Coders undid Claude's invisible EU-compliance watermark within four hours

Within four hours of Anthropic confirming that Claude models would globally embed invisible, machine-readable watermarks in AI-generated text — to comply with the EU AI Act — developer Guillaume Meyer had published his override. The code to remove watermarks from Claude-generated text went viral on GitHub, drew more than 20,000 bookmarks on X and over 100 contributors.

Anthropic watermarks text by leaving a pattern in Claude's choice of words and phrases, indiscernible to humans but machine-detectable. The technique, SynthID, was developed by Google and in use since 2023; OpenAI's Scott Aaronson proposed a similar method that the firm never deployed, worried watermarks would put customers off.

The workarounds exploit the scheme's statistical nature. Meyer's method uses a non-watermarking LLM to generate rewrites, swapping synonyms and reorganising content. Software engineer Erik Hughes knocked up a tool with Claude itself in 15 minutes that removes invisible and look-alike characters, reorders sentences and swaps words. Oxford's Leon Chlon says condensing the response or translating it into Arabic — with very different semantics — and back removes the pattern; Anthropic acknowledged that heavily edited, paraphrased or translated content might not carry a watermark.

The rules require providers to label synthetic content or face fines of up to 3% of annual turnover, and bar providers from marketing circumvention tools — but place no legal restriction on independent tools. Anthropic says the watermark 'doesn't change the meaning, quality, or readability' of responses and plans to ship a text-detection API so users can verify for themselves.

A watermark in word-choice statistics dies at the first rewrite: pass the text through a clean model, or translate it and back, and the pattern is gone.

It shows the practical lifespan of an output-statistics watermark: hours, once the scheme is public and the ecosystem contains unwatermarked rewriters.

The circumvention needs no exotic maths — synonym swaps, reordering, or a translation round-trip — because any rewrite re-rolls the very word choices the watermark lives in.

The regulatory design left the door open: providers can't market circumvention tools, but independent tools face no restriction.

Anthropic's own admission that edited or translated text may lose the mark concedes the mechanism's core limit.

Compliance that depends on a statistical property of output is only as strong as the weakest rewriter in the ecosystem — one clean path makes the whole scheme optional.

Meyer's tool kept spreading, with freelance writers and social-media creators asking to use it; 190 organisations including OpenAI, Microsoft and Meta signed the EU's transparency code of practice, with watermarks required in all new models from August and existing models by December — leaving open how many labs implement text watermarks and whether any can withstand Anthropic's planned detection API release.