On August 11, 2026, Anthropic confirmed in its help center that Claude models launched on or after August 2 weave an invisible, machine-readable watermark into all generated text, everywhere Claude is offered. And on the very same day, an open-source project called watermarks-remover appeared on GitHub with a single purpose: strip the provenance marks AI vendors embed in text and files. Six days later the repo sits at 11,918 stars and 1,276 forks (GitHub API, 2026-08-17), MIT-licensed, written in Python. The vendor plants the mark; the community ships the eraser the same day. The opening round of this watermark arms race played out like a script written in advance.
Scope note: this article is based on GitHub API data, Anthropic's help center documentation, reporting by TechCrunch / Interesting Engineering / Chosun, and the project README (as of 2026-08-17); star counts are API snapshots; the legal section summarizes publicly available regulations and is not legal advice; capabilities are per the official repo. This is news analysis, not a removal tutorial.
1. The Six-Day Timeline: Vendor Plants, Community Strips
Laying the two sides' events side by side shows how hot this race is:
| Date | Side | Event |
|---|---|---|
| From 2026-08-02 | Anthropic | Newly launched Claude models begin weaving invisible watermarks into generated text on all channels |
| 2026-08-11 | Anthropic | Help center article updated, formally confirming the scheme (responding to EU AI Act transparency requirements, per Interesting Engineering) |
| 2026-08-11 16:32 UTC | Open source | guillaumemeyer/watermarks-remover repo created, originally named remove-claude-marks - aimed squarely at Claude |
| 2026-08-14 | Media | Chosun's English edition reports "Anthropic's Watermarks Neutralized by Developer's Tool"; the story goes mainstream |
| 2026-08-17 | GitHub API | 11,918 stars / 1,276 forks, v0.5.0 released |
Note that original name: remove-claude-marks. This is not a generic "metadata cleanup utility" - it was born to strip Claude's watermark, then generalized into a multi-vendor tool. Community reaction speed is the most direct vote on the news.
2. What It Actually Strips: A Three-Layer Checklist
Reading the README reveals an eraser more systematic than expected. AI provenance marks exist in three forms, and the tool maps to each:
| Layer | Target | Approach | Result |
|---|---|---|---|
| A | Invisible Unicode, exotic spaces, bidi controls, tag characters | Deterministic Python scripts | Fully removable (lossless) |
| B | Statistical watermarks (SynthID-Text, Kirchenbauer-style token-sampling marks; the signal lives in the wording itself) | Rewrite sentence-by-sentence with another model | Best-effort only |
| Files | C2PA / EXIF / XMP metadata across PNG, JPEG, WebP, GIF, TIFF, SVG, PDF, DOCX, EPUB, HTML, Markdown and 13+ formats | Drop metadata segments (PDF needs exiftool + qpdf structural rebuild) | Removable |
Even pixel-domain image watermarks (SynthID for images, StegaStamp, Tree-Ring-class) get two optional heavy backends (CtrlRegen regenerating removal, DiffusionPurification diffusion purification), at the cost of multi-GB model downloads and a strongly recommended GPU. The whole project has zero dependencies (Python 3.10+ stdlib only) and works as an agent skill plus a local HTTP service.
But the most valuable part of the README is what it admits it cannot do:
- C2PA "soft binding" is out of scope. That is provenance embedded in the content itself - a watermark that can re-link a remote Content Credentials manifest even after metadata is stripped. The README states plainly: out of scope; stripping hard-bound C2PA does not clear those channels.
- No one can honestly certify "it passes the check." Until vendors publish detectors and keys, no tool can verify "this content is undetectable." Removal can only be attempted, never proven.
3. The Vendors' Half Is Escalating Too
While the stripping side celebrates, the embedding side has not paused: OpenAI has adopted the C2PA open standard and partnered with Google to embed SynthID invisible watermarks in its generated images; EU AI Act content-transparency obligations are landing; academia is simultaneously studying "desynchronized provenance" attacks (a 2026 arXiv paper). Watermarking is no longer one vendor's product feature - it is becoming infrastructure for the entire industry. That is the real backdrop for 12K stars in 6 days: this project is not stripping Claude, it is stripping the foundation everyone is being asked to install.
4. Three Buckets of Cold Water, and One Real Red Line
Beyond the hype, three buckets of cold water - the first two from the README itself:
- Stripping a statistical watermark = heavy rewriting, and rewriting = degradation. The signal is spread across the wording of nearly every sentence; light edits (new headline, reshuffled paragraphs) barely move it. You must rewrite sentence by sentence, and the rewriting model's ceiling becomes your output's ceiling. The README even asks itself the full-circle question: "If the plan is to rewrite the text with a cheaper model anyway, why pay for a premium model in the first place?"
- Rewriting with the origin model re-stamps the mark. Cleaning Claude's marks means rewriting with another vendor's model - and residual risk never disappears.
- "Clean" is not guaranteed. See above: soft binding is unaddressed, and no public detector exists to verify against.
Then the red line. China's Measures for Labeling of AI-Generated Synthetic Content, jointly issued by the CAC and three other regulators, took effect on September 1, 2025, together with the mandatory national standard GB 45438. It requires AI-generated content to carry both explicit labels (user-perceivable notices) and implicit labels (technical marks in file metadata; digital watermarks encouraged). And the final paragraph of Article 10 is blunt: labels must not be maliciously deleted, altered, fabricated, or concealed by any organization or individual, and tools and services must not be provided for others to conduct such malicious conduct; users publishing AI-generated content via platforms must proactively declare it and use platform labeling functions.
In other words, in China, using this tool to clean invisible characters from your own documents versus stripping labels from AI content before publishing it are two entirely different legal postures. The former is hygiene; the latter can brush directly against regulatory text - strip the label, the platform fails to verify implicit metadata, the provenance surfaces later, and "I didn't know it was AI-generated" does not stand up in front of metadata. The project's own README carries the disclaimer: for content you own or are authorized to process; users must adhere to local regulations.
One-line verdict: this is the fastest living textbook on the "AI content provenance" category - how vendors plant, how the community strips, how the law draws lines, all in the same week. Understanding it matters more than using it.
Frequently Asked Questions
Q1: Is using watermarks-remover illegal? A1: It depends on the scenario. In China, privacy hygiene on your own content (clearing residual invisible Unicode from documents, tidying metadata before external release) is legitimate use. But the labeling Measures' Article 10 forbids any organization or individual from maliciously deleting, altering, fabricating, or concealing AI-generated content labels, and forbids providing tools or services for such conduct. Stripping labels from published AI content to pass it off or dodge disclosure carries clear compliance risk. This is not legal advice; consult a professional for specific cases.
Q2: Can invisible watermarks be stripped completely? A2: Not guaranteed. Invisible Unicode and file metadata can be removed deterministically; but statistical watermarks woven into the wording can only be "best-effort" removed by heavy sentence-level rewriting, and C2PA soft binding (watermarks embedded in the content itself) is explicitly out of reach. More importantly, until vendors publish detectors, no tool can prove "undetectable." The README says so itself.
Q3: Does stripping a watermark hurt writing quality? A3: Yes. The signal is distributed across the wording of nearly every sentence, so the only removal path is a substantial rewrite with another model - which flattens tone, voice, and precision. The output ceiling is the rewriting model's ceiling. The README's own words: if you plan to rewrite with a cheaper model anyway, generate directly with the cheaper model.
Q4: What exactly does China require for AI content labeling? A4: The Measures for Labeling of AI-Generated Synthetic Content took effect September 1, 2025 (CAC and three other departments, with mandatory national standard GB 45438): providers must add explicit labels (user-perceivable) and implicit labels (file metadata, digital watermarks encouraged) to AI-generated content; distribution platforms must verify metadata and provide labeling functions; ordinary users publishing AI content must proactively declare it. No organization or individual may maliciously delete, alter, fabricate, or conceal labels.
Q5: How should ordinary people respond to this watermark arms race? A5: Three moves. First, when publishing AI-assisted content, declare it with the platform's labeling function - don't try to strip; compliance cost is far below risk. Second, when receiving manuscripts or outsourcing work, check C2PA/metadata to verify whether content is AI-generated. Third, treat it as an observation window: watermark-vs-eraser offense and defense will grind on for years; understanding "labels are infrastructure" beats picking a side.
References
- GitHub: guillaumemeyer/watermarks-remover (11,918 stars / 1,276 forks, MIT, Python, v0.5.0, API snapshot 2026-08-17; repo created 2026-08-11, formerly remove-claude-marks)
- Anthropic Help Center: Claude invisible watermark documentation (updated 2026-08-11; effective for models launched on or after August 2, on all channels)
- TechCrunch: Anthropic says it will watermark text generated by its AI models (2026-08-11)
- Interesting Engineering: Anthropic puts hidden watermarks on Claude text under new EU rules (2026-08)
- Chosun (English edition): Anthropic's Watermarks Neutralized by Developer's Tool (2026-08-14)
- CAC and three other departments: Measures for Labeling of AI-Generated Synthetic Content (published 2025-03-14, effective 2025-09-01) and mandatory national standard GB 45438
- TNW: OpenAI adopts C2PA standard and Google's SynthID
- arXiv: Authenticated Contradictions from Desynchronized Provenance and Watermarking (2603.02378)
This article is compiled from public reporting, official documentation, and regulatory texts (2026-08-17); not a hands-on reproduction; the legal section is not legal advice; stars and capabilities per the official repo. Related reading: SynthID-Text Open-Source Teardown | AI Content Detector Tools Compared | AI Content Labeling Compliance SOP