The tool that makes AI writing disappear. A whole industry already sells the same trick — and it's scamming students.

Sponsored by

A tool that quietly went viral on GitHub this week does one thing: it takes text that reads like it was written by an AI, and rewrites it so it doesn’t anymore.

It’s called humanizer, it’s free, it’s open source, and as of this week it sits at 43,700 stars and 3,700 forks under an MIT licence — one of a cluster of “agent skill” repos that GitHub’s own trending trackers have flagged as the fastest-moving category on the platform this month. Its one-line description is almost funny in how plainly it states the thing: “Agent skill that removes signs of AI-generated writing from text.”

Here’s the twist that makes it worth your ten minutes today. There is already an entire industry built around the exact same promise — “make your AI-flagged text look human again” — and large parts of it are a scam that’s been quietly wrecking students, academics and now politicians. A brand-new piece of research puts hard numbers on how badly it breaks the detectors everyone assumed still worked. And the fixes on offer aren’t the ones you’d expect.

🪞 What the tool actually does

Most “AI humanizer” products are black boxes: paste text in, pay a subscription, get text out, hope for the best. Humanizer is different mostly because you can read exactly what it’s doing.

Its rulebook is lifted, openly and directly, from Wikipedia’s own internal style guide — an essay maintained by WikiProject AI Cleanup called “Signs of AI writing,” written by volunteer editors who spend their time reverting AI slop out of encyclopedia articles. The tool encodes 35 of those patterns across six categories:

It runs a two-pass process — a first rewrite that doesn’t touch structure, then a check of the draft against the pattern list and the original source material — and its own documentation is explicit that it isn’t allowed to invent anything: every fact in the output has to trace back to the source text or the writer’s own material. It can also take a sample of your actual writing and match your voice to it, and it’s careful about what it touches, leaving code blocks, data, frontmatter and links alone.

Judged purely as a writing tool, this is a genuinely useful, honestly-built thing. Plenty of people write in short, punchy, list-heavy prose naturally and have watched a detector flag their very human work as robotic. Reddit threads and marketing-team Slack channels are full of writers who’ve had real posts wrongly accused of being AI slop, for the crime of using an em dash twice in one paragraph. A free, transparent, source-truthful tool that helps a human sound like themselves again is a defensible thing to build and to star.

The trouble is what sits next to it in the market.

One quick word from today’s sponsor

Smarter CRM. Less Busywork.

Disconnected data and tools make it harder to understand your customers. HubSpot's Agentic Customer Platform brings your data, teams, and tech stack together with AI built in to help your business work faster and create more personalized customer experiences.

Why HubSpot and what's new

• Use AI powered tools to take action faster

• Unify your data, teams, and tech stack in one place

• Create one shared view of customer data

• Connect teams around the same customer context

• Bring your business tools into one place

Connect more of your business in one place and give every team a smarter way to work. Get set up quickly and start checking off your hardest tasks.

Get started free

💸 The industry already selling the same trick — badly

For over a year now, a wave of commercial “AI detector” sites has been running a much dirtier version of the same play, and a recent investigation into three of them — JustDone AI, TextGuard and Refinely — laid out exactly how it works.

Step one: the detector flags something as AI-written that plainly isn’t. In one documented case, a detector scored a real, human-written report on the US–Iran conflict at 88% AI-generated. The same investigation found these tools mis-scoring legitimate human writing across Dutch, Greek, Hungarian and English, and in some cases flagging outright nonsense text as AI-written too — the kind of inconsistency that suggests scripted theatre rather than genuine analysis.

Step two: the same product, or a conveniently linked one, offers to fix the false flag — for a fee, up to $9.99 in the case reported. Pay up, get a “humanized” version, and the accusation quietly disappears.

That’s the researcher Debora Weber-Wulff’s description of the output — text that isn’t rewritten so much as mangled into something technically undetectable and often close to nonsensical.

Students and academics are the primary target. One of the detectors claimed partnerships with prestigious institutions, Cornell among them; Cornell has denied any such partnership exists. It’s not hard to see why students are the mark: a false 88% AI score attached to your own essay, two days before a deadline, with a $9.99 “fix” sitting right there, is about as effective a pressure sale as exists.

But the harm doesn’t stop at tuition-paying users. In one case, screenshots from one of these detectors were circulated by pro-government influencers to falsely accuse Hungarian opposition politicians of fabricating campaign documents with AI. NewsGuard’s Waqar Rizvi has a name for the broader effect: the “liar’s dividend” — once everyone knows AI-generated fakes exist, anything real becomes deniable, because you can always claim the evidence against you was AI slop, or wave a bogus detector score to make someone else’s real evidence look fake.

🔬 The number that should worry the people who build detectors

None of this would matter much if the underlying detectors were solid and only the scam-tier wrapper products were broken. They aren’t. A piece of research published under the name DAMAGE (“Detecting Adversarially Modified AI Generated Text”) put real numbers on it by auditing 19 different humanizer and paraphrasing tools, split into three quality tiers, and testing them against commercial AI detectors.

The headline result: run AI-generated text through a decent humanizer, and GPTZero’s detection rate collapses from 99.73% to 60.04%. That’s not a niche failure mode — that’s a widely used, paid, enterprise-trusted detector going from “essentially always right” to “barely better than a coin flip” against text that’s been through one extra processing step available to anyone for free.

It gets worse for the provenance side of the industry too. Google’s SynthID is a watermarking system built to survive exactly this kind of tampering — an invisible signal baked into AI-generated text at the token level, designed to be robust to light editing. Feed SynthID-watermarked text through a humanizer, and DAMAGE’s testing found detection of the watermark fell from 87.6% to 5.4%. The one detection method that didn’t depend on spotting stylistic “tells” — because it was hidden in the statistics of the text itself — got wiped out almost completely.

The researchers’ own detector, trained specifically to recognise humanized text rather than raw AI output, did much better: 98.26% true-positive rate at a 5% false-positive rate against humanized text, and 93.2% even against humanization specifically tuned to beat that exact detector. That’s the encouraging half of the story — adversarially-aware detectors can be built to keep pace. Nobody has deployed one at the scale of GPTZero or Turnitin yet.

One more detail worth sitting with: even the best-performing (“L1”) humanizers in the study only won a 26% fluency contest against the unmodified originals. Most of what “beats” detection reads noticeably worse than what it started from. Undetectable and good are not the same achievement, and right now almost nothing on the market is both.

⚖️ What to actually do about it

None of this is a reason to panic about a viral GitHub repo, and it’s not a reason to trust the next site that offers to check your work for $9.99 either. A few concrete moves, aimed at different readers:

1. If you’re an educator or administrator, stop treating a detector score as evidence. Cornell’s own teaching centre has published the cleanest version of this advice anyone has: “We currently do not recommend using current automatic detection algorithms for academic integrity violations using generative AI, given their unreliability… Detection tools claim to identify work as AI generated, but cannot provide evidence for that claim, and tests have revealed significant margins of error.” Their alternative — verifying citations, comparing against a student’s known prior work, and having an actual conversation — is slower and it’s also the only approach that doesn’t risk falsely accusing someone on the strength of a number a vendor won’t explain.

2. If you build or buy AI-detection tooling, budget for the arms race, not a one-time purchase. DAMAGE’s own numbers are the proof: a detector trained specifically against humanized text held up where a general-purpose one collapsed. Static detectors decay the moment a popular humanizer changes its patterns; whatever you deploy needs the same continuous retraining the humanizer side gets for free from an open-source community.

3. If you’re relying on a single AI-detection score to make an accusation — of a student, an employee, a politician — stop. That’s now a documented attack surface with a name (the liar’s dividend) and a real-world case study (Hungary). A screenshot of a detector percentage is not evidence; treat it the way you’d treat an anonymous tip.

4. If you’re a writer worried about false positives, the open, transparent tool is the safer choice over the paid black box. Humanizer’s rulebook is public, its “don’t invent facts” constraint is stated outright, and you can read exactly what it changed. A tool that won’t show you its method and also happens to be selling you the fix to a problem it just diagnosed deserves the opposite of your trust.

5. If you work in security or trust & safety, start thinking about humanizing as a generic evasion primitive, not a niche essay-writing problem. Attackers already spend real engineering effort evading automated content filters — invisible-Unicode phishing campaigns built to slip past spam scanners are already documented in the wild. A free, well-engineered tool for stripping the statistical fingerprints out of machine-generated text is exactly the kind of general-purpose capability that tends to get pointed at more than one problem.

🧵 The takeaway

The interesting thing here was never really the GitHub repo. It’s that “can a machine tell what another machine wrote” turned out to be a much shakier foundation than a whole industry — schools, platforms, publishers, now apparently political operatives — had quietly started building on top of. One honestly-documented open-source tool made that shakiness obvious to everyone at once. The dishonest version of the same tool had already been exploiting it, quietly, for money, for over a year.

The fix was never going to be a better detector arms race that ends in a winner. It’s the boring, human one Cornell already landed on: don’t let a number you can’t audit stand in for a judgment you’re responsible for making yourself.

Reply and tell me if you’ve been wrongly flagged by one of these tools — I’m curious how common the false-positive experience actually is.

📚 Sources — every figure above, checked at the primary source

Not printed, because it could not be confirmed at a primary source: any claim that the open-source humanizer tool itself has been used in a phishing or disinformation campaign — none was found, and point 5 above is framed as a forward-looking risk, not a reported incident.