Unverified Claude Watermark Strippers Trigger Supply Chain Risks

Following Anthropic’s implementation of invisible watermarking across its Claude models, a wave of unverified removal tools has emerged online. The mandate, applied to all models launched after August 2, 2026, was enacted to comply with Article 50 of the European Union AI Act. Within days, developers launched open-source and commercial services claiming to strip these provenance signals.

The Token-Sampling Watermark

Anthropic’s text watermark does not rely on hidden metadata or invisible Unicode characters. It uses a token-sampling bias method, similar to Google DeepMind’s SynthID-Text. The system subtly alters the statistical probability of specific word choices during generation, creating a pattern that becomes mathematically verifiable over longer passages.

The watermark is now applied globally across the Claude web application, the API, Claude Code, and Claude Cowork. It also extends to managed Claude instances hosted on AWS Bedrock, Google Cloud, and Microsoft Foundry. For generated visual assets like SVGs and raster images, Anthropic embeds digitally signed metadata using the open C2PA standard.

Evasion Tools and Layered Approaches

The most prominent evasion tool is an open-source GitHub project called watermarks-remover, created by Guillaume Meyer. The repository accumulated over 4,500 stars within two days of the Anthropic announcement. Commercial AI evasion services, including StealthGPT, Human Writes, and WriteHuman, also updated their platforms to advertise Claude-specific stripping capabilities.

Tools like Meyer’s operate using a two-layered architecture. Layer A targets deterministic markers, stripping out zero-width spaces and bidirectional text controls. Layer B attempts to disrupt the statistical watermark by rewriting the text using a secondary AI model.

Verification and Pipeline Vulnerabilities

The core technical problem with these evasion tools is that Anthropic has not released a public detector. The cryptographic key required to identify the token-sampling bias remains secret. Without this detector, third-party developers cannot verify whether their secondary rewriting actually removes the statistical signal or merely degrades the output quality.

Meyer explicitly noted in the project documentation that the statistical rewriting feature is a best-effort approach. Security researchers emphasize that while Layer A effectively removes hidden characters, it does nothing to alter the distribution of words that forms Anthropic’s actual text watermark. Anthropic states that while substantial paraphrasing can weaken the signal, the watermark survives standard copy-pasting and light editing.

The rapid adoption of these unverified tools introduces a new vector for supply chain vulnerabilities. Developers are wiring unvetted GitHub repositories directly into production workflows to bypass detection, often feeding sensitive documents into third-party evasion APIs.

If you manage enterprise AI workflows, review your automated pipelines for unauthorized evasion tools. The reliance on unverified text-strippers offers no guaranteed protection against output evaluation and introduces immediate security risks to your data supply chain.