a machine can detect. In the second week of August, Anthropic said Claude would carry an invisible watermark in the text it writes and signed Content Credentials on the files it makes. It also said the marks would apply worldwide, not only in Europe.

On August 11 a developer published a GitHub project called watermarks-remover. Its main skill started life as "remove-claude-marks", and the project now goes after marks from Claude, Gemini, OpenAI and open models. By October 28 it had 25,336 stars and 2,881 forks. It shipped nine releases between August 11 and September 3, and its code was last changed on October 26.

That is a lot of attention for a tool whose own README says it cannot promise to beat any vendor's detector. This post covers why the marks showed up now, what the tool removes, why people want it, what it cannot do, the rules that apply if you use it, and the options I would try first. I read the repository, its documentation and its release notes. I did not install it, and the reasons are below.

Why the marks showed up this year

Three things landed on the same date.

The EU AI Act. Article 50(2) says providers of AI systems that generate synthetic audio, images, video or text must make sure the output is marked in a machine-readable format and can be detected as AI made. It applies from August 2, 2026. Systems already on the EU market before that date have until December 2, 2026.

The EU Code of Practice. On June 10, 2026 the European Commission published a voluntary Code of Practice on Transparency of AI-Generated Content. Signing it gives a company a ready way to show it meets Article 50. For AI providers, the main commitments are:

• mark output with at least two layers, usually signed metadata plus an imperceptible watermark, because no single method is good enough on its own
• give others a free way to check content for those marks
• make the marks hold up against compression, cropping, screenshots and deliberate attacks
• forbid removing or tampering with the marks in their terms, usage policy or documentation, with exceptions for the legitimate purposes the Code lists
• support a shared, interoperable way to detect marks by February 2, 2027

By September 9, 82 providers and 152 deployers had signed, according to Morrison Foerster. Google said in July that it would sign. Anthropic says on its help page that it signed as both a model provider and a system provider.

California. The California AI Transparency Act, SB 942 as amended by AB 853, became operative on the same day. It covers generative AI providers with more than one million monthly users that are publicly available in California. They must embed hidden ("latent") disclosures in the images, video and audio they generate, offer an optional visible label, and provide a free detection tool. Text is not covered. Duties for large online platforms and device makers follow in 2027 and 2028.

So the marks are not one company's whim. They are the law in the biggest market most AI companies sell into, plus a voluntary code that turns the law into a checklist. Anthropic chose to apply its marks everywhere rather than switch them on by region.

What Claude marks, and what Anthropic says the marks mean

Anthropic's help article, How Claude marks AI-generated content, describes two mechanisms.

1. A watermark in the text itself. It is applied at the model level, does not change the meaning, and travels with the text when you copy it. The Batch at DeepLearning.AI reported in August that it is based on SynthID-Text, the method Google DeepMind published in Nature in 2024. In plain terms: when the model has several equally good next words, a secret key nudges which one it picks. One word means nothing. Over a few hundred words, the pattern becomes statistically detectable to anyone holding the key, and invisible to everyone else.
2. Content Credentials on files. Signed C2PA metadata attached to files Claude generates, such as PNG and JPEG images.

The article lists which models carry each mark. Models launched on or after August 2 support marking at launch, and older models are being added. Marking applies across the Claude apps, the API, Claude Code and Claude Cowork, and text marking also covers newer models served through AWS, Google Cloud and Microsoft Foundry.

Anthropic is also plain about the limits. A detected mark means Claude may have touched the content, not that Claude wrote it, because Claude may only have proofread, translated or summarized something a person wrote. A missing mark proves nothing either: the model may predate marking, the text may be heavily edited or very short, or the file's metadata may be gone. The Batch reports that the marks carry no information that identifies the user, the organization or the chat, and that code and other text with one right answer carries less of a mark.

Text detection is in private preview for regulators, researchers, the media, fact checkers, educators and a few other groups. For files, anyone can use Anthropic's free checker at claude.com/check-files.

What watermarks-remover actually does

The project calls itself a privacy-first tool for stripping AI marks from content you own. Under the hood it is a Python service plus a set of agent skills that drive it. It works in layers.

It ships as a skill for Claude Code, Codex, Cursor, Grok and Claude Cowork. There is also a Claude Code plugin with a hook that checks every file the agent writes, a Docker HTTP service, a pre-commit hook, and an audit command that scans whole folders or websites.

Two parts of the September 3 release (v0.7.0) show where the project is heading.

• A watermark stealing module. It queries a watermarked model many times, compares its word choices with an unwatermarked model, and estimates which words the watermark favors so a rewrite can avoid them. It does not recover the secret key. It builds on published research, including ETH Zurich's Probing SynthID work.
• A rewrite benchmark scored by an AI text detector. The project measures its rewrites with Pangram, a commercial detector, as its stand-in for how human the result reads, and adds a final "humanize" pass.

The documentation is unusually candid. It says Layer B can never be certified, that rewording a strong model's prose with a weaker model degrades it, and it asks the obvious question: "why pay for a premium model in the first place?" Its ethics page limits intended use to privacy, cleaning up invisible characters, and research on content you own. It rules out academic fraud, dodging disclosure rules, and claiming cleaned text is human written.

Why people want it

Some of the reasons are solid, some are fear, and one is the obvious one.

1. Privacy on files. Metadata leaks things. Photos carry GPS coordinates, documents carry author names and edit history, and a C2PA manifest can record the tool and the chain of edits. Stripping metadata before you share a file is old advice that predates AI. By Anthropic's account the Claude text watermark does not identify you, so the privacy case is much stronger for files than for text.
2. People who wrote it themselves. Anthropic's own caveat says proofreading, translating or summarizing can mark human writing. A student, job applicant or freelancer who wrote every word and asked Claude to fix the grammar now worries that a detector will say otherwise. The worry is fair. Stripping the mark is a poor answer to it, for reasons covered below.
3. Fear of search penalties. After the August news, plenty of marketers assumed Google would demote pages written with Claude's help. Seer Interactive's Alisa Scharf argued on September 4 that this misreads the change. Google judges quality, not how a page was produced, and Google has run its own SynthID watermark on Gemini output for two years without using it to rank anything. I agree with her.
4. Developers fighting broken text. Zero width spaces and stray direction controls break code, diffs, search and copy and paste, whatever put them there. Layer A handles that, and it has nothing to do with AI watermarks. You also do not need a 25,000 star project for it; there is a one line check further down.
5. Researchers. The Code asks for marks that resist attack. Someone has to test that, and attack code is how you find out whether a mark holds. Papers like Watermarks in the Sand (ICML 2024) argue that strong watermarking is impossible in principle against a determined attacker, which is one reason the Code asks for more than one layer.
6. Passing AI work off as human. Students under an honor code, freelancers billing for handwritten copy, content farms, fake reviews, fake news. The project's ethics page says this use is not appropriate. Star counts do not tell you which group is doing the starring.

What it cannot do

• It cannot promise a detector will miss your text. The README says no tool can honestly certify that, because the vendors' keys are secret. Layer B is a rewrite and a hope.
• Rewriting costs quality. Text from a top model, rewritten by a cheaper one, reads like the cheaper one. If the voice of the piece matters, this is the expensive part.
• Stripping metadata does not touch pixels. Removing C2PA from an image leaves any watermark that lives in the pixels themselves, and C2PA's "soft binding" is designed to match a stripped image back to its original credentials.
• Removal leaves traces of its own. A 2026 paper by Goonatilake and Ateniese argues that removing a watermark is not enough to hide that it was removed. The project defaults to gentle settings for that reason.
• A missing mark proves nothing. Not to a teacher, a client or a court. If you ever need to show that you wrote something, an absent watermark is about the weakest evidence you could offer.
• Code carries little of the mark. Text with one right answer gives the watermark few choices to work with, and Seer Interactive describes code as largely unaffected. Running an AI rewrite over source code to remove a mark that is mostly not there is all risk and no reward.

The rules if you strip anyway

This is not legal advice. It is the list of things to check.

• Your AI provider's terms. The Code requires signatories to forbid removing or tampering with marks in their terms, usage policy or documentation, with exceptions for legitimate purposes. When I searched Anthropic's usage policy on October 28 I found no clause that names watermarks. The Code lets the ban sit in any of those three places, so read all three for every tool you use before you assume anything.
• EU disclosure duties are separate. Article 50(4) makes deployers disclose deepfakes, and disclose AI-generated text published to inform the public on matters of public interest, unless a person reviewed it and someone holds editorial responsibility. Stripping a machine mark does not remove a duty to tell people.
• Someone else's work. Stripping credentials from your own file is one thing. Stripping a photographer's or illustrator's credentials from their work can run into 17 U.S.C. 1202, which bars removing copyright management information when you know it will help hide an infringement.
• School, employer and client rules are about what you did, not what a detector can prove. If a policy says to disclose AI help, a clean scan does not change what you owe.

Before you install a 25,000 star skill

Popular agent add-ons are attractive targets, and this one asks for a fair amount of trust.

• The Claude Code plugin registers a hook that runs on every file your agent writes. In its default mode it only reports. Switched to clean mode, it rewrites files in place. Its pre-commit hooks check or clean files on their way into git.
• Layer B hands your text to a rewrite model. Out of the box it only prints a rewrite prompt, the documented model option is a local Ollama install, and a remote API needs an explicit flag. Those are the right defaults.
• The README lists third-party desktop apps, a browser app and a hosted text service built around the project, and says plainly that it does not review or vouch for any of them. Pasting client text into a stranger's hosted service in the name of privacy gets things backwards.
• The README also asks other projects not to use look-alike names, because they make it hard to tell which project is which. Fast growing repos attract look-alikes. Check the owner name before you clone.

If you do try it, read the hook and the clean scripts first, pin a release tag instead of the main branch, and run it in a container against copies of your files. Our checklist for evaluating a skill before installing it applies here too.

I skipped installing it because nothing it does fixes a problem we have. Here is what we checked instead.

What we found on our own site

The hero images on jwatte.com are AI generated with Ideogram's API, including the one on this post. On October 28 I checked them with ExifTool.

• 1,196 of the 1,273 WebP images in the site's image folder carry one line of EXIF data: Make: Ideogram AI, plus a timestamp. Our conversion step copies it over from the PNG that Ideogram returns.
• None of our images, whether WebP, PNG or JPEG, carries a C2PA manifest or any XMP.
• The fresh PNG Ideogram returned for this post's image had that same EXIF tag and nothing else. No C2PA manifest and no AI source field.

That label is honest, and anything that drops metadata removes it. We are leaving it in place. These are editorial illustrations, nobody is misled, and anyone who checks gets a straight answer. I cannot tell you whether Ideogram also hides a watermark in the pixels. We have no detector for that, and the API response does not say.

Better options, depending on what worries you

Check what is actually in a file before you worry about it.

• Files made with Claude: claude.com/check-files.
• Any Content Credentials: Content Credentials Verify, or c2patool on the command line. Our Content Credentials checker looks for them on the images of a live page.
• Google's SynthID: upload the file in the Gemini app. Google's help page lists what it can check and the size limits.
• Everything else in the metadata: exiftool -a -G1 yourfile.jpg lists every tag the file carries.

If the worry is privacy on photos you took, remove the location and device data, not everything. exiftool -gps:all= photo.jpg removes only the GPS tags and keeps a backup copy of the original. On Windows, the file's Properties window has a "Remove Properties and Personal Information" link on its Details tab.

If the worry is being accused after AI proofreading, keep your process. Drafts, version history in Google Docs or Word, git commits, outlines and notes show how the work was made, which a stripped mark never can. If the setting asks you to disclose AI help, do it. It usually takes one sentence.

If the worry is invisible characters in code or copy, you already have the tools. VS Code highlights invisible Unicode characters by default. To sweep a folder from a terminal, this lists every zero width, direction control and byte order mark character with its file and line:

grep -rnP '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{FEFF}]' src/

It needs GNU grep and a UTF-8 locale. We ran it against a test file with planted characters before publishing this. Put it in CI and you have the useful half of Layer A with no new dependencies.

If the worry is search ranking, spend the effort where Google actually looks: original inputs, a named person who stands behind the page, and a real method. Our post on the helpful content classifier covers what does drag a site down. Stripping a mark that Google does not rank on changes nothing.

If you do not want a vendor's mark on internal drafts at all, run an open-weight model on hardware you control. With no vendor in the loop there is no vendor watermark, unless the software you run adds one. Our sovereign AI playbook walks through one setup. Whatever you publish afterwards still carries the same disclosure duties.

If you publish AI-assisted content to the public, a short disclosure line costs less than any tool. Our AI content disclosure audit checks a page for the usual signals.

The short version

The marks arrived because the EU now requires them, California requires them for images, video and audio, and the big AI companies chose to apply them everywhere. watermarks-remover is a well documented and honest project. It does a dependable job on metadata and invisible characters and a best-effort job on everything else. For most small businesses and writers, the cheaper path is also the honest one: check what a file carries, strip only what is private, keep your drafts, and say how you used AI.

Related reading

• Content Credentials: How to Prove You're Human in an AI-Generated World: what C2PA is and how to sign your own work.
• Why AI Content Disclosure Audit Exists: the disclosure signals regulators and search engines look for.
• The Agent Skill Marketplace: how to evaluate a skill before you install it.
• Nation-State Malware, Protestware, and the Packages Your AI Pulls In: the dependency side of trusting popular code.
• The HCU Classifier: what actually hurts a site in search.
• The Sovereign AI Playbook: running models on hardware you control.
• DMCA Takedowns and Terms of Use for Developers: the copyright basics behind the 1202 point above.

Fact-check notes and sources

All read on October 28, 2026 (UTC).

• watermarks-remover: the repository and the GitHub API for it (created August 11, 2026; 25,336 stars and 2,881 forks on October 28; MIT license; last push October 26), its releases (v0.0.1 on August 11 to v0.7.0 on September 3), the README (layers, file formats, coverage table, plugin hook, ecosystem list, the disclaimer quoted above), the ethics page and the stealer module README.
• How Claude marks content: Anthropic, How Claude marks AI-generated content (signing the Code, models and surfaces, worldwide scope, detection preview, caveats) and the file checker.
• The SynthID-Text basis, no user identity in the mark, little mark in code: The Batch, How Claude's Watermarks Work, August 21, 2026; Dathathri et al., Scalable watermarking for identifying large language model outputs, Nature, 2024.
• Article 50 text: Article 50 of the EU AI Act.
• The Code of Practice commitments, the December 2, 2026 and February 2, 2027 dates: Cuatrecasas, Code of Practice on Transparency of AI-Generated Content, legal flash, July 2026 (Commitments 1 to 4, including the ban on removal in terms or documentation).
• Signatory counts and Google's July announcement: Morrison Foerster, Full Transparency: Organizations Sign EU Code of Practice on AI Transparency, September 11, 2026 (82 providers and 152 deployers as of September 9).
• California: Morgan Lewis, New California AI disclosure rules become operative, August 2026; National Law Review, California's ongoing AI regulation (media only, not text; platform and device dates).
• Search ranking: Alisa Scharf, Seer Interactive, Google Is Not Going to Stop Ranking Your Claude-Assisted Content, September 4, 2026.
• Research: Zhang et al., Watermarks in the Sand, ICML 2024; Goonatilake and Ateniese, Removing the Watermark Is Not Enough, 2026; ETH Zurich SRI Lab, Probing SynthID.
• Usage policy search: Anthropic's usage policy page as served on October 28, searched for watermark, provenance and tamper. No matches.
• Copyright management information: 17 U.S.C. 1202, Cornell Legal Information Institute.
• Checking tools: Content Credentials Verify, c2patool, Google's Gemini verification help page, ExifTool.
• Our own images: ExifTool 13.50 run on October 28 over every WebP, PNG and JPEG in the site's image folder, plus the original PNG Ideogram's API returned for this post's hero image before conversion.

This post is informational, not legal advice. Mentions of Anthropic, Claude, Google, Gemini, OpenAI, Ideogram, GitHub, Microsoft, Amazon Web Services, Cursor, xAI (Grok), Pangram, Seer Interactive, Morrison Foerster, Cuatrecasas and Morgan Lewis are nominative fair use. No affiliation is implied.