A watermark removal market with nothing to test against

A market for removing AI watermarks appeared within days of Anthropic disclosing that it had switched on invisible marks in everything Claude writes, spanning a GitHub project with more than 4,500 stars, a cluster of newly registered web tools, and at least one established AI detection evasion service ^[1]. None of the claims about defeating the text watermark can currently be checked, because Anthropic has not published how the scheme works or released the detector that would show whether a cleaned document still carries the mark ^[2]. The largest of the tools is watermarks-remover, MIT-licensed, from developer Guillaume Meyer, founder of Memo ^[3]. It started as a Claude-only agent skill and now advertises coverage of Claude, Gemini and SynthID-Text, OpenAI provenance surfaces, and open-weight models using Kirchenbauer-style marks ^[4]. Meyer's post announcing the OpenAI and Gemini support, dated August 11, 2026, passed 2 million views ^[5]. Around it sit repositories including claude-watermark-cleaner, remove-ai-watermarks and noai-watermark, plus web tools including claudewatermark.com, claudewatermark.rip, gptcleanup.com and claudewatermarkremover.app ^[6]. StealthGPT added a Claude watermark remover to its use-case pages ^[7]. Human Writes advertises bypassing Turnitin and GPTZero on essays and assignments, claims to strip Claude's watermark, and carries a footer telling users it must only be used in compliance with academic integrity policies ^[8]. Separate the three things these tools actually do. Stripping hidden characters works and can be counted: zero-width characters, bidirectional controls, Unicode tag characters, lookalike spaces ^[9]. Stripping C2PA, EXIF and XMP metadata from PNG, JPEG, SVG, PDF, DOCX, ODT, HTML and Markdown also works, and is the part that touches Anthropic's signed provenance data directly ^[10]. It is also close to worthless as an achievement, since file metadata does not survive a re-save, a format conversion or a screenshot anyway ^[11]. The watermark itself is not in hidden characters. It lives in which words the model picked, so the only known way to remove it is to rewrite the text heavily with a second model ^[12]. Meyer says so plainly: he posted on Wednesday that his tool removes metadata only for now, and that stripping the actual marks may come later but is not available today ^[13]. His README makes the economic argument against the whole category, noting that a rewrite swaps the original model's word choices for a cheaper model's ^[14]. The commercial sites are less careful, promising clean, undetectable output and returning scores measured against ordinary AI detectors rather than against Anthropic's watermark, for which no public detector exists ^[15]. StealthGPT's own comparison table concedes that "no tool guarantees 100% bypass, detector models update regularly," on the page announcing Claude watermark removal ^[16]. Code review has already found holes. Pasquale Pillitteri cloned the main projects and read the source rather than the READMEs, finding that one popular text cleaner let the most common hidden-payload technique through untouched, with the payload decoding back intact after the supposed clean ^[17]. The compliance context matters more than the removal tools. Anthropic's support page this week says text from models launched on or after August 2, 2026 carries an imperceptible watermark woven into the wording, applied at the model level so it appears across the API, claude.ai, Claude Code, Claude Cowork and Claude Tag, and through AWS, Google Cloud and Microsoft Foundry ^[18][19]. The trigger is Article 50 of the EU AI Act, enforceable since August 2, with penalties reaching 15 million euros or 3% of global turnover ^[20]. Anthropic also acknowledges that a detected mark means content was processed by Claude, not necessarily written by it, so a grammar pass, a translation or a summary of your own prose comes back marked ^[21]. That is the part defenders should sit with: a positive result is not evidence of authorship, and there is currently no way for anyone outside Anthropic to produce a positive result at all ^[2][21].