Claude's Watermark, One Month Later

Claude's text watermark went live on 11 August 2026. Two and a half weeks on, four things have changed that are worth updating on: the mechanism behind it is no longer a guess, bypass tools showed up within a day, independent research has put a hard number on how well watermarks like it actually hold up, and the EU has quietly moved its own goalposts.

This is a follow-up. For the original announcement and how the watermark works, see does Claude watermark its text?

The mechanism is now confirmed: SynthID Text

Anthropic's original announcement described what the watermark does without naming the method, and the earlier version of this coverage assumed the established KGW-style green-list scheme by default, since that is the technique most published research targets. On 15 August, Anthropic gave TechCrunch more detail: Claude uses SynthID Text, the token-sampling watermark Google DeepMind published in 2024, rather than a fully proprietary scheme. Anthropic also said a public detection API is planned, though it had not shipped one at time of writing — so third parties still cannot independently verify a mark themselves.

Bypass tools appeared within a day

On 11 August — the same day the watermark went live — a developer named Guillaume Meyer published watermarks-remover on GitHub: a tool combining Unicode/metadata stripping with a best-effort statistical rewrite pass aimed at disrupting the token-level signal. It passed 4,100 stars within two days. Several similar projects followed the same week.

Worth being precise about what that proves. The Unicode and C2PA-stripping parts of these tools do exactly what they claim — that part is mechanical and checkable. The statistical rewrite part is not: as BleepingComputer reported, none of these tools can actually prove they defeat Claude's mark, because Anthropic has not published a detector for anyone to test against. A GitHub star count is a measure of attention, not of success.

What the research actually shows

The more solid evidence arrived separately. A July 2026 paper, "AI Watermark Evidence Fails Forensic Readiness: An Empirical Evaluation", tested meaning-preserving paraphrase attacks against several watermarking schemes, SynthID included. The result: paraphrase removed the watermark in 100% of previously-detected KGW and Unigram texts, and in 98.3% of SynthID texts (58 of 59). The same paper found a 5.4% false-positive rate on clean, human-written text.

Since Claude's mark is now confirmed as SynthID-based, that 98.3% figure is the closest thing to a real answer on whether substantive rewriting defeats it — considerably more solid ground than any GitHub star count, and it matches exactly what Anthropic's own documentation already conceded: heavy editing and paraphrase are the things that break the signal.

The EU quietly extended its own deadline

The most under-covered story of the month has nothing to do with Anthropic. Regulation (EU) 2026/1744, the "Digital Omnibus," entered into force on 27 July 2026. It gives AI systems that were already on the market before 2 August 2026 a four-month grace period — until 2 December 2026 — before the Article 50(2) machine-readable-marking obligation applies to them. General Article 50 transparency duties (disclosing that content is AI-generated) are unaffected and still started on 2 August.

None of this changes Claude's position: because it shipped marking at launch on 2 August, it gets no grace period and was compliant from day one. But it means most other providers now have legal room to delay marking that Anthropic chose not to use.

Where the rest of the industry stands

Provider	Signed EU Code of Practice	Text watermark shipped
Anthropic (Claude)	Yes	Yes — 11 Aug 2026
OpenAI (ChatGPT)	Yes	No — committed 2 Aug 2026 to "expand provenance signals to text," no date given
Google (Gemini)	Yes	Yes — SynthID, since 2024; now also adopted by OpenAI, Kakao and ElevenLabs for their own outputs
Meta, Microsoft, Mistral	Yes	No public text watermark yet
xAI (Grok)	No	No — the only major holdout, though Article 50 still legally applies regardless of signature

What this means practically

Nothing here changes the practical advice from the original article. If you are worried about invisible characters in Claude output, they are trivial to find and remove with the invisible character detector. If you are worried about the statistical watermark itself, the research above confirms — it does not overturn — what Anthropic already told you: character-level cleaning cannot touch it, and only substantive rewriting meaningfully weakens the signal, which is what the Claude text watermark remover's rewrite mode is built around. Treat any tool claiming a guaranteed, provable bypass with the same skepticism BleepingComputer applied to the GitHub projects: nobody outside Anthropic can currently verify a removal claim against Claude specifically, because there is still no public detector to test against.

Related

Does Claude watermark its text? · Does ChatGPT watermark its text?