Anthropic published a detailed technical write-up on August 14 explaining how the Claude text watermark works, framing it as compliance with Article 50 of the EU AI Act, which obliges providers of systems that generate synthetic text to make that text machine-detectable. The scheme Anthropic adopted is not proprietary: it is Google DeepMind's SynthID-Text approach, which appeared in Nature in 2024 and itself traces back to a 2022 proposal from Scott Aaronson during his time at OpenAI [^1]. The elegance of the method is that nothing extra is added to the text. Instead, the source of randomness the model uses to pick the next token is swapped out: where an unwatermarked model would draw from a pseudo-random number generator, the watermarked model uses a secret key combined with the preceding few tokens. The sentence that comes out reads identically to an unwatermarked one, but anyone who holds the key can score the word sequence and estimate the probability that Claude generated it. Anthropic's internal tests, plus the Gemini A/B experiment Google DeepMind reports in the SynthID-Text paper, show no measurable degradation in quality or readability.
The structural weakness of this probabilistic signature is exactly what gives it that elegance: it is not a cryptographic password, it is a probabilistic fingerprint. Anything that significantly perturbs word order or sentence structure will erode the fingerprint at the same time. WIRED reported on August 19 that developer Guillaume Meyer published an open-source removal tool to GitHub roughly four hours after Anthropic confirmed the global rollout, and within days the project had attracted more than 100 contributors and over 20,000 bookmarks on X [^2]. The technique is plain: use another LLM that does not embed the watermark to rewrite Claude's output several times, swapping synonyms and reorganizing phrasing until the statistical signature is too diluted to detect [^2]. Developer Erik Hughes reportedly used Claude itself to assemble an "unwatermarker" in about fifteen minutes, which strips invisible characters, scrambles substitutions, and reshuffles paragraphs [^2]. Visiting Fellow Leon Chlon at the University of Oxford demonstrated a different bypass: translate Claude's reply into a language such as Arabic, whose semantics diverge significantly from English, and translate it back. The statistical pattern falls apart [^2]. Anthropic itself acknowledges in its support documentation that heavily edited, paraphrased, or translated content may no longer carry a detectable watermark [^1].
Crypto Briefing's August 19 follow-up noted that multiple developer tools have spread across GitHub and social platforms, and that at the time of writing Anthropic has still not released the corresponding detection API, which means independent verification of how much of the signature these removal methods actually erase is not yet possible [^3]. In other words, this contest is still at a stage where neither side has shown its full hand. Overchat's hands-on review adds a third independent data point: the watermark becomes unrecoverable once the rewritten text retains only about 30% of the original wording; stripping invisible Unicode characters removes the character-level artifacts but cannot touch the word-choice statistics [^4].
The design of the EU rule itself deserves attention. The AI Act requires providers to make synthetic text machine-detectable, with non-compliance fines of up to 3% of annual turnover [^2]. Anthropic is rolling out the watermark globally rather than EU-only because it has no reliable way to scope it by region [^1]. But the regulatory requirement is that the text be detectable, not that the specific producing model be identifiable. That shifts the hard problem squarely onto whoever has to run the detector. Anthropic says a text-detection API is coming that would let users upload a passage and receive a probability that Claude wrote or processed it; the key and the detector have not been released yet [^1]. Whether this approach holds up depends on how the watermark degrades under light editing, translation, and cross-model rewriting. Any rewrite that is meaningful enough for a reader to want is meaningful enough to erase the watermark. That is the inherent cost of any statistical scheme, and it is the reason OpenAI reportedly declined to ship Aaronson's original proposal years ago: the company worried the watermark would degrade the product experience [^2].
The real signal from this episode is that SynthID-Text represents a generational shift from counterfeit-resistance to probabilistic marking. The watermark is still effective on long, Claude-dominant generations; it is essentially ineffective on heavily edited, translated, or regenerated text. Regulators are not asking for absolute anti-counterfeiting, they are asking for AI-generated content to be markable, declarable, and traceable. Anthropic's compliance posture sets an industry example, but within four days of launch the bypass tools have already caught up at the speed of open-source collaboration. The next milestone to watch is whether Anthropic's detection API, once shipped, shifts the balance of this arms race, or whether SynthID-style statistical watermarks are destined to be replaced by a next generation of schemes based on cryptographic or multimedia fingerprints.
[^1]: Anthropic, "How Claude's text watermark works," August 14, 2026, https://www.anthropic.com/news/claude-text-watermark
[^2]: WIRED, "Coders Say They Already Found Workarounds to Claude's Invisible Watermarks," August 19, 2026, https://www.wired.com/story/coders-say-they-already-found-workarounds-to-claudes-invisible-watermarks/
[^3]: Crypto Briefing, "Coders Find Workarounds to Anthropic's Invisible Watermarks Within Hours of Launch," August 19, 2026, https://cryptobriefing.com/anthropic-watermark-workarounds-coders/
[^4]: Overchat AI, "Claude Watermark: What It Is and How to Remove It from Text," August 14, 2026, https://overchat.ai/ai-hub/claude-watermark