It hasn’t even been a week since Anthropic started putting invisible watermarks into Claude’s text.
Now there’s an open-source tool built to remove them.
The project, watermarks-remover, has already exploded on GitHub, passing 8.8K+ stars and nearly 900+ forks in a matter of days.
The numbers are impressive. But they’re not the most important part.
What’s more revealing is how the tool works, what kinds of AI signals it targets, and how quickly a community-built project appeared around a system designed to make AI-generated content easier to identify.
Because this is the uncomfortable reality of building anything in software, companies can spend months designing a new system, but once that system reaches the public, someone can start looking for a way around it.
It’s Not Just a Claude Watermark Remover
Calling watermarks-remover a Claude watermark remover undersells what the project is actually trying to do.
The open-source project targets several different kinds of signals that can reveal how digital content was created or processed. That includes invisible Unicode-based marks in text, statistical patterns associated with AI-generated writing, and provenance information stored in file metadata.
It also isn’t limited to plain text. The project lists support for formats including PNG, PDF, DOCX, SVG, HTML and Markdown, which gives it a much broader target than just taking a Claude response and making the watermark disappear.
An AI watermark isn’t necessarily a visible logo stamped onto a document. Depending on the system, the signal can be hidden in the text itself or stored alongside the content as metadata.
And that means removing it can involve very different techniques.
But Can It Actually Remove Claude’s Watermark?
The short answer: It can remove some AI provenance signals. But the truth about removing Claude’s statistical watermark is more complicated.
The project can confidently clean some kinds of AI provenance. If a file contains C2PA, EXIF or XMP metadata, those are things software can inspect and remove. The same is true for invisible Unicode characters and other hidden text markers.
Claude’s statistical watermark is different.
Anthropic’s system is embedded in the text itself by subtly changing the model’s token-selection patterns. There isn’t a hidden character sitting inside the sentence that a script can simply find and delete.
That’s why watermarks-remover takes a different approach for statistical marks. Its second layer can rewrite the original text using another model, with the goal of changing enough of the original token patterns that the watermark signal no longer survives. The repository describes this as best-effort removal, rather than a guaranteed way to defeat a vendor’s watermark.
Meaning, the tool isn’t cracking Anthropic’s secret watermarking mechanism.
It’s changing the text so substantially that the original signal may become difficult or impossible for a detector to recognize.
Whether that actually defeats Claude’s watermark in practice is a much harder question, and one the public evidence cannot conclusively answer yet.
Also Read: Open-Source AI Tools You Probably Haven’t Tried Yet The Problem With AI Watermarks
Anthropic can make Claude’s output harder to disguise as human-written. But that doesn’t mean the signal will stay untouched once it enters the real world.
The moment a watermark becomes part of a software pipeline, someone can study how it behaves, experiment with it, and build tools that try to disrupt it.
Again, that doesn’t mean AI watermarks are useless. They can still provide another signal for detecting AI-generated content, especially when the original output remains largely intact.
But they are unlikely to become the perfect fingerprint many people imagine.
AI-generated text is routinely copied, edited, translated, summarized, passed through other models and combined with human writing. Every additional step creates another opportunity for the original statistical pattern to change.
That’s what makes watermarks-remover more interesting than its growing GitHub star count suggests. The project isn’t proof that Anthropic’s watermark has been defeated. It is an early demonstration of something more fundamental: AI provenance is becoming a cat-and-mouse game.
Companies can build new ways to mark what their models create.
The open-source community can build new ways to test, weaken or remove those marks.
And that cycle has only just begun.