Claude's Invisible Watermark Got an Open-Source Eraser the Same Day It Was Confirmed: 12K Stars in 6 Days - and a Red Line in China

Anthropic confirmed on Aug 11 that Claude models launched on/after Aug 2 weave invisible machine-readable watermarks into all generated text (per EU rules); the same day, open-source watermarks-remover (formerly remove-claude-marks, MIT/Python zero-dep, agent skill + local HTTP service) launched to strip it - 11,918 stars / 1,276 forks in 6 days (API snapshot Aug 17). Three-layer removal checklist (lossless Unicode scrub / best-effort statistical-watermark rewrite / C2PA+EXIF metadata across 13 formats), with honest limits: C2PA soft binding out of scope, no tool can certify passing undetected. Three buckets of cold water plus China red line: the labeling Measures (effective 2025-09-01, GB 45438) forbid malicious label deletion and forbid providing deletion tools. Understanding it beats using it.

Published August 17, 20267 min read

On August 11, 2026, Anthropic confirmed in its help center that Claude models launched on or after August 2 weave an invisible, machine-readable watermark into all generated text, everywhere Claude is offered. And on the very same day, an open-source project called watermarks-remover appeared on GitHub with a single purpose: strip the provenance marks AI vendors embed in text and files. Six days later the repo sits at 11,918 stars and 1,276 forks (GitHub API, 2026-08-17), MIT-licensed, written in Python. The vendor plants the mark; the community ships the eraser the same day. The opening round of this watermark arms race played out like a script written in advance.

Scope note: this article is based on GitHub API data, Anthropic's help center documentation, reporting by TechCrunch / Interesting Engineering / Chosun, and the project README (as of 2026-08-17); star counts are API snapshots; the legal section summarizes publicly available regulations and is not legal advice; capabilities are per the official repo. This is news analysis, not a removal tutorial.

1. The Six-Day Timeline: Vendor Plants, Community Strips

Laying the two sides' events side by side shows how hot this race is:

Date	Side	Event
From 2026-08-02	Anthropic	Newly launched Claude models begin weaving invisible watermarks into generated text on all channels
2026-08-11	Anthropic	Help center article updated, formally confirming the scheme (responding to EU AI Act transparency requirements, per Interesting Engineering)
2026-08-11 16:32 UTC	Open source	`guillaumemeyer/watermarks-remover` repo created, originally named `remove-claude-marks` - aimed squarely at Claude
2026-08-14	Media	Chosun's English edition reports "Anthropic's Watermarks Neutralized by Developer's Tool"; the story goes mainstream
2026-08-17	GitHub API	11,918 stars / 1,276 forks, v0.5.0 released

Note that original name: remove-claude-marks. This is not a generic "metadata cleanup utility" - it was born to strip Claude's watermark, then generalized into a multi-vendor tool. Community reaction speed is the most direct vote on the news.

2. What It Actually Strips: A Three-Layer Checklist

Reading the README reveals an eraser more systematic than expected. AI provenance marks exist in three forms, and the tool maps to each:

Layer	Target	Approach	Result
A	Invisible Unicode, exotic spaces, bidi controls, tag characters	Deterministic Python scripts	Fully removable (lossless)
B	Statistical watermarks (SynthID-Text, Kirchenbauer-style token-sampling marks; the signal lives in the wording itself)	Rewrite sentence-by-sentence with another model	Best-effort only
Files	C2PA / EXIF / XMP metadata across PNG, JPEG, WebP, GIF, TIFF, SVG, PDF, DOCX, EPUB, HTML, Markdown and 13+ formats	Drop metadata segments (PDF needs exiftool + qpdf structural rebuild)	Removable

Even pixel-domain image watermarks (SynthID for images, StegaStamp, Tree-Ring-class) get two optional heavy backends (CtrlRegen regenerating removal, DiffusionPurification diffusion purification), at the cost of multi-GB model downloads and a strongly recommended GPU. The whole project has zero dependencies (Python 3.10+ stdlib only) and works as an agent skill plus a local HTTP service.

But the most valuable part of the README is what it admits it cannot do:

C2PA "soft binding" is out of scope. That is provenance embedded in the content itself - a watermark that can re-link a remote Content Credentials manifest even after metadata is stripped. The README states plainly: out of scope; stripping hard-bound C2PA does not clear those channels.
No one can honestly certify "it passes the check." Until vendors publish detectors and keys, no tool can verify "this content is undetectable." Removal can only be attempted, never proven.

3. The Vendors' Half Is Escalating Too

While the stripping side celebrates, the embedding side has not paused: OpenAI has adopted the C2PA open standard and partnered with Google to embed SynthID invisible watermarks in its generated images; EU AI Act content-transparency obligations are landing; academia is simultaneously studying "desynchronized provenance" attacks (a 2026 arXiv paper). Watermarking is no longer one vendor's product feature - it is becoming infrastructure for the entire industry. That is the real backdrop for 12K stars in 6 days: this project is not stripping Claude, it is stripping the foundation everyone is being asked to install.

4. Three Buckets of Cold Water, and One Real Red Line

Beyond the hype, three buckets of cold water - the first two from the README itself:

Stripping a statistical watermark = heavy rewriting, and rewriting = degradation. The signal is spread across the wording of nearly every sentence; light edits (new headline, reshuffled paragraphs) barely move it. You must rewrite sentence by sentence, and the rewriting model's ceiling becomes your output's ceiling. The README even asks itself the full-circle question: "If the plan is to rewrite the text with a cheaper model anyway, why pay for a premium model in the first place?"
Rewriting with the origin model re-stamps the mark. Cleaning Claude's marks means rewriting with another vendor's model - and residual risk never disappears.
"Clean" is not guaranteed. See above: soft binding is unaddressed, and no public detector exists to verify against.

Then the red line. China's Measures for Labeling of AI-Generated Synthetic Content, jointly issued by the CAC and three other regulators, took effect on September 1, 2025, together with the mandatory national standard GB 45438. It requires AI-generated content to carry both explicit labels (user-perceivable notices) and implicit labels (technical marks in file metadata; digital watermarks encouraged). And the final paragraph of Article 10 is blunt: labels must not be maliciously deleted, altered, fabricated, or concealed by any organization or individual, and tools and services must not be provided for others to conduct such malicious conduct; users publishing AI-generated content via platforms must proactively declare it and use platform labeling functions.

In other words, in China, using this tool to clean invisible characters from your own documents versus stripping labels from AI content before publishing it are two entirely different legal postures. The former is hygiene; the latter can brush directly against regulatory text - strip the label, the platform fails to verify implicit metadata, the provenance surfaces later, and "I didn't know it was AI-generated" does not stand up in front of metadata. The project's own README carries the disclaimer: for content you own or are authorized to process; users must adhere to local regulations.

One-line verdict: this is the fastest living textbook on the "AI content provenance" category - how vendors plant, how the community strips, how the law draws lines, all in the same week. Understanding it matters more than using it.

Frequently Asked Questions

Q1: Is using watermarks-remover illegal? A1: It depends on the scenario. In China, privacy hygiene on your own content (clearing residual invisible Unicode from documents, tidying metadata before external release) is legitimate use. But the labeling Measures' Article 10 forbids any organization or individual from maliciously deleting, altering, fabricating, or concealing AI-generated content labels, and forbids providing tools or services for such conduct. Stripping labels from published AI content to pass it off or dodge disclosure carries clear compliance risk. This is not legal advice; consult a professional for specific cases.

Q2: Can invisible watermarks be stripped completely? A2: Not guaranteed. Invisible Unicode and file metadata can be removed deterministically; but statistical watermarks woven into the wording can only be "best-effort" removed by heavy sentence-level rewriting, and C2PA soft binding (watermarks embedded in the content itself) is explicitly out of reach. More importantly, until vendors publish detectors, no tool can prove "undetectable." The README says so itself.

Q3: Does stripping a watermark hurt writing quality? A3: Yes. The signal is distributed across the wording of nearly every sentence, so the only removal path is a substantial rewrite with another model - which flattens tone, voice, and precision. The output ceiling is the rewriting model's ceiling. The README's own words: if you plan to rewrite with a cheaper model anyway, generate directly with the cheaper model.

Q4: What exactly does China require for AI content labeling? A4: The Measures for Labeling of AI-Generated Synthetic Content took effect September 1, 2025 (CAC and three other departments, with mandatory national standard GB 45438): providers must add explicit labels (user-perceivable) and implicit labels (file metadata, digital watermarks encouraged) to AI-generated content; distribution platforms must verify metadata and provide labeling functions; ordinary users publishing AI content must proactively declare it. No organization or individual may maliciously delete, alter, fabricate, or conceal labels.

Q5: How should ordinary people respond to this watermark arms race? A5: Three moves. First, when publishing AI-assisted content, declare it with the platform's labeling function - don't try to strip; compliance cost is far below risk. Second, when receiving manuscripts or outsourcing work, check C2PA/metadata to verify whether content is AI-generated. Third, treat it as an observation window: watermark-vs-eraser offense and defense will grind on for years; understanding "labels are infrastructure" beats picking a side.

References

GitHub: guillaumemeyer/watermarks-remover (11,918 stars / 1,276 forks, MIT, Python, v0.5.0, API snapshot 2026-08-17; repo created 2026-08-11, formerly remove-claude-marks)
Anthropic Help Center: Claude invisible watermark documentation (updated 2026-08-11; effective for models launched on or after August 2, on all channels)
TechCrunch: Anthropic says it will watermark text generated by its AI models (2026-08-11)
Interesting Engineering: Anthropic puts hidden watermarks on Claude text under new EU rules (2026-08)
Chosun (English edition): Anthropic's Watermarks Neutralized by Developer's Tool (2026-08-14)
CAC and three other departments: Measures for Labeling of AI-Generated Synthetic Content (published 2025-03-14, effective 2025-09-01) and mandatory national standard GB 45438
TNW: OpenAI adopts C2PA standard and Google's SynthID
arXiv: Authenticated Contradictions from Desynchronized Provenance and Watermarking (2603.02378)

This article is compiled from public reporting, official documentation, and regulatory texts (2026-08-17); not a hands-on reproduction; the legal section is not legal advice; stars and capabilities per the official repo. Related reading: SynthID-Text Open-Source Teardown | AI Content Detector Tools Compared | AI Content Labeling Compliance SOP

This article is AI-assisted and human-edited. Last updated: 2026-08-17

FAQ

Is using watermarks-remover illegal?: It depends on the scenario. In China, privacy hygiene on your own content (clearing residual invisible Unicode from documents, tidying metadata before external release) is legitimate use. But the labeling Measures' Article 10 forbids any organization or individual from maliciously deleting, altering, fabricating, or concealing AI-generated content labels, and forbids providing tools or services for such conduct. Stripping labels from published AI content to pass it off or dodge disclosure carries clear compliance risk. This is not legal advice; consult a professional for specific cases.
Can invisible watermarks be stripped completely?: Not guaranteed. Invisible Unicode and file metadata can be removed deterministically; but statistical watermarks woven into the wording can only be "best-effort" removed by heavy sentence-level rewriting, and C2PA soft binding (watermarks embedded in the content itself) is explicitly out of reach. More importantly, until vendors publish detectors, no tool can prove "undetectable." The README says so itself.
Does stripping a watermark hurt writing quality?: Yes. The signal is distributed across the wording of nearly every sentence, so the only removal path is a substantial rewrite with another model - which flattens tone, voice, and precision. The output ceiling is the rewriting model's ceiling. The README's own words: if you plan to rewrite with a cheaper model anyway, generate directly with the cheaper model.
What exactly does China require for AI content labeling?: The *Measures for Labeling of AI-Generated Synthetic Content* took effect September 1, 2025 (CAC and three other departments, with mandatory national standard GB 45438): providers must add explicit labels (user-perceivable) and implicit labels (file metadata, digital watermarks encouraged) to AI-generated content; distribution platforms must verify metadata and provide labeling functions; ordinary users publishing AI content must proactively declare it. No organization or individual may maliciously delete, alter, fabricate, or conceal labels.
How should ordinary people respond to this watermark arms race?: Three moves. First, when publishing AI-assisted content, declare it with the platform's labeling function - don't try to strip; compliance cost is far below risk. Second, when receiving manuscripts or outsourcing work, check C2PA/metadata to verify whether content is AI-generated. Third, treat it as an observation window: watermark-vs-eraser offense and defense will grind on for years; understanding "labels are infrastructure" beats picking a side.

Frontline Hotspot

GPT-6 Astra Lands on Google Cloud, but Microsoft Keeps the Crown

On October 21, 2026, OpenAI announced a partnership with Google Cloud: frontier models plus the Codex agent workflow are coming to Google Cloud Model Garden, enterprise purchases can draw down GCP spend commitments, and general availability is planned in the coming weeks. Google Cloud's blog names three models - GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna, all in private preview - and calls Google Cloud the only hyperscale cloud provider offering access to all three leading closed source LLMs. Astra pricing is public on the API side: 10 dollars per million input tokens, 50 dollars output, a 1.05M context window, 128K max output, valid through April 30, 2026; Google-channel pricing is unpublished. Sol is the low-cost tier from DevDay on September 29 (2/10 dollars, about a fifth of Astra, officially pitched as near-Astra performance for complex work). Microsoft relations carry an explicit official caveat: the OpenAI post closes with Microsoft remains OpenAI's primary cloud partner, so this is not a defection. Media caliber (Reuters/CNBC): Microsoft's exclusive distribution expired in April, AWS followed a day later, Google completes the trifecta; Anthropic drew 47 percent of its 2025 revenue from AWS and Google per IPO filings; Google Cloud grows about 82 percent, fastest of the three. Naming lineage: the internal Astra that solved ten decade-old math problems in August with Lean-verifiable proofs is widely linked by media but never officially equated to GPT-6 Astra. Unpublished: parameter count, Google-channel pricing, exact GA date, open weights (API and enterprise hosting only).

Oct 24, 20268 min read

Frontline Hotspot

iFlytek Spark X2.6: A 293B Flagship, but Only a 4B Is Open

iFlytek launched Spark X2.6 at its global 1024 Developer Festival in Beijing on October 22, 2026: a 293B-parameter MoE that activates 30B per token, a 1M-token context window, an end-cloud integrated design, trained entirely on domestic compute and served from a 10,000-card domestic inference cluster. The efficiency ledger, all vendor-reported: training 2000B tokens of 256K-length data on the Feixing-2 platform fell from 4.5 months to 1.2 months (a 4x gain), and the first fully domestic four-layer KV Cache architecture lifted hit rate from 63 to 95.7 percent with 4.5x inference efficiency. Self-reported scores put SWE Pro at 77.3 and SWE Multilingual at 95.0, both first, with SWE Verified at 95.4 behind only DeepSeek-V4.1-Flash 1017's 95.6 - yet there is no complete score table, no technical report, and no third-party replication. The key correction: the viral headline 'iFlytek open-sources X2.6' misreads the release. Only the on-device Spark-X2.6-4B is open under Apache 2.0 (Hugging Face under the XHToken namespace, ModelScope mirror, Ollama as SparkLLM), while the 293B flagship stays API-only. The 4B self-reports six gains including BFCL-V4 71.8 and SWE Verified 62.8. Launch pricing is 0.9 / 0.08 / 3.6 yuan per million tokens. The narrative layer predicts 60 percent local, 30 percent hybrid, 10 percent cloud workloads with routing accuracy up from 81.2 to 96.1 percent; the chairperson's 'only model trained on fully domestic compute' is a unilateral claim with no chip model disclosed. Unpublished: chip models, cluster size, total FLOPs, technical report, flagship weights.

Oct 23, 20268 min read

Frontline Hotspot

Xing4.0-29B-Intent Scores 58: Why Gemini Leads the Category

The Xingchen General Intelligence Lab of China Telecom Artificial Intelligence Technology released and open-sourced Xing4.0-29B-Intent on October 19, 2026: a 29B MoE model that activates roughly 4B parameters per token and turns a sentence of natural language into a category plus args JSON structure that downstream systems can read directly, shipping 2.75 million training samples, the weights, and an inference image. The official evaluation totals 58 (intent understanding 81, event extraction 40, relation extraction 38, named entity recognition 72, category score 69), against Gemini-3.6-Flash at 49, Qwen3.8-Max 46, Kimi-K3 45, and GPT-5.6-Sol 45. Two caveats matter. First, the category column is led by Gemini-3.6-Flash at 71 - the lead comes from event extraction, relation extraction, and intent understanding, while named entity recognition is ahead by a single point. Second, the official WeChat evaluation table lists 18 rows while the GitHub README keeps only 11, so the two official tables differ in length, and those 18 rows include the model under test, leaving 17 general-purpose rivals. The WeChat post also carries a second 5,606-question table (70 / 56 / 53 / 65) that never reached GitHub. The evaluation is self-run, and the announcement itself states the results do not represent all tasks or real deployment scenarios. Data side: 2,753,000 samples rebuilt from 61 public datasets plus China Telecom's own assistant data, spanning 19 domains and 52 languages, with a label set of 170+ intents and 148 slots - while the shipped schemas measure 347 categories and 147 unique slots in union, an unexplained gap. Licensing: weights, public data, and the Python SDK are all under Apache-2.0, yet the repository LICENSE is an unfilled placeholder template, the weight side has no standalone LICENSE file, and the dataset carries upstream terms that users must check themselves. Latency, minimum VRAM, API pricing, and training details are not published; the widely quoted sub-150-millisecond response is a media figure, not an official one.

Oct 22, 20269 min read

Core conclusion

FAQ

Is using watermarks-remover illegal?: It depends on the scenario. In China, privacy hygiene on your own content (clearing residual invisible Unicode from documents, tidying metadata before external release) is legitimate use. But the labeling Measures' Article 10 forbids any organization or individual from maliciously deleting, altering, fabricating, or concealing AI-generated content labels, and forbids providing tools or services for such conduct. Stripping labels from published AI content to pass it off or dodge disclosure carries clear compliance risk. This is not legal advice; consult a professional for specific cases.
Can invisible watermarks be stripped completely?: Not guaranteed. Invisible Unicode and file metadata can be removed deterministically; but statistical watermarks woven into the wording can only be "best-effort" removed by heavy sentence-level rewriting, and C2PA soft binding (watermarks embedded in the content itself) is explicitly out of reach. More importantly, until vendors publish detectors, no tool can prove "undetectable." The README says so itself.
Does stripping a watermark hurt writing quality?: Yes. The signal is distributed across the wording of nearly every sentence, so the only removal path is a substantial rewrite with another model - which flattens tone, voice, and precision. The output ceiling is the rewriting model's ceiling. The README's own words: if you plan to rewrite with a cheaper model anyway, generate directly with the cheaper model.
What exactly does China require for AI content labeling?: The *Measures for Labeling of AI-Generated Synthetic Content* took effect September 1, 2025 (CAC and three other departments, with mandatory national standard GB 45438): providers must add explicit labels (user-perceivable) and implicit labels (file metadata, digital watermarks encouraged) to AI-generated content; distribution platforms must verify metadata and provide labeling functions; ordinary users publishing AI content must proactively declare it. No organization or individual may maliciously delete, alter, fabricate, or conceal labels.
How should ordinary people respond to this watermark arms race?: Three moves. First, when publishing AI-assisted content, declare it with the platform's labeling function - don't try to strip; compliance cost is far below risk. Second, when receiving manuscripts or outsourcing work, check C2PA/metadata to verify whether content is AI-generated. Third, treat it as an observation window: watermark-vs-eraser offense and defense will grind on for years; understanding "labels are infrastructure" beats picking a side.