Anthropic published a support page in August 2026 describing how it marks Claude's output: an imperceptible watermark woven into the wording of text from models launched on or after August 2, 2026, and signed C2PA provenance metadata on supported files. We went through what that page says and does not say on August 11.
A market to remove the mark arrived within days. Nobody in it can prove the central claim, and neither can most buyers, because Anthropic's detector is in a private preview limited to eligible organizations such as regulators and fact-checkers.
What the reporting found
Ax Sharma surveyed the category for BleepingComputer on August 13, 2026, in AI 'watermark removers' flood the web. Almost none can prove they work. The survey covers an MIT-licensed GitHub project from Guillaume Meyer, founder of Memo, which BleepingComputer counted at "over 4,500 stars" on the day it published, a handful of smaller repositories, a cluster of newly registered web tools, and the commercial tier: StealthGPT, which "sells AI detection evasion, added a Claude watermark remover to its use-case pages," and Human Writes, which "advertises bypassing Turnitin and GPTZero on essays and assignments, claims to strip Claude's watermark, and carries a footer telling users it must only be used in compliance with academic integrity policies." Meyer's post about the project passed 2 million views, per the same reporting.
Star counts and view counts drift, so read those two figures as August 13 snapshots rather than current numbers. We are not linking any of the tools, and the names above appear because BleepingComputer named them.
One caution belongs at the top, in BleepingComputer's own words:
"Note: BleepingComputer has not audited or tested any of the tools named in this article. Readers should treat them with the same caution as any other unvetted code from the internet."
BleepingComputer surveyed this market rather than testing it. The only hands-on code inspection the piece cites belongs to Pasquale Pillitteri, who "cloned the main projects and read the code rather than the READMEs, finding that one popular text cleaner let the most common hidden-payload technique through untouched. The hidden payload decoded back intact after the tool had supposedly cleaned the text." One tool, one technique, checked by reading the source instead of the marketing.
Three products, one name
"Watermark remover" is being used for three different jobs with three different success rates.
The first is stripping hidden characters out of text. BleepingComputer's summary is that this "works and can be counted." It also has no bearing on the text watermark, and Anthropic's own explainer, How Claude's text watermark works, published August 14, 2026, is blunt about why: "Nothing is added to the text and there are no hidden characters."
The second is stripping C2PA, EXIF and XMP metadata out of files, which also works "across PNG, JPEG, SVG, PDF, DOCX, ODT, HTML and Markdown." This is the part that touches Anthropic's signed provenance data directly, and BleepingComputer's assessment of it is worth keeping: "it is also not much of an achievement. File metadata does not survive a re-save, a format conversion or a screenshot anyway." A tool that clears provenance from a PNG has matched the capability of pressing Cmd-Shift-4.
The third is the one people are actually buying, and it is the one the most-starred project's author says his tool does not do today. Where a vendor does claim it, the claim cannot be checked. BleepingComputer's technical summary: "The watermark lives in which words the model picked, which means the only known way to remove it is to rewrite the text heavily, using a second model."
Anthropic's explainer describes the same mechanism in more detail. The watermark is a keyed choice among words that would have read fine either way: "Instead of using an arbitrary random number generator to pick the next word, watermarking uses the key and a few words that come before to settle what word the model should pick." The resulting pattern "is undetectable to the reader, but is detectable to anyone who has a key that encodes it." Anthropic holds the key. On editing, the same page says: "Light editing probably won't remove the watermark completely; a complete rewrite where every word is replaced will." That is Anthropic describing its own method. Outside Anthropic and its detector's private preview, nobody can run that check on a specific document today.
Meyer is candid about the gap in his own project. BleepingComputer reports that he is "unusually candid about this, posting on Wednesday that his tool removes metadata only for now, and that stripping the actual marks may come later but is not available today." That Wednesday was August 12, 2026. His README goes further and argues against the feature everyone is waiting for: per BleepingComputer, it argues "that a rewrite swaps the original model's word choices for the cheaper model's, and asking why anyone paying for a premium model would then run its output through a worse one." Replying to a critic who called watermarking a compliance checkbox rather than a real defense, Meyer agreed on the first half: it is "pure compliance to stay in the EU market."
The developer with the most-starred project in the category is telling you his tool removes metadata, that word-level removal is not shipped, and that the shipped version of it would degrade your writing. The commercial sites are less careful, and BleepingComputer says so: "Several promise clean, undetectable output."
The claim a buyer cannot test
BleepingComputer reports that StealthGPT's own comparison table carries the caveat that "no tool guarantees 100% bypass, detector models update regularly," on the same page where it announces it now removes Claude watermarks. Whatever score a site shows you is measured against something, and per BleepingComputer, the something is usually the wrong target: the scores "are measured against ordinary AI detectors rather than against Anthropic's watermark, for which no public detector exists."
Anthropic draws the same line from its side. Asked in its explainer how the watermark differs from AI detection software like Pangram, it answers that those services work by other means because "the companies that provide it don't have our key," so they "look at aspects of the text like the subtle (and not-so-subtle) 'tells' that often appear in AI's phrasing." Its verdict on the two methods: "Picking up on these patterns is fundamentally different from checking for a watermark." A detector score, then, says nothing about the watermark either way.
That gap is the story. Anthropic's support page now says: "Watermark detection is currently in private preview, available to eligible organizations as required under EU law (such as regulators, law enforcement, media, fact-checkers, independent researchers, educational organizations, and EU civil society groups)." The explainer, updated September 1, 2026, puts it in one line: "We are releasing a detection API in private preview." An eligible fact-checker can apply for that check. A typical buyer looking at a vendor's before-and-after demo cannot, and neither can we.
Update, October 28, 2026: when we published, no Claude model had launched on or after August 2, 2026, and this paragraph argued the market was selling protection against a mark no shipped model applied. That argument no longer holds. The Claude Platform release notes list Claude Fable 5.1 and Claude Mythos 5.1 on September 1, 2026, Claude Opus 5.5 on September 22, 2026, Claude Sonnet 5.5 on September 28, 2026 and Claude Haiku 5.5 on October 7, 2026, and state: "Text generated by Claude Fable 5.1 and Claude Mythos 5.1 carries Anthropic's text watermark." Anthropic's Opus 5.5 announcement says: "As with Fable 5.1, Opus 5.5 comes with our watermarking measures to comply with the EU AI Act." The support page's table, "Which Claude models support watermarking", shows text watermarks on first-party surfaces for those five and for Fable 5, Opus 5, Opus 4.8 and Sonnet 5, which launched before the cutoff. So the mark is live on those nine models. The test is what has not changed: a buyer outside the detector's private preview still cannot check whether a remover takes it out.
The supply-chain part, for people who install skills
Our readers run agent pipelines. That makes the installation mechanism more interesting than the marketing.
BleepingComputer describes it plainly: the leading project "ships as an agent skill, installed by symlinking a directory into a local skills folder and invoked with a slash command. Its optional scoring setup clones a third-party research repository and pulls a roughly 220MB artifact."
Read that as an inventory of trust decisions. A symlink into a skills folder means an agent loads the code every session. A slash command means it runs inside a context that already has your files. A 220MB pull from a third-party repository means a dependency you did not choose and will not review. And the documents you hand it are, by definition, the ones you were worried about.
BleepingComputer's framing of where this goes: "The projects currently in the space are at least open and readable, even where they ship no licence at all. The next wave, arriving into a market with over four thousand stars of proven demand and no way for buyers to verify any claim, may not be."
If you install agent skills at all, including from the Skills Hub we run for Routines, the practical takeaway has nothing to do with watermarks. Look at what is currently symlinked into your skills folder, and at what each of those skills can reach.
Disclosure costs one sentence
Our position on this has not changed since the rollout piece, and the August 13 reporting strengthened it. Stripping a mark buys you deniability about a fact you could have stated in one sentence, and it commits you to maintaining that deniability against detection tooling that is already in private preview. When access widens, the people who disclosed will have nothing to revisit.
"First draft written with Claude, edited by me" survives every format conversion, every paste into the wrong editor and every re-save. It needs no maintenance and no vendor.
Routines, the Mac app we build, publishes audits of AI vendors written only from each vendor's own published documents. The habit behind those audits is the one this market inverts: state what a tool does, in writing, where a reader can check it.
Disclosure: the content on this site, this article included, is produced with Claude's help. Text written with the models in Anthropic's table may now carry the embedded watermark, and a reader has no public way to check it, which is why this sentence is here.
BleepingComputer's survey is worth reading in full. Anthropic's support page and its August 14 explainer are the documents to watch, because that is where Anthropic has announced detection changes so far.
FAQ
Does any Claude watermark remover work?
A buyer cannot tell, in either direction. Anthropic's detector for its text watermark is in private preview for eligible organizations, such as regulators, media, fact-checkers and independent researchers, so a buyer outside those groups has no way to take a document through one of these tools and check whether the mark survived. BleepingComputer's survey of the category, published August 13, 2026, a day before Anthropic's explainer, reached the same verdict: "None of the claims about defeating the text watermark can currently be checked ... because Anthropic has not yet published how it works or released the detector." Anthropic has since described the method, and its explainer, updated September 1, 2026, now says: "We are releasing a detection API in private preview." Until a buyer can run that check, anything a vendor asserts about defeating the text watermark is an assertion, not a result.
Can anyone verify a removal claim right now?
Not most buyers, and not us. Anthropic's detector is in private preview for eligible organizations, and the only checks open to everyone else are ordinary AI-writing detectors, which are unrelated to Anthropic's watermark. BleepingComputer notes that the scores some commercial sites return "are measured against ordinary AI detectors rather than against Anthropic's watermark, for which no public detector exists". BleepingComputer reports that StealthGPT's own comparison table carries the caveat that "no tool guarantees 100% bypass, detector models update regularly", on the same page where it announces it now removes Claude watermarks. Anthropic's August 14 explainer draws the same line: AI detection software such as Pangram does not have Anthropic's key, and "Picking up on these patterns is fundamentally different from checking for a watermark."
Is it safe to install a watermark remover?
Treat it as unvetted code, because that is what it is. BleepingComputer added an explicit note to its own survey: "BleepingComputer has not audited or tested any of the tools named in this article. Readers should treat them with the same caution as any other unvetted code from the internet." The mechanism matters for anyone running agents: the most-starred project installs as an agent skill by symlinking a directory into a local skills folder, is invoked with a slash command, and its optional scoring setup clones a third-party research repository and pulls a roughly 220MB artifact. You then feed your own documents through it.
Do metadata strippers actually remove Claude's provenance data?
Removing C2PA, EXIF and XMP metadata from files works, and it is the least impressive part of the category. BleepingComputer puts it flatly: "File metadata does not survive a re-save, a format conversion or a screenshot anyway." So a tool that clears signed provenance from a PNG or a PDF is doing something a screenshot already does. It has no effect on the text watermark, which is not stored in the file.
Where does Claude's watermark actually live?
In the wording. Anthropic's support page says it "weaves an imperceptible watermark directly into the text itself", and its August 14 explainer gives the mechanism: "Instead of using an arbitrary random number generator to pick the next word, watermarking uses the key and a few words that come before to settle what word the model should pick." The same page states that "Nothing is added to the text and there are no hidden characters." BleepingComputer's technical summary agrees: "The watermark lives in which words the model picked, which means the only known way to remove it is to rewrite the text heavily, using a second model." That is why stripping hidden characters or file metadata, both of which do work, does not touch it.
Is any Claude text watermarked yet?
Yes, from some models, as of October 28, 2026. Anthropic's support page states that "Claude models launched on or after August 2, 2026 support marking at launch", and its table "Which Claude models support watermarking" shows text watermarks on first-party surfaces for Claude Fable 5.1, Claude Fable 5, Claude Mythos 5.1, Claude Opus 5.5, Claude Opus 5, Claude Opus 4.8, Claude Sonnet 5.5, Claude Sonnet 5 and Claude Haiku 5.5. The Claude Platform release notes date Fable 5.1 and Mythos 5.1 to September 1, 2026, Opus 5.5 to September 22, 2026, Sonnet 5.5 to September 28, 2026 and Haiku 5.5 to October 7, 2026. The other four launched before the cutoff, Opus 4.8 on May 28, 2026 and Opus 5 on July 24, 2026 among them. The table shows no text watermark yet for the other seven models it lists, Mythos 5, Opus 4.7, Opus 4.6, Opus 4.5, Sonnet 4.6, Sonnet 4.5 and Haiku 4.5, and the page says "Anthropic is adding watermarks to outputs from models released before August 2, 2026."
What should I do instead of hunting for a remover?
Write the disclosure. One line at the top of a document, "first draft written with Claude, edited by me", costs nothing, survives every format conversion and paste, and does not need maintaining. Stripping a mark buys deniability about a fact you could have stated in a sentence, and commits you to holding that deniability against detection tooling that is already in private preview. If you run agent pipelines, the other useful action is auditing what is already symlinked into your skills folder.
Sources
- BleepingComputer, Ax Sharma, "AI 'watermark removers' flood the web. Almost none can prove they work", published August 13, 2026, accessed August 14, 2026
- Anthropic, "How Claude Marks AI-Generated Content", re-verified October 28, 2026
- Anthropic, "How Claude's text watermark works", published August 14, 2026, updated September 1, 2026, accessed October 28, 2026
- Claude Platform release notes, platform.claude.com, checked October 28, 2026 for model launches on or after August 2, 2026
- Anthropic, "Introducing Claude Opus 5.5", published September 22, 2026, accessed October 28, 2026