Humanizers vs AI Detectors: One Service Beats Pangram in 4% or 87% of Cases, Depending on the Test

On October 5, 2026, OpenAI announced that it is embedding an invisible textGrain watermark in ChatGPT texts for users in the EU. In August Anthropic announced the same for Claude, and Google has been marking Gemini texts since 2024. At the same time, the market for services that promise to make machine text “human” — humanizers — is growing. Their benchmarks name winners every month: in October one ranked StealthGPT first (88% of texts passed the Pangram detector), another ranked Phrasly first (86.7%; in the overall ranking of that benchmark WriteHuman came first). In the first benchmark, the same Phrasly passed Pangram in only 4% of cases.

The real picture is less dramatic. A watermark, a linguistic-profile detector and paste metadata are three different signals, and bypassing one does not mean bypassing the others. Humanizer benchmarks are run by the humanizer sellers themselves, and each ends up in first place in its own test. Independent studies show a spread of 1% to 97% of missed texts for the same detector, depending on versions. And in the strictest quality test (run by the humanizer maker TextPulse, with GPTZero as the detector), the share of texts that passed the detector and did not lose facts, quotations or meaning was 0 to 10%.

A humanizer’s “success” percentage is a property of the pair “service + detector” on a given date and of whoever runs the test, not of the service alone: in five independent studies Pangram missed from 1% to 97% of rewritten texts, and on Wikipedia machine text runs up against source verification, not the detector, in any case.

This is a review of published studies and tests as of October 28, 2026, not a guide to bypassing detectors and not legal advice. All percentages refer to specific versions of services and detectors on the date of the test.

01 · Three signals that are constantly confused

A language model writes text by choosing the next token — a word or part of a word — from several plausible options each time. A statistical watermark slightly steers this choice with the help of a secret key. A single word gives nothing away, but over hundreds of words a pattern accumulates that only the detector of the key’s owner can check. The mark lives in the choice of words, not in formatting, so copying into a document or a content management system does not destroy it. An em dash, the word “delve” or uniform sentence length is not a watermark but a stylistic feature.

A linguistic-profile classifier — Pangram, GPTZero, Turnitin, Originality.ai — is trained on examples of human and machine texts and estimates the probability that a model wrote the text. It knows nothing about watermark keys and works with texts from any model, including open ones, which have no marks. This is exactly the profile that humanizers try to change.

Paste metadata is the third signal. When text is copied from a chatbot’s web interface, service metadata can travel with it. This is exactly what LLM Paste Check has been checking since September 2026 in the visual editor of English Wikipedia (since October 8, in all Wikipedias).

Hence the main conclusion for this entire article: a text that passed Pangram may still contain a textGrain or Claude watermark. And vice versa: a detected watermark does not show who checked the facts, how much a human edited, or whether the text complies with Wikipedia’s rules.

02 · Three years of the race

OpenAI’s first attempt, the AI Text Classifier, was shut down within six months because of low accuracy. Since then detectors have grown stronger, bypassing has become a business of its own, and Wikipedia and regulators have moved from recommendations to bans and mandatory labeling.

03 · Watermarks: What They Withstand and What They Do Not

Google described its SynthID-Text in a peer-reviewed paper in Nature in October 2024. In an experiment on ≈20m Gemini responses, the share of “like” ratings with and without the watermark differed by 0.01 percentage points, and “dislike” ratings by 0.02 pp: users did not notice a difference. Google released the code for generating and checking the watermark in the Hugging Face Transformers library. The company itself warns that the watermark is less effective on factual responses, and that heavy rewriting or translation lowers the detector’s confidence.

On August 14, 2026, Anthropic explained that its new Claude models embed a variant of the same SynthID-Text approach in text — because of AI Act requirements, but immediately for the whole world. The company gives no reliability figures of its own, but it honestly lists the limitations: verification is unreliable on short texts, and the signal is weak in factual texts and code; light edits are unlikely to remove the watermark, while “rewriting every word in full” will. A translation done by Claude itself preserves the watermark, because the model chooses every word. The detector is available only through a closed API for regulators, media, fact-checkers, researchers and educational organizations.

On October 5, 2026, OpenAI announced textGrain in ChatGPT and Codex for EU users: the rollout is phased, over the coming weeks. API customers worldwide can enable it for selected models — by default it is off. The company’s own page is not available for automated reading, so we cross-checked the figures of the technical report against four publications. On excerpts of 400 tokens the watermark was detected in about 95% of cases, on 200 tokens in about 80%, at a threshold of 1% false positives. Controlled replacement of words with synonyms shows the limit of robustness.

OpenAI had a text watermark ready as early as 2024: at that time The Wall Street Journal wrote about a system that recognized ChatGPT texts with “99.9%” confidence, but the company did not release it. Whether this is the same textGrain is unknown. In a survey commissioned by OpenAI, almost 30% of users said they would use ChatGPT less if the watermark appeared only in ChatGPT. The watermark appeared in response to EU requirements: Article 50 of the AI Act began to apply on August 2, 2026 (for systems already on the market — with a grace period until December 2).

Academic research shows the same picture on open models. The “green list” watermark (Kirchenbauer et al.) remained detectable after human paraphrasing, but on average only after 800 tokens. Paraphrasing by a separate model, DIPPER, lowered detection of the watermark from 100% to 57%, and detection by the statistical detector DetectGPT from 70% to 5%. Recursive five-round paraphrasing lowered watermark detection on excerpts of 300 tokens from 99.3% to 9.7% (Sadasivan et al.). And “watermark stealing” made it possible to forge or erase academic schemes with a success rate above 80% for less than $50 of queries (ICML 2024).

A paper watermark is visible when held to the light. A text watermark is visible only to a detector that has the key.

There is also a limit that current watermarks do not yet overcome: models with open weights. We did not find evidence that Llama, Qwen, DeepSeek or Mistral put watermarks in their texts. Researchers (Gloaguen et al., 2025) explain that the methods for closed models do not work here, because the user controls generation, and watermarks embedded in the weights do not survive further training and quantization. The AI Act formally does not exempt open generative models from Article 50, but how to meet this requirement for models run on one’s own computer is an open question.

04 · Detectors: Vendors’ Promises and Independent Tests

In January 2023, OpenAI released the AI Text Classifier, which correctly recognized 26% of machine-written texts and falsely flagged 9% of human ones. On July 20, 2023, it was shut down “due to its low accuracy.” Since then, detectors have become much more accurate — at least by their own reports.

On October 16, 2026, Pangram reported that its fourth version falsely flagged 0.0041% of 2,046,273 human texts and missed 0.34% of ≈520 thousand machine ones. The detection rates by text length — 98.71% (50–99 words), 99.59% (100–249) and 99.79% (250–499) — are one hundred percent minus the miss rate (1.29%, 0.41% and 0.21%) published by the vendor; Pangram itself does not print the detection rates.

The Pangram 4.1 model card, dated October 19, adds a caveat: the minimum is 50 words “mostly in complete sentences,” below 150 words the interface shows lower confidence, and the miss rate for English even rose slightly: 0.3652% versus 0.3396% in Pangram 4. For a single sentence there are no reliable measurements at all. So a “paragraph” for Pangram is the minimum usable fragment, while an A4 page (≈350–600 words) is in practice comfortable, although Pangram publishes data only up to 499 words.

Independent checks mostly confirm that Pangram is a strong detector, but not as flawless as in its self-report; however, they were run on early versions (before Pangram 4/4.1), so a direct comparison with the self-report is tentative.

• University of Chicago (NBER, 2025, working paper, not peer-reviewed; 2025 version of Pangram). On 1,992 human excerpts from before 2020, at the optimal threshold (by Youden’s index), the average false-positive rate across six genres (calculated from the paper’s table) was: Pangram — 0.22%, Originality.ai — 0.75%, GPTZero — 0.89%, the open RoBERTa model — 57.9%. On short excerpts of up to 50 words, Pangram erred more often: 1.1% false positives, 3.2% misses.
• Epoch AI (July 2026, Pangram 3.3.2). On 495 human texts, Pangram and GPTZero did not err a single time, while Originality.ai erred 19 times (3.84%). But when models imitated the style of a specific author, Pangram missed 10.1% of machine texts, GPTZero 10.8%, and Originality.ai 17.9%; scientific texts were the hardest.
• VUB university in Brussels (2026, preregistered study). In 160 papers of 4,000 words or more (40 of them human), none of the four detectors produced false positives. Fully machine-written papers (ChatGPT Deep Research) were recognized by Pangram under the strict criterion in 65% of cases, and by Turnitin, GPTZero and Copyleaks in 0%. On its own page of “third-party evaluations,” Pangram cites a softer figure — 97.5%.
• RAID benchmark. The leaderboard is saturated, but the results are submitted by the detector developers themselves: at 5% false positives and without attacks, Winston AI has 100%, GPTZero 98.4%, and Pangram (2024 model) 99.3%. In a 2024 paper, a homoglyph attack — replacing letters with look-alike characters from other alphabets — lowered Originality’s accuracy from 85% to 9%.

05 · The Arithmetic of False Accusations

Even an accurate detector can produce many false accusations if genuine cases are rare. The formula is simple: share of false accusations among flagged papers = FPR × (1 − p) / [FPR × (1 − p) + TPR × p], where p is the share of papers actually written by AI. Take 1,000 papers, of which 100 were written by AI, and a detector with a 1% false positive rate that catches every machine-written text. It will flag 109 papers, and 9 of them will be human-written — every twelfth accusation. If only one paper in a hundred was produced with AI, half of the accusations will already be false.

Non-native speakers fare worst. In 2023, Stanford researchers tested 91 TOEFL essays with seven detectors: on average 61.3% of the essays were judged machine-written, and 97.8% were flagged by at least one detector. Essays by American eighth-graders were classified almost flawlessly. Modern detectors claim the problem has been solved: in October 2026, Pangram reported zero false positives on 15,420 essays by students for whom English is not a native language. But this is self-reported, and we did not find independent tests of that scale.

The consequences are already measurable. Vanderbilt University switched off the Turnitin detector in August 2023, having calculated that 75,000 papers a year at a claimed 1% false positive rate meant ≈750 papers that could be falsely flagged. Washington State University abandoned the same detector in February 2026: in fall 2024, 148,547 papers went through it, and 33% of the AI cases heard by the integrity committee in 2023–2025 ended in a “not guilty” decision, because there was no evidence other than the detector. Australian Catholic University, according to ABC, received ≈6,000 referrals for integrity violations in 2024, ≈90% of them related to AI; the university disputes these figures, but switched off the detector in March 2025. In January 2026, a court in New York reportedly overturned a sanction against an Adelphi University student that had been imposed on the basis of a Turnitin finding of “100% AI.”

Regulators have also started checking the promises. In 2025, the US Federal Trade Commission ordered Workado to stop advertising its detector as “98% accurate”: according to tests by the developers of the model the company took off the shelf, it recognized machine-written texts outside scientific subjects in only 53% of cases. The same company sold a feature that made text “undetectable.”

06 · What a Humanizer Is and Who Uses It

A humanizer is a paraphrasing service. It changes words, syntax, sentence length, the order of arguments and tone to move the text away from the patterns detectors were trained on. Their aim is to change the words and structure of the text. Hidden characters and homoglyphs are known mainly from academic attacks (RAID), and in the TextPulse test no hidden characters were found in any of the services. An audit of 19 services (DAMAGE, January 2025, authors from Pangram) documented typical side effects: meaningless phrases, invented references, dictionary-based word replacement without changing sentence structure, a drop in style to a middle-school level, typos.

The market is large and fast-moving. By OneLittleWeb’s estimate, in September 2026 the 23 humanizers in its selection (excluding Undetectable.ai, QuillBot, HIX Bypass and Walter Writes) together had ≈33m visits a month, 44% more than in August. The largest are Stealthwriter (13.3m; not to be confused with StealthGPT, which has 0.35m) and Humanize AI (12.3m). Undetectable.ai claims more than 24m users and at the same time sells its own detector. The cheapest paid plans of the leading services cost ≈$10–30 a month. According to NBC, Turnitin tracks about 150 such services.

Text can be “laundered” beyond recognition. The question is what is left of the numbers and quotes after the spin cycle.

An ironic detail: on GitHub, one of the most popular open-source “humanizers” for chatbots — the blader/humanizer repository, over 61,000 stars — is built on the Wikipedia page “Signs of AI writing.” The page itself warns: do not treat these signs as problems that need fixing, because that only makes detection harder.

07 · How Much “Success”: Benchmarks With a Conflict of Interest

Both benchmarks exist, and their figures match the published ones. But HumanizerBench is run by WriteHuman, and HumanizerEval, by all appearances, by StealthGPT (it does not disclose this itself): both companies sell services that were tested.

HumanizerEval (October 22, 2026) ran 50 English-language machine-generated texts of 364–997 words through 11 humanizers and six detectors. “Passed” means the detector gave an overall verdict of “human”; mixed verdicts count as a failure. StealthGPT passed Pangram 4.1 in 88% of cases and all six detectors at once in 17 of the 50 texts; Undetectable.ai did so in one text, the rest in none. The benchmark data is published in the StealthGPT-Labs GitHub organization with the description “public StealthGPT benchmark reports”, but the site does not name the organizer and the conflict of interest is not disclosed. The benchmark itself warns that the margin of error for a share out of 50 texts is about ±14 percentage points.

HumanizerBench (test of October 1, 2026) openly states that it is run by WriteHuman. Here 14 services were given 30 tasks each, and “passed” means a “human” score of 50% or higher. Against Pangram, Phrasly came first (26 of 30), followed by StealthGPT (22) and WriteHuman (15); Undetectable.ai passed once, and nine services, including Walter Writes, HIX Bypass and Grammarly, not at all. Pangram and GPTZero agreed on the verdict for only 52.6% of texts.

One service gives opposite results in different tests. Phrasly against Pangram: 4% in HumanizerEval (Pangram 4.1, standard mode, without Ultra), 86.7% in HumanizerBench (Pangram 4, mode not specified) and 100% in Phrasly’s own test (Pangram 4, Ultra mode, 72 texts). Results go stale within weeks: in the StealthGPT-Labs benchmark, the share of WriteHuman passes against Pangram fell from ≈65% in the September 30 report (Pangram 4; value taken from the repository description) to 26% in the October 22 report (Pangram 4.1).

Despite the conflicts, the benchmarks agree on a few things. Cheap services — HIX Bypass, Humbot, BypassGPT — do not get past Pangram at all. Across all tests, Undetectable.ai passes Pangram 4 and 4.1 in fewer than half of cases. And Winston AI and ZeroGPT let through most texts from almost all services, often 90–100%. In other words, a humanizer’s “success rate” largely measures the weakness of the detector it is compared against.

Turnitin, the most widespread detector at universities, was not tested in these benchmarks: it has no public API for such a volume. The claim on the HumanizerEval homepage of “≈95% Turnitin bypass” rests on unnamed “independent testing”, although Turnitin was not tested there. Since August 2025 Turnitin has had a separate mode for detecting humanizers, but it has not published its accuracy.

08 · Independent Tests: From 1% to 97%

Studies without a commercial interest are few, and none tested the newest versions of both humanizers and detectors at the same time. But they too show that the result is determined by the pair of versions, the genre and the threshold.

In a University of Chicago test, after StealthGPT (2025 version) Pangram missed on average 1.3% of machine-generated texts, Originality.ai 6.2% and GPTZero 56.8% (NeuroDrift averages across 24 “model × genre” combinations from the paper’s table). At the ICML 2026 conference, researchers ran 2,000 machine-generated peer reviews of scientific papers through Undetectable AI: Pangram 3.0 labeled 7.2% as human (the rest as machine-generated or mixed), GPTZero did not flag 13.3% as machine-generated, and three open detectors failed to recognize a single one. In the same study, humanizing human reviews that had been edited by AI raised GPTZero’s false positives from 3.0% to 65.6% (for Pangram 3.0, only from 3.0% to 3.6%).

The most unexpected result is in the preprint by Karr et al. (August 2026). On 642 scientific abstracts after Undetectable AI version 11, Pangram 3.2 missed 96.6% of machine-generated abstracts from 2023–2025, and GPTZero 96.1%. Meanwhile, human abstracts edited by the Gemini model with a prompt along the lines of “make it sound more human” (not pure grammar) were flagged as AI by Pangram 3.2 in 64–80% of cases. The authors conclude that honest editing with AI carries a higher risk of punishment than deliberate evasion with a humanizer.

Detector makers contradict one another. Pangram states that its fourth version detects AI in 98.83% of texts after 13 commercial humanizers. GPTZero claims that on rewritten texts it has 93.5% recall, while Pangram v3 has only 50.2%. We did not find independent verification of Pangram 4 or 4.1 against commercial humanizers after July 2026.

09 · The Price of Rewriting: Facts, Quotes, Meaning

A humanizer is judged by whether the text passes a detector. But for publication, what matters more is whether the text remains true. The strictest check was run by TextPulse — a company that itself sells a humanizer, so its results need independent replication. The quality threshold included similarity of meaning, retention of 90% of quotes, no invented numbers or names, and no hidden characters.

Walter Writes, the best at evading GPTZero (60%), invented on average 4.4 new numbers or names per text of ≈300 words — invented sample sizes, percentages, confidence intervals, authors and institutions. QuillBot retained only 29% of quotes (its responses were cut off at ≈125 words). Grammarly never passed GPTZero, but 85% of its texts were judged fit for use.

HumanizerEval, linked to StealthGPT, also tested factual consistency — it does not disclose its methodology and does not publish the rewritten texts. Even by its own estimate, most services alter facts in a third to three-quarters of texts.

HumanizerBench shows the same pattern from the other side: the better a service evades detectors, the less meaning it preserves.

The vendors acknowledge this. According to Phrasly’s own test, StealthGPT introduced on average 3.5 factual changes per text, Undetectable 6.2, WriteHuman 2.6, and Phrasly Ultra itself 0.9. StealthGPT reported that 18% of texts from its new Super model failed an internal factual-consistency check. Scientific integrity researchers described “tortured phrases” as far back as 2021 — a product of paraphrasers that, for example, turned “artificial intelligence” into “counterfeit consciousness”. For an encyclopedic article, a single such number or one invented quote costs more than any detector passed.

10 · Wikipedia: They Check Sources, Not Style

Over 2025–2026, the large Wikipedias moved from advice to bans. English Wikipedia has had a guideline in force since March 2026: using language models to generate or rewrite article text is “strictly prohibited”. The discussion ended 44 to 2. The exceptions are grammar edits to one’s own text with human review, and translation from other language editions. Sanctions require evidence beyond “basic stylistic or linguistic features”. Since August 2025, speedy deletion criterion G15 has been in force. From August 2026 it requires unambiguous signs: a chatbot addressing the user, nonexistent sources (incorrect ISBNs, DOIs that lead to a different article), or technical traces such as “oaicite” and “turn0search0”. German Wikipedia adopted a ban by a vote of 208 to 108 in February 2026. Ukrainian Wikipedia took over the English rules: the guideline “Writing Articles Using LLMs” (a translation of the English one) was approved on May 6, 2026 with the participation of 10 users, and speedy deletion criterion 2.5 appeared in July 2026 (July 30 according to the Meta table; we did not see the discussion). We did not find a separate rule on AI in the policies on paid editing (WP:PAID, conflict of interest, Wikimedia terms of use), but the ban applies to everyone.

Tools have also appeared. LLM Paste Check warns in the visual editor when at least 50 characters with ChatGPT, Claude, Gemini, Copilot or DeepSeek metadata are pasted, and asks the user to explain why the text should be kept. It was enabled on English Wikipedia on September 24, and on all Wikipedias on October 8, 2026. It is not a classifier and not a watermark. There are no official effectiveness figures. By an unofficial count in a community query (Quarry), of 731 warnings shown, 54% ended with saving without a tag — that is, the text was removed or the metadata cleaned. The check is easy to bypass: it does not work in the wikitext editor, and, according to the author of the proposal on the community wishlist, chatbots already recommend exactly that editor to users. Watermarks have so far appeared only in a request for a prototype check via SynthID — and only for Gemini.

Pangram is used selectively on Wikipedia. Wiki Education — an organization that runs student editing programs — runs participants’ edits through it and automatically sends them warnings. At the same time, the organization states directly that it does not regard the result as evidence: only as a signal to check the text more carefully.

The most valuable figures are from its 2025 report. Pangram flagged 178 of 3,078 new articles by participants (5.8%) and not a single article from before ChatGPT appeared. Half of the organization’s staff spent a month checking them manually.

That is, invented sources are rather the exception: in the Wiki Education sample they appeared in only 7% of the 178 articles, while the rest cited real sources that did not support what was written (more than two-thirds of the articles failed verification). In an interview with IEEE Spectrum, WikiProject AI Cleanup described such citations as “extremely common”. That is why WikiProject AI Cleanup uses Pangram and GPTZero only as “one more data point”, and the page “Signs of AI writing” explicitly advises against relying on detectors alone.

The scale of the phenomenon is hard to measure. In August 2024, researchers (Brooks et al.) flagged more than 5% of new English Wikipedia articles (GPTZero: 5.36%); after subtracting the expected false positives — at least 4.4%. By an estimate that WikiProject AI Cleanup cited to IEEE Spectrum, at the end of 2025 Pangram flagged ≈20% of new articles and drafts, and in early 2026 15–16%; the methodology has not been published.

On Wikipedia, what saves or sinks a text is not style but the footnote: whether the source says what the article says.

We discussed why Wikipedia matters for what language models say about a company in “Why ChatGPT Trusts Wikipedia More Than Your Website” and “A Brand Without Wikipedia Is a Company Without a Passport in the LLM Era”, and how AI answers change the traffic of the encyclopedia itself in the briefing “Wikipedia Traffic 2001–2035”.

A practical conclusion follows for professional Wikipedia editing. The quality metric is not whether the text passed a detector, but whether every substantive claim is confirmed by an independent source and whether the policies on AI and paid editing are observed. A humanizer does not help here and may do harm: in tests, some services added invented numbers and quotes — exactly what machine-written articles get caught on.

11 · Ukrainian and the Human Eye

Detectors were trained primarily on English, and for a long time this showed. In the independent MULTITuDE test (2023), GPTZero on Ukrainian barely distinguished machine text, whereas a multilingual detector fine-tuned on 11 languages worked as well in Ukrainian as in English. An interesting detail: a detector trained only on English gave 0.67 on Ukrainian texts, while one trained on Russian gave 0.94; linguistic proximity matters.

Modern vendors claim high accuracy in Ukrainian. Pangram reported 99.95% in 2024 (≈2,000 texts per language, machine texts only from GPT-4o); GPTZero reported 96% recall in 2025, the lowest figure among the 21 languages in its table. According to the model card of Pangram 4.1 itself, it falsely flags 0.009% of Ukrainian human texts (the sample size is not given). But we did not find independent tests of modern detectors in Ukrainian. Back-translation as an attack turned out to be weaker for Ukrainian than for English: 14.5% success versus 30.6% for the m2m100 model (for NLLB, 15.4% versus 21.3%) (Macko et al., EMNLP 2024).

In Ukraine, the Ministry of Education and Science (MON) and the Ministry of Digital Transformation issued recommendations on the use of AI in higher education in 2025 (we could not open the text itself). Universities use StrikePlagiarism, which has had an AI-text detection function since 2023, while the Unicheck site now leads to a Turnitin page. We did not find an independent evaluation of these tools on Ukrainian texts. In a small survey of 201 students in Bila Tserkva (autumn 2025), more than 80% said they use AI in their studies, and 88% do not consider assistive use a violation of academic integrity. We did not find mandatory labeling of AI content in Ukrainian legislation. The White Paper of the Ministry of Digital Transformation (June 2024) proposes voluntary labeling tools at the first stage and places mandatory regulation on the model of the AI Act in the second stage.

People without tools recognize machine text worse than it seems. In a 2024 study, experienced teachers correctly identified only 37.8% of essays written by ChatGPT. The exception is people who often write with ChatGPT themselves: five such experts, by majority vote, were wrong on one article out of 300. But individually, each of them falsely accused authors in 1.3–12% of cases.

Stylistic markers move with fashion. At least 13.5% of 2024 PubMed abstracts were processed by LLMs, and the word “delves” appeared 28 times more often than predicted. The frequency of “ChatGPT markers” in arXiv abstracts began to fall from April 2024; the study’s authors explain this by saying that the authors of the texts learned to avoid them. So a word list is the weakest kind of evidence.

12 · Rules and Money

Mandatory labeling of text exists in China (from September 1, 2025) and the EU. California’s SB 942 does not cover text.

Article 50(2) of the AI Act obliges providers of systems that generate text, images, audio, or video to mark the output in a machine-readable format so that it can be detected. The obligation does not apply when the system merely assists with standard editing or does not substantially change the input text. Article 50(4) requires those who publish generated text to inform the public on matters of public importance to disclose this, except where the text has undergone human review or editorial control and a specific person or organization is responsible for the publication. The fine is up to €15m or 3% of worldwide turnover, whichever is higher. We did not find a ban on users removing the watermark in Article 50: the obligation lies with providers. For systems that were on the market before August 2, 2026, labeling was postponed under the Digital Omnibus package to December 2, 2026. The Code of Practice on the transparency of generated content, the final version of which was published on June 10, was signed by about 190 organizations by the end of July, including OpenAI, Anthropic, Google, Meta, and Mistral.

The money made in detection is noticeable but not huge. In July 2026, Pangram raised $9m in a Series A led by Menlo Ventures (≈$13–14m in total); it is integrated into Substack and costs $20 a month. GPTZero raised $10m in 2024; Sacra estimates its annual recurring revenue (ARR) at the end of 2025 at $24m. Turnitin is owned by Advance Publications, which bought it in 2019 for $1.75bn; by March 2024 the detector had checked more than 200m papers and found at least 20% AI text in ≈11% of them. Grand View Research estimates the detector market at $750m in 2026; this is the estimate of a single analytics company with an unverified methodology.

13 · Method map

Below are 16 detection and bypass methods with their status as of October 2026: what already works in products, what is available in limited form, and what exists only in research papers.

14 · What this means for you

15 · What’s next

What follows are NeuroDrift’s analytical scenarios, not forecasts from the sources.

• December 2026 – February 2027. On December 2, the grace period for labeling in the EU ends — for systems that were on the market before August 2, 2026. By February 2, 2027, signatories of the Code of Practice are to create a joint solution for verifying watermarks — according to lawyers’ analyses, this is the date from the Code. If such a solution starts working, newsrooms and universities will for the first time be able to check the watermarks of several providers in one place.
• The race continues. Humanizers are appearing that are trained to evade detection directly on detector outputs: in one preprint, AuthorMist bypassed GPTZero, Winston and Originality in 78.6–96.2% of cases. Detectors respond by adding separate “humanized” labels. Any percentage in this article should be treated as a snapshot on the date of the test.
• A combination of signals. The most likely direction (our estimate) is a combination of watermarks for closed models, classifiers for open ones and evidence of the writing process: version histories, drafts, edit logs. Wikipedia is already moving this way: paste metadata, edit filters and manual source checking.
• Independent tests. The biggest gap is the absence of an independent, regular and open comparison in which neither the organizer nor the sponsor sells any of the tested products. Until there is one, every “humanizer ranking” should be read together with the name of whoever runs it.

Honesty and limitations

The strongest argument for detectors. Independent tests by the University of Chicago, Epoch AI and VUB showed that modern classifiers, above all Pangram, almost never err on human texts written before ChatGPT appeared. In one study, five human experts who often write with AI, by majority vote, recognized machine text almost flawlessly (individually they falsely accused authors in 1.3–12% of cases), so the signal is real. Vendor humanizer rankings themselves show that most services do not work against Pangram.

The strongest argument against. Few false positives on “clean” texts from before 2022 is not the same as few false accusations in real life. There, texts are edited with Grammarly, translated, written by non-native speakers, and the share of genuine cases is unknown. A preprint by Karr et al. (Pangram 3.2) showed that having a model edit abstracts with a prompt such as “make it sound more human” gets flagged more often than bypassing with the Undetectable AI humanizer. Most figures on the accuracy of current versions come from those who sell detectors or humanizers.

Limitations of this review. We did not run our own experiments with detectors or humanizers. OpenAI pages are not available for automated reading, so the textGrain figures were cross-checked against four publications rather than the primary source. Some values (the Wiki Education and Brooks charts, among others) were read off published images with an error of ±0.3–0.5 pp. The court ruling in the Adelphi case is known from secondary sources. We did not find independent tests of Pangram 4/4.1 against commercial humanizers, or of any modern detectors in Ukrainian. “We did not find” here means exactly that, not “does not exist.”

Sources

• Watermarks: Dathathri et al., SynthID-Text, Nature 2024, Hugging Face on SynthID-Text, Anthropic — How Claude’s text watermarking works, OpenAI — Our approach to EU text provenance rules, retellings of the report: fonearena, actuia, letsdatascience, Interesting Engineering; TechCrunch on OpenAI’s unreleased watermark, 2024, Simon Willison on the WSJ survey.
• Robustness of watermarks and paraphrasing: Kirchenbauer et al. 2023, On the Reliability of Watermarks, ICLR 2024, Krishna et al., DIPPER, NeurIPS 2023, Sadasivan et al., Watermark Stealing, ICML 2024, watermarks and open models, C2PA 2.3.
• Detectors: OpenAI AI Text Classifier and its shutdown, Pangram — Is Pangram accurate?, Pangram 4.1 model card, Pangram on non-native speakers’ essays, Jabarian & Imas, NBER WP 34223, Epoch AI, July 2026, Van Vlasselaer et al., IJEI 2026, RAID and leaderboard, Russell, Karpinska, Iyyer, ACL 2025, Turnitin on false positives, Turnitin, a year of the detector.
• False accusations: Liang et al., Patterns 2023, Vanderbilt, Washington State University, ABC on ACU, Waterloo, Curtin, Newby v. Adelphi case (retelling), FTC — Workado, 2025.
• Humanizers: HumanizerEval, October 2026 and methodology, StealthGPT-Labs repository, HumanizerBench — Pangram and leaderboard, TextPulse, Phrasly test, StealthGPT Super, Saha et al., ICML 2026, Karr et al. 2026, DAMAGE, Pangram on 13 humanizers, GPTZero on rewritten texts, Turnitin against bypassing, AuthorMist, “tortured phrases”, humanizer traffic, OneLittleWeb, NBC News, blader/humanizer.
• Wikipedia: Writing articles with large language models and RfC 44:2, criterion G15, Signs of AI writing, WikiProject AI Cleanup, category of flagged articles, LLM Paste Check, Wikimedia bulletin 2026/20, unofficial Quarry count, ticket T423545 (SynthID), Wiki Education, July 2026, Wiki Education, January 2026, Brooks, Eggert, Peskoff 2024, IEEE Spectrum, Wikipedia:Künstliche Intelligenz and the vote, WP:LLM, Paid-contribution disclosure.
• Languages, people, style: MULTITuDE, Macko et al., EMNLP 2024, Pangram multilingual, GPTZero multilingual, Fleckenstein et al. 2024, Kobak et al., Science Advances 2025, Geng & Trotta 2025, student survey, “Science and Education” 2026, MON and Ministry of Digital Transformation recommendations (OECD.AI), StrikePlagiarism, Ministry of Digital Transformation White Paper (dev.ua).
• Rules and money: AI Act, Article 50, Article 99, Digital Omnibus, Garrigues, Code of Practice, European Commission, DLA Piper on the Code, China, Covington, California AB 853, Pangram, Series A, GPTZero, Series A, Sacra on GPTZero, Grand View Research.