Nobody Broke Claude's Invisible Watermark. We Read the Code.

X and Reddit spent days repeating the same story: Anthropic is going to watermark Claude's text, and a developer has already broken the protection. Users announced they were canceling subscriptions. A repo named claude-awm was shared as proof.

Frandroid's line-by-line verification tells a different story. The code was cloned, Claude was asked to read it, and every claim was checked. The crack does not hold.

How a text watermark actually works

A text watermark is not invisible ink. Claude picks its next word from several valid candidates. The watermark replaces the random choice with a secret rule, the key. No invisible character, no metadata, no hidden string. Anthropic is explicit about this.

The consequences are counterintuitive. Creative writing is heavily marked, because many phrasings work. Factual answers barely are: after "the capital of France is", there is only one correct word. Code is almost unmarked, because it must stay exact. Longer text is also easier to detect. Drowning the mark in a big document does the opposite.

The underlying technology is SynthID, created by Google DeepMind and published in Nature in 2024. Anthropic uses a version of it.

Where Gemini, Claude and ChatGPT actually stand

• Gemini has watermarked text since May 2024, but only in its app and on the web, not via the developer API. Google offers no public score or API to check if a text came from Gemini.
• Claude's watermark is announced but deployed on no model yet.
• ChatGPT has no public text watermark at all.

The current agitation comes from the EU's AI Act. Article 50, applicable since August 2, 2026, requires that AI-generated content be detectable for new models. Anthropic applies it worldwide because it cannot reliably limit the rule to Europe.

No, nobody broke Claude

The claude-awm repo promises anti-watermarking for Claude. Frandroid found one occurrence of the word "Claude" in the whole codebase, in a comment. No calls to Anthropic, no key, no AI-generated text.

The author reimplements SynthID with his own keys, then attacks the result. The tested models are open models: Qwen and gpt-oss. No proprietary models, no Claude.

The numbers are brutal. Out of 294 measurements, only one falls under the detection threshold of 2.33, and only after removing 40% of the words from the shortest text. Changing punctuation, removing formatting, switching between English variants: the mark survives. Only destroying the text works. On the same text, the detection score jumps from about 26/100 for a short passage to above 100 for a long one.

Nobody outside Anthropic holds the key.

The invisible-character trick also fails. The script meant to prove these characters cannot be seen does not cover the characters used by the main attack. On long text, symbols transform back into emojis.

Anthropic promises a public detection interface, "soon", with no date. Without the key, nobody can read a text watermark. The watermark, once live, will contain no information about a person, an organization, or a conversation. Google ran the same system on millions of Gemini responses and found no satisfaction gap between marked and unmarked text. The panic is real. The crack is not. The code was public, the check was simple, and the mob did not read it.