Four hours

Within four hours of Anthropic confirming that Claude models would globally embed invisible, machine-readable watermarks into any AI-generated content, developer Guillaume Meyer had published his override.

His code to remove watermarks from Claude-generated text has since gone viral on GitHub: it has been bookmarked more than 20,000 times on X and has drawn more than 100 contributors, with many more incorporating the technology into their own projects.

One comment reported by Wired captures the tone: an AI specialist wrote that "Anthropic is embedding watermarks in its Claude texts… the issue is practically history just one day later".

Why they are doing it

Meyer and others started investigating how watermarking works after Anthropic announced it would adopt the technique. The motives are not uniform:

  • Some are trying to evade it because they disagree with the idea that all AI-generated content should be labelled as such.
  • Others, including Meyer himself, say they simply relish the technical challenge.
  • Freelance content writers and social media creators have also contacted Meyer asking for help using the code.

Meyer's own position is more nuanced: he says he is not against transparency and is all for content attribution.

The gap in the regulation

The reason for the watermark is the EU AI Act. Under the rules, model providers such as Anthropic and OpenAI must label synthetic audio, image, video or text so that the material can be detected by a machine as AI-generated, or face fines of up to 3 percent of annual turnover.

The crux sits here. The rules say providers cannot market circumvention tools; but there is no legal restriction on independent tools.

The regulation, in other words, places the obligation on the provider and does not regulate circumvention. Anthropic must embed the watermark, but a third party publishing code that removes it is not prohibited.

How to read it

The episode clarifies what kind of solution content marking is. A watermark is not a security control designed to stop a malicious, technically capable user; it is an attribution mechanism that works at scale. It makes the origin of content visible in ordinary use, and does not hold up against a determined actor.

Reading that as failure is possible but incomplete. The comparison: metadata embedded by cameras can also be stripped, yet it survives in the vast majority of photographs and does useful work. A watermark's value lies in changing majority behaviour.

A question remains on the regulatory side, though: how far can a rule that places the obligation only on providers while leaving circumvention free deliver the transparency it aims at? The four-hour interval shows that question is not theoretical.