Claude watermarks cracked within four hours, code goes viral

the announcement and breach

Anthropic confirmed last week that Claude models would embed invisible watermarks in any text they generate, to meet the European Union’s AI law requirements. Within four hours of the announcement, developer Guillaume Meyer published code that removes the watermark, and the project attracted more than a hundred contributors, tens of thousands of bookmarks on X, and adoption in many additional projects. “The problem became history within a day,” wrote an AI expert alongside a picture of Meyer cutting cables on EU and company flags.

regulatory background

The new rules, which came into force at the start of the month, require model providers such as Anthropic and OpenAI to mark synthetic content—text, image, audio or video—so that a machine can identify it as such. Non-compliance may trigger a fine of up to 3% of annual turnover. The legislation bans the providers themselves from marketing circumvention tools, but it does not restrict independent tools created by external developers.

developer’s argument

Meyer says he does not oppose transparency or attribution, but views watermarks as a poor solution because they carry significant risks. His main concern is false positives and the fact that the watermark does not distinguish between light and heavy AI use. As a French speaker who uses Claude and tools like Grammarly for text editing, he notes that treating the watermark as definitive evidence—especially when Anthropic admits the detector only provides a probability—could lead to unfair job-candidate rejections or excessive accusations against researchers.

how the technology works

Anthropic’s watermark relies on SynthID, a technique developed by Google and in use since 2023. The idea is to leave a statistical pattern in the model’s word and phrase choices that is invisible to human eyes but detectable by a machine that knows what to look for. Computer scientist Scott Aaronson proposed a similar method while at OpenAI, but the company refrained from deploying it for fear of deterring customers. Anthropic claims the watermark does not degrade answer quality, yet users worry about hidden effects on output.

bypass method and open question

Meyer’s tool uses a large language model that does not embed a watermark to generate multiple revised versions, swapping synonyms and reorganizing content. The limitation is that it relies on models that do not watermark, an uncertain assumption given that about 190 organizations—including OpenAI, Microsoft and Meta—have signed the European code of conduct on transparency. The deadline requires watermarking of every new model by August and integration into existing models by December. Until Anthropic releases an official detection suite, there is no full certainty that the bypass works, but understanding the SynthID-text mechanism gives developers reasonable confidence that the method is effective.