Developers Claim They’ve Discovered Bypasses for Claude’s Hidden Watermarks

Just four hours after Anthropic announced that Claude models would integrate invisible, machine-readable watermarks into every AI-generated output, developer Guillaume Meyer released his workaround.

His code for removing watermarks from Claude-generated text quickly gained traction on GitHub, amassing over 20,000 bookmarks on X and attracting more than 100 contributors, with many incorporating the tool into their own projects. “Anthropic is embedding watermarks in its Claude texts … and the issue was practically resolved just one day later,” stated an AI expert, sharing an image of Meyer breaking free from chains while standing on crumpled EU and Anthropic flags.

After Anthropic revealed last week that Claude would implement watermarking to comply with the European Union’s AI Act, Meyer and others began exploring how watermarking functions.

Meyer told WIRED that some are trying to bypass watermarking out of disagreement with the notion that all AI-generated content should be labeled, while others, himself included, find the technical challenge enticing. Freelance content creators and social media experts have also reached out to Meyer for help with the code, he says.

The new regulations, which were established earlier this month, require model providers such as Anthropic and OpenAI to label synthetic audio, images, videos, or text so machines can identify them as AI-generated, under threat of fines up to 3 percent of annual revenue. Although the rules prohibit providers from marketing circumvention tools, independent tools remain legally unrestricted.

“I’m not against transparency, and I support content attribution,” explains Meyer. “However, I believe watermarking is an ineffective solution due to its significant drawbacks and risks.” He raises concerns about false positives and the inability of watermarking to differentiate between minimal and extensive AI usage, particularly since, as a native French speaker, he often utilizes Claude and other AI tools like Grammarly to refine his work. Relying on the watermark as evidence—especially when even Anthropic acknowledges it can only suggest a probability that the text has been influenced by Claude—could lead to unjust rejections of candidates or exaggerated claims about researchers using AI, he argues.

Anthropic incorporates watermarks invisibly by creating a pattern in Claude’s word and phrase selections that is undetectable to human readers but can be identified by a machine trained to recognize it. Since this affects Claude’s outputs, some users are worried that it may diminish the quality of Claude’s responses, despite Anthropic’s insistence that this will not occur. The method, known as SynthID, was developed by Google, which has applied it to watermark its AI-generated content since 2023. Computer scientist Scott Aaronson suggested a similar technique during his time at OpenAI but reported that the company hesitated to implement it for fear that watermarks would deter customers from using their product.

Meyer’s method for removing watermarks employs a non-watermarking large language model to generate numerous rewrites by substituting synonyms and slightly rearranging text. This approach depends on utilizing other large language models that don’t insert watermarks—which may not be a secure choice, given that 190 organizations, including OpenAI, Microsoft, and Meta, have endorsed the EU’s transparency code of practice. It remains unclear how many of these organizations will adopt watermarking, which is required for all new models launched from August and must be integrated into existing models by December.

While the efficacy of this tool remains unconfirmed until Anthropic provides the software it uses for watermark detection, a solid understanding of the foundational SynthID-text approach that drives Claude’s watermarking makes them reasonably confident in its functionality, notes Wayne Pan, chief technology officer and co-founder of the sovereign AI startup Haimaker in Silicon Valley. He incorporated Meyer’s open-source tool into his platform because he, too, opposed the idea of Claude watermarking content—even with minimal edits—and disagreed with the watermark being imperceptible to users.