Anthropic's Invisible AI Watermarks Were Cracked in Four Hours
The EU's new content-labelling rules forced Anthropic to watermark every Claude response. Developers tore through the system before the news cycle ended. Here is what that means for workers, writers, and anyone who uses AI tools.
Key points
- Anthropic confirmed Claude now embeds invisible, machine-readable watermarks in all AI-generated text to comply with the EU AI Act, which came into force earlier this month.
- Developer Guillaume Meyer published working removal code within four hours; the repository has since collected more than 20,000 bookmarks on X and more than 100 contributors on GitHub.
- The EU AI Act requires AI providers to label synthetic text, audio, images and video so machines can detect it, or face fines of up to 3 percent of annual turnover.
- Independent removal tools are not illegal under the current rules; only providers themselves are banned from marketing ways to strip watermarks.
- Anthropic plans to release a detection tool, called a text-detection API, that will let anyone check whether a piece of writing carries a watermark.
Four hours. That is how long Anthropic's new content-labelling system survived before the first working bypass appeared online.
The AI company confirmed last week that its Claude chatbot would embed invisible watermarks into every response, to meet new European Union rules. Guillaume Meyer, a freelance developer, published his removal code the same day. It spread fast.
What exactly is a watermark here?
It is not a visible stamp. Anthropic uses a technique called SynthID, originally developed by Google and used on Google's own AI content since 2023. The system subtly influences which words and phrases Claude chooses, creating a hidden pattern that a machine can detect but a human reader cannot see.
The law behind this is the EU AI Act. New rules that took effect this month require companies like Anthropic and OpenAI to label AI-generated content so it can be identified automatically. Providers that skip this face fines worth up to 3 percent of their worldwide annual revenue. A further 190 organisations, including OpenAI, Microsoft and Meta, have signed a separate EU transparency code. All new AI models must carry watermarks from August; existing models must add them by December.
Why are developers trying to remove them?
Meyer told Wired his own motivation is partly technical curiosity and partly a genuine objection to how the system works. As a native French speaker who uses Claude and tools like Grammarly to polish his writing, he worries an invisible mark could brand lightly edited text as fully AI-generated. Employers rejecting CVs, universities flagging research papers: he sees those as real risks when the detection system itself only produces a probability, not a certainty.
Anthopic confirmed that heavily paraphrased or translated text may not retain its watermark at all, which raises its own questions about reliability.
Meyer's tool feeds Claude's output into a separate AI model (one without watermarking) to generate rewrites, swapping synonyms and shuffling sentence structure. Other developers have built their own versions. Software engineer Erik Hughes built one in 15 minutes using Claude itself. Oxford Visiting Fellow Leon Chlon found that translating text into Arabic and back strips the watermark, because Arabic sentence structure is different enough to destroy the hidden pattern.
Crucially, none of these tools are illegal. The EU rules prohibit providers from selling removal software, but independent coders face no such restriction.
| Method | Who built it | Time taken |
|---|---|---|
| Synonym-swap via second AI model | Guillaume Meyer | Same day as announcement |
| Character removal and sentence reorder | Erik Hughes | 15 minutes |
| Translate to Arabic, translate back | Leon Chlon (Oxford) | Not stated |
Should workers and writers be worried?
The honest answer is: it depends on how employers and institutions use the detection tool Anthropic is still building. Right now, no public checker exists, so watermarks cannot actually be verified by anyone outside Anthropic.
When that detection tool arrives, the bigger concern is false positives. Anthropic acknowledges its system assigns a probability, not a verdict. Using that probability to disqualify a job application or accuse a student of cheating would be unfair, and people who use AI lightly to proofread their own work face the same flag as people who paste in a fully generated document.
The one practical thing you can do right now: keep your own drafts. A version history showing your work developed over time is stronger evidence of authorship than any watermark detection result.
Common questions
Does this mean Claude's responses will get worse?
Anthopic says no. The watermarking influences word choice at the margin but does not change the meaning, quality or readability of responses. Some users are sceptical, but no independent testing has confirmed any quality drop yet.
Is using one of these removal tools against the law?
Not under current EU rules, which only prohibit AI providers from marketing removal tools themselves. Individual users and developers can build and use them freely. That could change if regulators revisit the legislation.
