AI Watermarks Are Easy to Strip. So Why Is Everyone Adding Them?

A free GitHub tool capable of stripping AI watermarks from Claude's text appeared within 24 hours of Anthropic launching the feature, gaining roughly 72 stars a day. Within days, several more tools followed. Despite how easily these marks can be defeated, Anthropic, Google, Microsoft, Meta and OpenAI are all pressing ahead with watermarking their AI output. The driver is regulatory: Article 50 of the EU AI Act became enforceable on August 2, 2026, and non-compliance carries fines of up to 15 million euros or 3% of global annual turnover.

What happened

Detail	Fact
EU AI Act Article 50 enforcement date	August 2, 2026
Maximum fine for non-compliance	€15 million or 3% of global annual turnover, whichever is higher
Signatories to the EU Code of Practice	Approximately 190 organisations, including Anthropic, Google, Meta, Microsoft and OpenAI
Anthropic watermark announcement	Nine days after the August 2 enforcement date
Removal tool speed	On GitHub within 24 hours; gained roughly 72 stars per day
Effectiveness of the removal tool	Disrupts about 70% of the token sequences the watermark depends on
Anthropic business customers (as of last year)	Approximately 300,000

Nine days after the EU’s deadline passed, Anthropic announced that Claude would embed an invisible statistical pattern into its text output, plus signed C2PA metadata (a standard for attaching verifiable provenance data to files) into generated files. The rollout was global, not limited to EU users. Google has watermarked AI-generated images since 2023 and has since extended that to text, audio and video. OpenAI reportedly built similar text-watermarking capability years ago but chose not to deploy it, with concerns over false positives and giving competitors a way to fingerprint ChatGPT usage patterns.

Why AI watermarks break so easily

The technical problem is asymmetric. A watermark has to survive almost anything a user might do to a piece of text. An attacker only needs one method that works.

• Editing degrades statistical marks. Anthropic’s own documentation acknowledges that proofreading, translation, heavy paraphrasing, or short outputs can all cause its text watermark to go undetected.
• Removal tools move fast. The GitHub tool that appeared within a day of Anthropic’s announcement works by running Claude’s output through one or two rewrite passes, enough to disrupt about 70% of the token sequences the watermark relies on.
• A detected watermark is not proof of authorship. Anthropic itself notes that a match only shows Claude “may have processed” the content, not that Claude wrote it. That ambiguity is unlikely to be respected when an employer or platform treats a watermark check as a verdict.

That last point deserves attention for anyone working in content, consulting, or any field where AI use carries professional risk. A false positive is a real scenario, not a theoretical one.

Are users actually cancelling Claude subscriptions?

Business Insider reported that dozens of users cancelled their Claude subscriptions after the watermark rollout. One AI consultant cancelled because the watermark can appear on text he wrote himself and only lightly edited, not just text Claude generated from scratch. A software engineer said the watermark confirmed a decision he had already made over separate service concerns. A digital agency founder raised a broader worry: building a workflow around a vendor’s tools means that vendor can change the terms later, unilaterally.

Anthropic told Business Insider it has not seen a measurable increase in cancellations tied to the announcement. At roughly 300,000 business customers, a few dozen public complaints barely register statistically. Still, the pattern matters: a watermark easy enough to remove with a free tool can still shift how paying users feel about the product. The mark does not have to be technically robust to affect trust.

So are watermarks here to stay?

As a technical guarantee, AI watermarks are close to theater. They do not hold up against a determined adversary, and Anthropic does not claim they do. But as regulatory infrastructure, they are very likely here to stay, at least in the near term.

The EU’s Code of Practice explicitly calls for a layered approach combining metadata, statistical marking and detection tools, because no single layer was expected to hold on its own. The long-term goal is a paper trail for the cases that actually get scrutinised: a dispute, an audit, a lawsuit, where nobody thought to strip the mark in the first place.

This mirrors the pattern that digital rights management (DRM) and similar provenance systems have followed for two decades. Broken within days of release, and still standard practice years later, because the institutional weight sits behind the mark rather than the mark’s technical resilience. You can learn more about how these regulatory shifts affect AI integration decisions for businesses or follow our ongoing AI news coverage for the latest developments.

What does this mean for your business?

1. Treat missing watermarks as increasingly notable. AI-generated content now arrives marked by default unless someone deliberately strips it. Over time, the absence of a watermark will start to look more deliberate, the same way scrubbed metadata on a photo reads as more suspicious than a photo that simply never had any.
2. Do not rely on watermark detection as a definitive AI check. Given the false-positive risk Anthropic itself acknowledges, and the ease of removal, watermark status alone is a weak signal. Use it as one data point, not a verdict.
3. Review vendor dependency in your AI workflows. The agency founder’s concern is legitimate. If a tool you depend on can embed marks in your work or change terms unilaterally, that is a workflow risk worth mapping now, not after it becomes a problem.
4. Watch the enforcement pattern. The first EU fines under Article 50 will clarify how aggressively regulators pursue compliance. That should inform how seriously you treat watermarking requirements in your own AI-assisted content production.

Our take

The GitHub tool that appeared within 24 hours is not the story. The story is that watermarks were never designed to be the last line of defence. Regulators and the major labs both know this. The watermark’s job is to create a default state of traceability, so that in the minority of cases that end up in a formal dispute or audit, the mark is there to find. For 99% of everyday use, nobody is checking.

For businesses, the more immediate concern is the false-positive problem. If a tool marks your own lightly edited work as AI-generated, and a client or employer treats that check as conclusive, you have a real reputational problem with no clean technical rebuttal. That is a workflow and communication issue to solve now, before it surfaces in a contract dispute.

The vendor lock-in point is also worth taking seriously. Any stack built tightly around a single AI provider’s tools carries the risk that the provider changes behaviour, adds restrictions, or in this case starts marking your output in ways that affect how third parties perceive it. Diversifying your AI tool usage is no longer just about cost or capability.

Source: Bing News · OpenAI