Anthropic published a support page this month describing how it marks Claude's output: an imperceptible watermark woven into the wording of text from models launched on or after August 2, 2026, and signed C2PA provenance metadata on supported files. We went through what that page says and does not say on August 11.
A market to remove the mark arrived within days. Nobody in it can prove the central claim, and neither can anyone reviewing it, because Anthropic has published no detector.
What the reporting found
Ax Sharma surveyed the category for BleepingComputer on August 13, 2026, in AI 'watermark removers' flood the web. Almost none can prove they work. The survey covers an MIT-licensed GitHub project from Guillaume Meyer, founder of Memo, which BleepingComputer counted at "over 4,500 stars" on the day it published, a handful of smaller repositories, a cluster of newly registered web tools, and the commercial tier: StealthGPT, which "sells AI detection evasion, added a Claude watermark remover to its use-case pages," and Human Writes, which "advertises bypassing Turnitin and GPTZero on essays and assignments, claims to strip Claude's watermark, and carries a footer telling users it must only be used in compliance with academic integrity policies." Meyer's post about the project passed 2 million views, per the same reporting.
Star counts and view counts drift, so read those two figures as August 13 snapshots rather than current numbers. We are not linking any of the tools, and the names above appear because BleepingComputer named them.
One caution belongs at the top, in BleepingComputer's own words:
"Note: BleepingComputer has not audited or tested any of the tools named in this article. Readers should treat them with the same caution as any other unvetted code from the internet."
BleepingComputer surveyed this market rather than testing it. The only hands-on code inspection the piece cites belongs to Pasquale Pillitteri, who "cloned the main projects and read the code rather than the READMEs, finding that one popular text cleaner let the most common hidden-payload technique through untouched. The hidden payload decoded back intact after the tool had supposedly cleaned the text." One tool, one technique, checked by reading the source instead of the marketing.
Three products, one name
"Watermark remover" is being used for three different jobs with three different success rates.
The first is stripping hidden characters out of text. BleepingComputer's summary is that this "works and can be counted."
The second is stripping C2PA, EXIF and XMP metadata out of files, which also works "across PNG, JPEG, SVG, PDF, DOCX, ODT, HTML and Markdown." This is the part that touches Anthropic's signed provenance data directly, and BleepingComputer's assessment of it is worth keeping: "it is also not much of an achievement. File metadata does not survive a re-save, a format conversion or a screenshot anyway." A tool that clears provenance from a PNG has matched the capability of pressing Cmd-Shift-4.
The third is the one people are actually buying, and it is the one the most-starred project's author says his tool does not do today. Where a vendor does claim it, the claim cannot be checked. "The watermark lives in which words the model picked, which means the only known way to remove it is to rewrite the text heavily, using a second model."
Meyer is candid about the gap in his own project. BleepingComputer reports that he is "unusually candid about this, posting on Wednesday that his tool removes metadata only for now, and that stripping the actual marks may come later but is not available today." That Wednesday was August 12, 2026. His README goes further and argues against the feature everyone is waiting for: per BleepingComputer, it argues "that a rewrite swaps the original model's word choices for the cheaper model's, and asking why anyone paying for a premium model would then run its output through a worse one." Replying to a critic who called watermarking a compliance checkbox rather than a real defense, Meyer agreed on the first half: it is "pure compliance to stay in the EU market."
The developer with the most-starred project in the category is telling you his tool removes metadata, that word-level removal is not shipped, and that the shipped version of it would degrade your writing. The commercial sites are less careful, and BleepingComputer says so: "Several promise clean, undetectable output."
The claim nobody can test
BleepingComputer reports that StealthGPT's own comparison table carries the caveat that "no tool guarantees 100% bypass, detector models update regularly," on the same page where it announces it now removes Claude watermarks. Whatever score a site shows you is measured against something, and per BleepingComputer, the something is usually the wrong target: the scores "are measured against ordinary AI detectors rather than against Anthropic's watermark, for which no public detector exists."
That absence is the story. Anthropic's own support page commits to detection without shipping it: "We're also working to enable users and other third parties to detect Claude's embedded watermarks and provenance metadata... We'll share details on detection mechanisms in forthcoming technical documentation." Until that lands, a claim that a document came out clean cannot be confirmed or refuted by the vendor, the buyer, a journalist or us.
There is a second reason to sit still. As of today, no Claude model has launched on or after August 2, 2026. Anthropic's page says models launched on or after that date "support marking at launch" and that existing ones "are in progress." The current lineup all predates the cutoff, Fable 5 on June 9, Sonnet 5 on June 30, Opus 5 on July 24, and the Claude Platform release notes list no model launch since. So the marking cohort is empty, and this market is selling protection against a mark that no shipped model is applying yet.
The supply-chain part, for people who install skills
Our readers run agent pipelines. That makes the installation mechanism more interesting than the marketing.
BleepingComputer describes it plainly: the leading project "ships as an agent skill, installed by symlinking a directory into a local skills folder and invoked with a slash command. Its optional scoring setup clones a third-party research repository and pulls a roughly 220MB artifact."
Read that as an inventory of trust decisions. A symlink into a skills folder means an agent loads the code every session. A slash command means it runs inside a context that already has your files. A 220MB pull from a third-party repository means a dependency you did not choose and will not review. And the documents you hand it are, by definition, the ones you were worried about.
BleepingComputer's framing of where this goes: "The projects currently in the space are at least open and readable, even where they ship no licence at all. The next wave, arriving into a market with over four thousand stars of proven demand and no way for buyers to verify any claim, may not be."
If you install agent skills at all, including from the Skills Hub we run for Routines, the practical takeaway has nothing to do with watermarks. Look at what is currently symlinked into your skills folder, and at what each of those skills can reach.
Disclosure costs one sentence
Our position on this has not changed since the rollout piece, and this week's reporting strengthens it. Stripping a mark buys you deniability about a fact you could have stated in one sentence, and it commits you to maintaining that deniability against detection tooling that has not shipped yet. When the detector does land, the people who disclosed will have nothing to revisit.
"First draft written with Claude, edited by me" survives every format conversion, every paste into the wrong editor and every re-save. It needs no maintenance and no vendor.
Routines, the Mac app we build, publishes audits of AI vendors written only from each vendor's own published documents. The habit behind those audits is the one this market inverts: state what a tool does, in writing, where a reader can check it.
Disclosure: the content on this site, this article included, is produced with Claude's help. Under Anthropic's stated rules none of it carries an embedded watermark, because no model in the marking cohort has shipped, which is exactly why this sentence is here instead of a mark nobody can check.
BleepingComputer's survey is worth reading in full, and Anthropic's support page is the document to watch, because it is where the detector will be announced when one exists.
FAQ
Does any Claude watermark remover work?
Nobody can say, in either direction. Anthropic has published no detector for its text watermark, so there is no way to take a document through one of these tools and check whether the mark survived. BleepingComputer's survey of the category, published August 13, 2026, makes the same point: "None of the claims about defeating the text watermark can currently be checked ... because Anthropic has not yet published how it works or released the detector." Anything a vendor asserts about defeating the text watermark today is an assertion, not a result.
Can anyone verify a removal claim right now?
No, including us. The only public checks available are ordinary AI-writing detectors, which are unrelated to Anthropic's watermark. BleepingComputer notes that the scores some commercial sites return "are measured against ordinary AI detectors rather than against Anthropic's watermark, for which no public detector exists". BleepingComputer reports that StealthGPT's own comparison table carries the caveat that "no tool guarantees 100% bypass, detector models update regularly", on the same page where it announces it now removes Claude watermarks.
Is it safe to install a watermark remover?
Treat it as unvetted code, because that is what it is. BleepingComputer added an explicit note to its own survey: "BleepingComputer has not audited or tested any of the tools named in this article. Readers should treat them with the same caution as any other unvetted code from the internet." The mechanism matters for anyone running agents: the most-starred project installs as an agent skill by symlinking a directory into a local skills folder, is invoked with a slash command, and its optional scoring setup clones a third-party research repository and pulls a roughly 220MB artifact. You then feed your own documents through it.
Do metadata strippers actually remove Claude's provenance data?
Removing C2PA, EXIF and XMP metadata from files works, and it is the least impressive part of the category. BleepingComputer puts it flatly: "File metadata does not survive a re-save, a format conversion or a screenshot anyway." So a tool that clears signed provenance from a PNG or a PDF is doing something a screenshot already does. It has no effect on the text watermark, which is not stored in the file.
Where does Claude's watermark actually live?
In the wording. Anthropic's support page says it "weaves an imperceptible watermark directly into the text itself", and BleepingComputer's technical summary agrees: "The watermark lives in which words the model picked, which means the only known way to remove it is to rewrite the text heavily, using a second model." That is why stripping hidden characters or file metadata, both of which do work, does not touch it.
Is any Claude text watermarked yet?
Not from any shipped model, as of August 14, 2026. Anthropic's page states that "Claude models launched on or after August 2, 2026 support marking at launch" and that existing models "are in progress". No Claude model has launched on or after that date: Fable 5 (June 9, 2026), Sonnet 5 (June 30, 2026) and Opus 5 (July 24, 2026) all predate the cutoff, and the Claude Platform release notes show no new model since. The marking cohort is currently empty.
What should I do instead of hunting for a remover?
Write the disclosure. One line at the top of a document, "first draft written with Claude, edited by me", costs nothing, survives every format conversion and paste, and does not need maintaining. Stripping a mark buys deniability about a fact you could have stated in a sentence, and commits you to holding that deniability against detection tooling that has not shipped yet. If you run agent pipelines, the other useful action is auditing what is already symlinked into your skills folder.
Sources
- BleepingComputer, Ax Sharma, "AI 'watermark removers' flood the web. Almost none can prove they work", published August 13, 2026, accessed August 14, 2026
- Anthropic, "How Claude Marks AI-Generated Content", re-verified August 14, 2026
- Claude Platform release notes, platform.claude.com, checked August 14, 2026 for model launches on or after August 2, 2026