Anthropic's Invisible AI Watermarks Were Cracked in Four Hours
The EU's new content-labelling rules forced Anthropic to watermark every Claude response. Developers tore through the system before the news cycle ended. Here's what that means for workers, writers, and anyone who uses AI tools.
Key points
- Anthropic confirmed Claude now embeds invisible, machine-readable watermarks in all AI-generated text to comply with the EU AI Act, which came into force earlier this month.
- Developer Guillaume Meyer published working removal code within four hours; the repository has since collected more than 20,000 bookmarks on X and more than 100 contributors on GitHub.
- The EU AI Act requires AI providers to label synthetic text, audio, images and video so machines can detect AI-generated content, or face fines of up to 3 percent of annual turnover.
- Independent removal tools aren't illegal under current rules; only providers themselves are banned from marketing ways to strip watermarks.
- Anthropic plans to release a detection tool, called a text-detection API, that will let anyone check whether a piece of writing carries a watermark.
Four hours. That's how long Anthropic's new content-labelling system survived before the first working bypass appeared online.
The AI company confirmed last week that its Claude chatbot would embed invisible watermarks into every response to meet new European Union rules. Guillaume Meyer, a freelance developer, published his removal code the same day, and it spread fast.
What exactly is a watermark here?
Anthropican's approach isn't a visible stamp. Anthropic uses a technique called SynthID, originally developed by Google for its own AI content since 2023, which subtly influences which words and phrases Claude chooses, creating a hidden pattern a machine can detect but a human reader can't see.
The law behind this is the EU AI Act. Rules that took effect this month require companies like Anthropic and OpenAI to label AI-generated content so it can be identified automatically. Providers that skip this face fines worth up to 3 percent of their worldwide annual revenue. A further 190 organisations, including OpenAI and Meta, have signed a separate EU transparency code. All new AI models must carry watermarks from August; existing models must add them by December.
We first reported that Anthropic was heading down this road on 11 August, in our story on how the mandatory change would work, and have since tracked watermarking across six stories in the last 90 days.
Why are developers trying to remove them?
Meyer told Wired his motivation is partly technical curiosity and partly a genuine objection to how the system works. As a native French speaker who uses Claude and tools like Grammarly to polish his writing, he worries an invisible mark could brand lightly edited text as fully AI-generated. Employers rejecting CVs, universities flagging research papers: he sees those as real risks when the detection system produces a probability, not a certainty.
Anthropican confirmed that heavily paraphrased or translated text may not retain its watermark at all, which raises its own questions about reliability.
Meyer's tool feeds Claude's output into a separate AI model without watermarking to generate rewrites, swapping synonyms and reorganising sentence structure. Other developers have built their own versions. Software engineer Erik Hughes built one in 15 minutes using Claude itself. Oxford Visiting Fellow Leon Chlon found that translating text into Arabic and back strips the watermark, because Arabic sentence structure is different enough to destroy the hidden pattern. None of these tools are illegal: the EU rules prohibit providers from selling removal software, but independent coders face no such restriction.
| Method | Who built it | Time taken |
|---|---|---|
| Synonym-swap via second AI model | Guillaume Meyer | Same day as announcement |
| Character removal and sentence reorder | Erik Hughes | 15 minutes |
| Translate to Arabic, translate back | Leon Chlon (Oxford) | Not stated |
Should workers and writers be worried?
The honest answer depends on how employers and institutions use the detection tool Anthropic is still building. Right now no public checker exists, so watermarks can't actually be verified by anyone outside Anthropic.
When that detection tool arrives, the bigger concern is false positives. Anthropic acknowledges its system assigns a probability, not a verdict. Using that probability to disqualify a job application or accuse a student of cheating would be unfair, and people who use AI lightly to proofread their own work face the same flag as people who paste in a fully generated document.
The one practical thing you can do right now: keep your own drafts. A version history showing your work developed over time is stronger evidence of authorship than any watermark detection result.
Common questions
Does this mean Claude's responses will get worse?
Anthropican says no. The watermarking influences word choice at the margin but doesn't change the meaning or readability of responses. Some users are sceptical, but no independent testing has confirmed any quality drop yet.
Is using one of these removal tools against the law?
Not under current EU rules, which only prohibit AI providers from marketing removal tools themselves. Individual users and developers can build and use them freely. That could change if regulators revisit the legislation.
