Claude Is Adding Invisible Watermarks to AI Text. Here’s What You Should Do Now

Hey folks,

When I first read Anthropic’s announcement, my mind went straight to a resume.

Not a fake resume. A real one that someone wrote themselves, then sent to Claude for a quick proofread at 11:47 p.m. before an application deadline.

Could that document come back with an invisible Claude mark?

According to Anthropic, yes.

That deserves attention. But a few headlines have pushed the story further than the evidence supports.

Claude isn’t secretly stamping every response from every model with an indestructible “AI wrote this” label. Anthropic’s own help page says models launched on or after August 2, 2026 support marking at launch. Older models are still being brought into the system.

For supported models, the marks apply across Claude, the API, Claude Code, Claude Cowork, Claude Tag, and cloud platforms where the marking type is supported. The policy applies worldwide, not only in Europe.

The driver is the EU AI Act’s transparency rules, which became applicable on August 2, 2026.

So yes, this is real.

But the details matter.

LLMs write one token at a time. A token can be a word, part of a word, or punctuation.

Imagine the model has four reasonable choices:

big, huge, massive, enormous

Normally, it samples from a probability distribution. “Huge” might have a 32 percent chance. “Massive” might have a 27 percent chance.

A statistical watermark can slightly influence those choices according to a hidden pattern. One word proves nothing. But across hundreds of choices, a detector can look for the pattern.

Invisible.

Spread across the text.

Still present after copy and paste.

Anthropic hasn’t yet published the technical details of its detector. It says that documentation is coming. So anyone claiming to know the exact algorithm is guessing.

We do have a working example from Google. Google DeepMind’s SynthID for text changes token probabilities during generation. Google says it works best on longer, varied writing and can survive cropping, a few changed words, and mild paraphrasing.

Google also says a thorough rewrite or translation can sharply reduce detection confidence.

Anthropic lists similar limits.

This is the part I don’t want employers, schools, or coworkers to miss.

Anthropic says detection means the content may have been processed by Claude. It doesn’t prove Claude originated the ideas or wrote the first draft.

Claude could have:

1. Proofread your own paragraph.

2. Translated something you wrote.

3. Summarized your research notes.

4. Converted your document into another format.

The output may still carry a mark.

That makes a binary judgment like “Claude touched this, therefore the author cheated” both lazy and wrong.

Could a company use the signal to screen job applications? Technically, perhaps, once detection becomes available to third parties.

Has Anthropic shown that employers are doing this now? No.

And the detector isn’t public yet. Anthropic says it will share detection guidance later.

If an employer or university treats a watermark as proof of dishonesty, it would be ignoring Anthropic’s stated limitations.

This is the question I care about more.

If a marking system changes which token gets selected, it can change the final text. That part follows from how token watermarking works.

But change doesn’t automatically mean worse.

Anthropic says its watermark doesn’t change meaning, quality, or readability. It hasn’t published the technical results behind that claim yet.

Google has. In a Nature paper on SynthID-Text, researchers compared watermarked and unwatermarked responses across nearly 20 million Gemini interactions. The differences in user feedback were statistically insignificant. Smaller controlled tests also found no significant quality loss.

That’s strong evidence that a well-designed watermark can avoid a noticeable quality drop.

But it isn’t proof about Claude’s implementation. Different system. Different tests. No published Anthropic benchmark yet.

My view: don’t panic, but watch the evidence.

Changing the font won’t help.

Neither will copying the text into Google Docs, exporting it as a PDF, or removing strange Unicode characters. A statistical text watermark lives in the word and token choices, not in formatting.

Changing a few words may not remove it either. Anthropic says the mark may persist through some editing.

But the “you can never remove it” claim is also false.

Anthropic says heavily edited, paraphrased, translated, or mixed text may no longer carry a detectable mark. Very short passages may not leave enough signal for reliable detection.

That doesn’t give you a magic percentage. It gives you uncertainty.

And no honest tool can promise “0 percent AI-generated” across every detector. AI detectors measure different signals, make mistakes, and change over time.

Within days of Anthropic’s announcement, Guillaume Meyer released an open-source project called watermarks-remover.

The name makes it sound like one magic eraser. It is more useful to think of it as three tools:

1. Layer A cleans visible-file problems you cannot see. It strips zero-width characters, bidirectional controls, unusual spaces, and other hidden Unicode.

2. The file cleaners remove provenance metadata. They can clean C2PA, EXIF, XMP, and document properties from supported images, PDFs, DOCX files, HTML, and Markdown.

3. Layer B tries to weaken statistical text watermarks. It does this through substantial rewriting, not by finding and deleting a hidden tag.

The first two jobs can be inspected and verified. The third is best-effort.

That distinction matters because Claude’s text mark is believed to live in word choices. Removing Unicode characters from a paragraph does not remove a statistical pattern in its wording.

The repository says this clearly: until vendors release their detectors and keys, no tool can certify that rewritten text will fail an official check.

One important detail: the agent skill is only a thin client. The actual cleaning tools run through a small local service, so copying the skill file without starting the service will not work.

For Claude Code on macOS or Linux, the direct setup is:

git clone https://github.com/guillaumemeyer/watermarks-remover.git
cd watermarks-remover
mkdir -p ~/.claude/skills/remove-ai-marks
cp -R skills/remove-ai-marks/. ~/.claude/skills/remove-ai-marks/
python3 service/scripts/server.py --host 127.0.0.1 --port 8765

The core service needs Python 3.10 or newer and uses the standard library. Keep that terminal running while you use the skill. If you already use Docker, the repository also supports docker compose up -d.

For Codex, copy the same remove-ai-marks folder into ~/.codex/skills/ instead. Other agents use their own skills directory.

Start a fresh agent session, then try:

Inspect this file for AI provenance marks. Clean only the Unicode and metadata marks you can verify, save a new copy, and report what remains uncertain. Do not rewrite the text unless I approve it.

That last sentence is important.

One Reddit discussion raised the right concern: a rewrite intended to disturb a watermark can also disturb meaning, especially in contracts, legal citations, medical text, or factual documents.

Another technical Reddit breakdown pointed out that the deterministic cleaner is excellent at Unicode and metadata hygiene, but none of that touches a watermark encoded in Claude’s token choices. The statistical step is still another model rewriting your prose.

My precautions would be:

1. Never overwrite the original. Save a cleaned copy and compare it against the source.

2. Run inspection before cleaning. Ask the tool to separate confirmed findings from best-effort guesses.

3. Approve rewriting separately. Layer A is the lower-risk hygiene pass. Layer B can change voice, precision, and facts.

4. Recheck every name, number, quotation, citation, and legal clause. A fluent rewrite can still be wrong.

5. Do not rewrite Claude text with Claude. The repository recommends a non-origin model, preferably a local open-weight model, to avoid adding the same type of mark again.

6. Ignore magic thresholds. Reddit commenters have suggested numbers such as “change 25 percent,” but Anthropic has not validated a universal percentage.

7. Treat “undetectable” as an unsupported claim. Anthropic’s detector is not public, so successful removal of its statistical text mark cannot currently be proven.

8. Use it only on content you own or are authorized to process. Removing provenance can create legal, academic, or compliance problems if you misrepresent where work came from.

There is also a simple quality tradeoff. The more aggressively another model rewrites your document, the more likely it is to flatten your voice or damage an important detail.

For most people, the safest setting is: clean verifiable Unicode and metadata, keep the original, and make any substantive rewrite yourself.

I’m not going to spend my time trying to trick a detector.

My rule is simpler:

Written with AI. Verified by me.

For a resume, article, or important work document, I also want version history. Keep the notes, sources, and edits that show how the work developed.

That matters more than an unreliable score from a detector.

If you want to keep your own authorship clear, use Claude as an editor instead of asking it to replace your draft.

Try this:

Act as my editor. Do not rewrite the passage.
List:
1. Factual claims I should verify
2. Sentences that are unclear
3. Repeated ideas
4. Grammar or spelling errors
For each issue, explain the problem and suggest no more than two options. I will make the final edits myself.

This keeps the final decisions in your hands.

The best way to sound human isn’t to ban em dashes or add random typos.

It’s to sound like you.

Take three pieces of writing you genuinely wrote and use this prompt in ChatGPT, Claude, or another assistant:

Study the writing samples below and create a personal style guide.
Identify:
1. My usual sentence length and rhythm
2. Words and phrases I repeat
3. How I open and close ideas
4. How formal or casual I sound
5. Patterns that do not sound like me
Do not imitate the subject matter. Describe the writing rules only.
Then turn those observations into concise custom instructions I can review and edit. Do not claim these instructions will fool AI detectors.
[PASTE YOUR WRITING SAMPLES]

Review the rules before saving them to any app’s custom instructions. Delete anything that feels generic.

You can then go to Settings → Personalization → Custom Instructions and paste these in.

One warning: switching from Claude to Gemini doesn’t solve the watermark question. Google already uses SynthID on text generated in the Gemini app and web experience. And the EU rules point toward more providers adopting machine-readable marks, not fewer.

If you are finding value in my AI action letters, please consider subscribing. It keeps me going.

Thanks for reading AI Action Letter! This post is public so feel free to share it.

Share

I think hiding every trace of AI use will soon feel silly. The valuable skill is knowing when to use AI, checking its work, and taking responsibility for the result.

That last part is yours.

If you know someone who uses AI for resumes, school, or work, please share this with them.

Share

That’s it from me today.

Till next time. Stay tuned as I will share best resources from both my Harvard and Google networks to bring the best to you. Let’s up skill together. Aspyre higher!