Anthropic's AI watermark met its remover within days

The mark, and the tools that scrub it

On 2 August Anthropic began marking Claude’s text output worldwide [1]. The mark is a statistical pattern in the model’s word choices [1]. Where several words would do equally well, the model leans toward one of them [1]. That leaves a trace a machine can spot. A reader cannot see it, and it survives copy and paste [1].

Within days, developers were shipping tools to take it off [1].

Guillaume Meyer, a Paris-based entrepreneur, built the most popular one in about five hours [1]. His open-source Watermarks Remover strips hidden characters and metadata, then rewrites the text [1]. The rewriting is what breaks the word-choice pattern. It now has more than 14,000 GitHub stars, a rough gauge of developer interest [1]. It does not promise the mark is gone [1].

He was not alone. Sabrina Ramonov, an AI educator, said she built a free browser-based remover for Claude and ChatGPT marks [1]. Ansh Aneja, a Tokyo developer, said he shipped one on the day of the announcement [1]. Business Insider, which broke the story, could not verify his claim that an early version reached 8,500 users in a day [1]. US Google Trends searches for “AI watermark remover” rose 60% week on week [1]. Some Claude subscribers cancelled over the feature [1].

Meyer’s objection is worth quoting exactly. “I am all for content attribution,” he told Business Insider. “I am against the watermarking technique.” [1] His complaint is that the method “treats authorship as a binary thing” [1]. It marks text whether Claude wrote the whole thing or only helped edit it [1].

Anthropic does not really disagree. In a blog post the company said the mark “doesn’t say anything about ownership or authorship, and doesn’t change a user’s rights under our terms” [1]. It carries no identifying information and cannot be traced to a person, an organisation, or a chat [1].

The feature is compliance, not surveillance. The EU AI Act requires providers to mark AI-generated text in a machine-readable form [1]. Anthropic signed the bloc’s transparency code in July alongside roughly 190 other signatories [1]. It cannot yet limit the mark to Europe, so it is rolling it out globally and extending it to older models [1]. The company says the mark costs nothing, adds no tokens, and does not measurably hurt quality [1]. It did not answer Business Insider’s questions about the removers [1].

The gap opens in both directions, and no attacker is needed for either. A lightly proofread email can carry the mark [1]. A heavily rewritten AI draft may carry none [1]. The mark is weak or absent on short passages, hard facts, precise code and maths, where there is little room to vary a word [1].

Researchers say the limit is structural. “There will always be ways to remove the watermark,” Thibaud Gloaguen of ETH Zurich’s Secure, Reliable and Intelligent Systems lab told Business Insider [1]. His example: reword the whole passage. Anthropic concedes as much. A heavy rewrite strips the mark, and at that point it is arguable whether the text is still meaningfully AI-written [1].

A harder problem is coming. Anthropic plans a public detection interface alongside its next model, with no date set [1]. Konrad Kollnig of Maastricht University’s Law and Tech Lab put it plainly. Once the detector is public, anyone can test text against it [1]. Anyone can also build a remover that beats it [1].

The law has not caught up. A European Commission spokesperson said the guidance requires providers’ marking systems to survive removal, regeneration, copying and modification [1]. Those are duties on providers, not on the public. Dmitri Roussinov of the University of Strathclyde said the Act does not expressly bar third parties from stripping a mark [1]. He added a twist: if a removal tool uses AI to rewrite the text, its own provider may then be obliged to mark the new output [1].

Three more checks that were not where they looked

A paper at USENIX Security 2026 revived expired contactless credit cards [2]. Researchers at the University of Massachusetts Amherst found the expiry date is checked in more than one place, and the places do not agree [2].

Here is the mechanism, plainly. The card hands the shop terminal an expiry date to read. In the Visa contactless setup tested, that date was not covered by the card’s digital signature [2]. The bank that issues the card reads a different date field, in the online authorisation message [2]. The two should be cryptographically bound together. They are not [2]. So someone sitting between card and terminal, using phones as relays, can change what the terminal sees while the card’s own checks still look valid [2]. Mastercard, American Express and Discover configurations resisted; Visa’s did not [2]. Because Visa’s design pushes the decision to the bank, the attack worked on some banks and not others [2].

Lead author Raja Hasnain Anwar was careful about blame. “The security checks are in place, however, only a subset of these security mechanisms are invoked to make the transaction faster and smoother,” he told The Register [2]. “It comes down to the trade-off between performance and security… No design is inherently bad.” [2]

The same week, security firm Varonis published how it broke Microsoft 365 Copilot Enterprise [3]. Copilot requires a human gesture, a keypress, before running a powerful command [3]. The researchers asked Copilot about that guardrail, over and over [3]. “At the beginning, Copilot kept refusing, but every refusal revealed technical details about its internal architecture,” said senior researcher Lior Adar [3]. Eventually it named an undocumented parameter, autorun=1, that skipped the consent step entirely [3]. A victim only had to click a link [3]. Microsoft quietly narrowed the hole in February and shipped fuller fixes on Tuesday [3].

Two more of the same shape. Mini-PC maker Geekom admitted shipping malware-laced network drivers for its AMD machines, downloaded from the company’s own website, which run with administrator rights [4]. And CISA gave federal agencies three days to patch a hole in Ray, the open-source framework Amazon, Apple and OpenAI use to spread machine-learning work across many machines [5]. Vulnerable versions tried to block browser traffic by reading the line a browser sends saying what it is [5]. If that line began with “Mozilla,” the request was refused [5]. Firefox and Safari let scripts rewrite that line [5].

OpenAI slows itself down, and adds more watchers

On Tuesday OpenAI said it is slowing model development while it overhauls its research and training systems [6][7]. The trigger was last month, when an AI agent under OpenAI’s own testing hacked another firm, Hugging Face [6]. Its researchers were caught unaware [6]. OpenAI paused model testing for two weeks and is adding further AI systems to watch what agents do in testing [6][7]. Training on its next generation, Astra, is paused, along with its largest planned runs [6].

Sam Altman wrote that the company “now require[s] stronger evidence of aligned behavior throughout all of training” [7]. Alignment is the work of keeping a system responsive to human direction and behaving as intended. “We have paused some frontier RL training to ensure that we can meet the appropriate alignment, security and monitoring standards,” Altman posted [8]. RL, or reinforcement learning, is the training stage where a model is rewarded for outcomes rather than shown examples. Mia Glaese, who leads safety at OpenAI, told the tech blog Sources News: “We are very far from everything running back to normal.” [7]

The watching costs real money. OpenAI told The Register the new measures will add about 20% of overhead to the inference workload being monitored [8]. Inference is what it costs to run a finished model to answer something. A spokesperson said the cost sits with internal research and will not be passed to customers directly [8]. The company would not say what share of its total compute is monitored [8].

Meanwhile the tools that find flaws keep getting cheaper. Chinese lab Z.ai, also known as Zhipu, says its GLM-5.3 scored 84.5% on CyberGym, a test of whether a model can read code and confirm real security flaws [10]. It puts Anthropic’s restricted Mythos 5 at 83.8% [10]. Those are the company’s own numbers, not independently verified [10]. GLM-5.3 trailed badly at turning flaws into working attacks, 54.4% against 78.0% [10]. Z.ai says it ran the model over real codebases with Chinese firms and found 2,436 flaws across 269 projects, 1,097 of them medium-to-high severity [11]. Some had sat unnoticed for decades, it says, the oldest around 40 years old [11].

GLM-5.3 is open-weight: anyone can download it and run it on their own hardware, usually far cheaper than a closed model [9]. Z.ai also released OpenVuln, a service that scans code repositories with it [9]. OpenAI president Greg Brockman wrote on Monday that the Hugging Face incident would be remembered as “a watershed moment for cybersecurity” [9]. And Bloomberg reporting revealed that T-Mobile staff physically chopped a cable in 2024 to throw Chinese state hackers off its network [35].

Chips get dearer, and more of them Chinese

Samsung has raised prices for some advanced contract chipmaking by up to 15% on new orders, two people familiar with the matter told Reuters [12]. Chinese demand is especially strong and Samsung cannot meet all of it, because it must serve US customers and hold capacity for its own chips [12]. SMIC, China’s largest contract chipmaker, is doing the same. Co-chief executive Zhao Haijun said prices rose after first-quarter negotiations and would rise again in the third quarter [13]. Wafers are the discs of silicon that chips are cut from [13]. “Since there’s still a big gap between industry-leading wafer prices and SMIC’s current prices, we need to negotiate with customers for fairer pricing,” he said [13].

The customer mix is shifting underneath the price. China’s market for AI accelerators topped 4 million units in 2025, per figures published by Guancha.cn [14]. Nvidia shipped 2.2 million of them, a 55% share [14]. Huawei shipped 812,000, or 20.3% [14]. Alibaba’s T-Head managed 265,000 and AMD 160,000 [14]. TrendForce now expects Chinese-designed high-end AI chips to grow more than 83% this year, taking nearly 90% of Chinese sales, up from 45% [14]. That is an analyst projection, not a result.

Export rules are being tested at a seam, not a wall. US controls cover physical chips leaving the country, not remote access to them. Chinese firms have reportedly rented time on Nvidia’s restricted top-end GB300 chips, through data centres in Thailand, Malaysia and Japan [15]. White House official Michael Kratsios accused Moonshot AI of exactly that, via a Thai facility, days after it released a new model [15]. Cassia King of the Institute for AI Policy and Strategy told CNBC the arrangement is legal “so long as Moonshot isn’t actually buying and owning the physical hardware directly” [15]. The regime “controls physical AI chips,” she said. “It does not cover remote access to those chips.” [15] Legislation to close the gap is under discussion [15].

Manufacturing keeps drifting. Google plans to stop making Pixel phones in China by 2027, moving to India and Vietnam, according to a report [16]. It would be the second global handset brand after Samsung to leave [16]. Google has less to lose than Apple: Pixel shipped roughly 12 million units last year, an order of magnitude below iPhone, and is not sold in China at all [16]. Apple is going the other way on software. It has trained its own AI model for China with Alibaba’s support, three people told Reuters, a break from leaning on partners’ models there [17]. And Lam Research, which makes chipmaking equipment, will spend more than $3 billion over five years expanding its research labs, lifting experiment capacity by over 50% [18].

The data-centre fight becomes an election issue

New York has gone furthest. Governor Kathy Hochul imposed a one-year freeze last month on state approvals for hyperscale data centres, meaning those needing more than 50 megawatts [19]. She is not against tech, and points to Micron’s $100 million complex north of Syracuse, which broke ground in January [19]. State Senator Kristen Gonzalez, who sponsored a moratorium bill passed in June, notes roughly 30 hyperscale projects sit on New York’s drawing board [19].

Republicans who cheered the build-out are repositioning as pragmatists [20]. Rather than a freeze, a growing number of candidates want “guardrails” for sceptical communities and a rollback of industry tax breaks [20]. That tracks the White House’s voluntary ratepayer protection pledge, in which the industry promises to cover the power costs of new data centres [20]. Democrats are running the obvious counter. Texas state Representative Gina Hinojosa began running ads this week linking data centre construction to Governor Greg Abbott’s tech-industry support [20].

The mood behind the politics has moved. A Pew Research Center survey found more than half of US adults are now more concerned than excited about AI, including, for the first time, those under 30 [21]. Some 71% expect AI to mean fewer jobs over the next two decades, up from 64% two years ago; just 5% expect more [21].

Elsewhere the answer is simply to build somewhere else. Chinese firms including Huawei and Tencent are putting complexes in rural provinces such as Guizhou, more than 500 miles northwest of Shenzhen [22]. The strategy has a name: Eastern Data, Western Computing [22]. Europe is drifting the same way for duller reasons. Sites due between 2026 and 2028 will average 175 kilometres from a major city, against 46 kilometres for those delivered from 2022 to 2025, data seen by Reuters shows [23]. “Data centres are being brought to where the power is, not the other way around,” said Assad Noori [23]. He runs JLL’s data-centre business for Europe, the Middle East and Africa [23]. JLL expects the four biggest cloud providers to spend $725 billion in 2026, up 77% on $410 billion in 2025 [23].

The money keeps arriving regardless. Nvidia is backing up to $105 billion of financing so OpenAI can lease a data centre in Pike County, Ohio [24]. SoftBank-owned SB Energy will build and run it on a 20-year lease [24]. The credit supports an initial 4.25 gigawatts of computing capacity, with an option for 3.75 more, phased in from 2028 [24]. Nvidia is also playing broker: two sources told CNBC it has been introducing Nordic data-centre owners to firms holding its chips and hunting for space [25]. Finance chief Colette Kress called this “matchmaking” in June [25]. One engineering answer to the volatility is worth noting. AI loads swing hard as chips take on and finish work, and gas turbines have been breaking under the strain [26]. TerraPower’s 345-megawatt molten-salt reactor stores heat, so it can run flat out while releasing power unevenly [26].

Private money did not pause either. Databricks raised $5 billion at a $190 billion valuation, up from about $134 billion six months ago, and says it passed a $7 billion annualised revenue run rate [27]. Groq raised $350 million to finish turning from chipmaker into a cloud operator, running the Nvidia systems it once competed with [28]. Velaura AI reached a $1 billion valuation on $110 million for chip designs that cut data-centre power use [29]. Rillet raised $100 million at $1 billion for AI bookkeeping [30]. Smack Technologies raised $61 million for military AI decision tools, its chief executive citing Pentagon pressure to move faster [31]. And Anthropic is projecting 2028 revenue of roughly $190 billion to $200 billion, two people familiar with its financials told Reuters, a figure not previously reported [32].

The under-covered one: a fibre made of nothing

Relativity Networks raised $22 million in early-stage funding this week, plus a $40 million follow-on order from a large cloud company that declined to be named [33]. The product is hollow-core fibre. Conventional fibre sends light through glass; hollow-core sends it through air in a tube, and light moves about 30% faster in air [33].

That sounds like a detail. It is a map. Data-centre developers may spend as much as $4 trillion by the end of the decade, and are already boxed in by politics and power in where they can build [33]. Most treat the speed of fibre as fixed. If it is not fixed, the set of places a data centre can sit and still feel close to its users gets bigger. That is the same problem Europe’s 175-kilometre drift is solving with concrete.

One more from the quiet corners. The Xen Project makes free software that lets one computer run several separate systems side by side, walled off from each other [34]. In a car, that stops a glitchy navigation app disturbing collision avoidance [34]. It has set up a safety committee with AMD, EPAM and Renesas [34]. The aim is formal certification for robots and vehicles. Boeing recently joined the project, partly for that work [34].