Open-source tool strips Claude's text watermarks
A week after Anthropic started stamping every Claude answer, the first public stripper is already a star on GitHub — and its author is more honest than the hype around it.
Guillaume Meyer's watermarks-remover has passed 13,000 GitHub stars and 1,400 forks since it landed on August 11, the same day Anthropic told the world Claude would mark its output. The MIT-licensed project is an agent skill plus a local Python service. It does three jobs: strip invisible Unicode and bidirectional junk from text, rewrite prose to scramble statistical sampling marks of the SynthID-Text / Kirchenbauer type, and peel C2PA, EXIF, and document properties off PNG, JPEG, SVG, PDF, DOCX, HTML, and Markdown. Meyer lists Claude, Gemini, OpenAI provenance surfaces, and open-weight marks as the class-level targets. AI Era's write-up this morning treated that as the watermark going to scrap paper overnight. The repo itself is dryer. Layer A, the Unicode scrub, is testable. Layer B, the statistical attack, is labeled best-effort. File metadata comes off cleanly. Pixel-level image marks are optional add-ons, not the core path.
We covered the launch last week — Anthropic embeds invisible watermarks in all Claude output — when the company turned the mark on globally rather than try to guess who is sitting in the EU. The EU AI Act's transparency rule is the reason the stamp exists, and there is still no off switch for paying customers. That is the part users are angry about. A tool that claims to wash the stamp is the predictable next move. Meyer, who publishes as The Opinionated Man, is unusually blunt about the price. A sampling watermark lives in the wording, not in a hidden character. Light edits barely move it. Stripping it means rewriting a large share of the sentences, and that rewrite can only be as good as the second model. His own punchline is the one the star-count posts skip: if you are going to run the text through a cheaper model anyway, you could have generated it there in the first place.
That is why this is not the clean kill the Chinese coverage is selling. Until vendors publish detectors and keys, Meyer writes, no tool can honestly certify that a cleaned file will fail the official check. Prefer a non-origin model for the rewrite, or you risk stamping the text again. AI Era reported that Claude itself refused to run the skill when users asked it to; other models did not. Even if that holds, the interesting fact is the tradeoff, not the refusal. Provenance that survives only until someone pays for a second pass is a compliance checkbox, not a chain of custody. Provenance that forces you to flatten the prose to remove it is a tax on the people who actually used the expensive model to think. Either way, the first week of Claude's invisible ink has already produced a popular, MIT-licensed washer — and a public reminder that the mark was never meant to survive a determined rewrite.
What to watch: whether Anthropic or Google ship a public detector that can still see a Layer B rewrite, or whether they quietly treat "full paraphrase" as out of scope.
If a watermark only holds until you rewrite the paragraph, is it disclosure or theater? Tell us in the comments.
Sources: watermarks-remover (GitHub)
