When Charles Hoskinson dropped Anthropies on GitHub last week, the crypto world shrugged. Four stars, a playful name, and a promise to strip Anthropic's AI watermark from Claude outputs. The Cardano founder called it a "warning" — not a product. But beneath the surface of this seemingly trivial open-source experiment lies a legal and technical landmine that could reshape how we think about ownership in the age of generative AI.
I've spent the last decade auditing blockchain projects, watching founders launch tools that either fade into obscurity or ignite movements. Anthropies, despite its humble start, has the potential to be the latter — not because of its code, but because of the uncomfortable question it forces us to ask: Who really owns the words an AI writes for you?
The Context: A Watermark No One Asked For
Anthropic's invisible watermark, rolled out in August 2026 to comply with the EU AI Act, uses a technique called "key-guided tournament sampling." It's not a hidden string pasted onto text; it's a statistical pattern woven into the very fabric of the model's output. The idea is brilliant: make AI-generated content detectable without sacrificing quality. But the execution assumes a level of trust that Hoskinson finds naive.
Anthropic's terms of service state that users "own" the outputs — but with a catch: ownership is "subject to your compliance with our Terms." Hoskinson seized on this phrase, arguing it's a "condition precedent" — meaning if you violate the terms (say, by removing the watermark), you never actually owned the output in the first place. This isn't just semantic gymnastics; it's a direct attack on the foundational promise of AI services.
The Core: Three Layers of Subversion
Anthropies isn't a single tool; it's a framework. Hoskinson's code divides the watermark removal problem into three layers:
- Layer 1: Co-Authored-By — A simple git trailer that Claude sometimes appends to code. Deterministic removal, zero text alteration.
- Layer 2: C2PA Image Metadata — Re-encoding images to strip embedded provenance credentials. Again, straightforward.
- Layer 3: Prose — The hard part. Here, the tool routes the text through a different large language model — one that doesn't watermark — to rewrite the content, effectively scrambling the statistical signal.
The key insight: the tool refuses to rewrite using the same model that added the watermark. "Orchestrate" mode detects the host model and blocks execution if it's Claude or Bard. This is a technically honest decision — you can't fight fire with fire if the fire is watermarked. Based on my own experience auditing LLM pipeline tools, this design choice is both elegant and limiting. The tool's effectiveness on prose is entirely dependent on the quality of the third-party model used for rewriting. And that model may itself have invisible biases or, worse, its own watermarking.
Hoskinson chose code as the primary demo use case. Why? Because code carries almost no watermark signal — the structured syntax leaves little room for statistical manipulation. The tool works flawlessly on code, but that's a curated battlefield. The real test — natural language — remains unproven, and the sacrifices in fidelity are unknown.
The Legal Subtext: More Than a Tool
Anthropies is licensed under Apache 2.0, which includes an explicit patent grant. This means Anthropic cannot sue Hoskinson or his users for patent infringement. More importantly, the license allows anyone to fork the code and continue development even if Hoskinson abandons the project. This is a legal shield, not just a technical one.
But the legal angle goes deeper. Hoskinson's reading of the "subject to compliance" clause, if adopted by courts or even by influential legal scholars, could force AI companies to rewrite their terms of service. The current boilerplate — "you own your outputs, but we can do whatever we want to enforce our policies" — is a house of cards. If the act of removing a watermark means you never owned the output in the first place, then every user who ever used Claude for commercial work under the current terms is potentially infringing. That's a class-action lawsuit waiting to happen.
Code is only as strong as the trust it protects. And here, the trust is fractured. Users trust AI companies to deliver what they promise. But when the watermark is permanent and the terms are conditional, that trust becomes a liability.
The Contrarian: Why This Tool Might Backfire
Let's be honest: Anthropies is a stunt. The GitHub repo has four stars. Hoskinson himself called it a "warning." The tool's practical value, especially for the prose that matters most, is unvalidated. And the legal argument, while clever, has no precedent. Courts are unlikely to accept a "condition precedent" interpretation that would retroactively void millions of users' ownership claims.
There's a darker possibility: the tool could be used for large-scale content fraud. Imagine a spam operation using Anthropies to strip watermarks from AI-generated articles, then publishing them as original work. The tool itself is neutral, but its existence lowers the barrier to misuse. Hoskinson didn't include any usage restrictions in the Apache 2.0 license — a deliberate choice that opens the door to abuse.
Moreover, the "non-origin rewrite" approach is a technological dead end. If every AI provider adopts watermarking, there will be no "clean" model to route through. The ecosystem will become an arms race of detection and evasion, with users caught in the middle. Bridges aren't built by one person. This tool, standing alone, cannot solve the systemic trust problem. It's a symptom, not a cure.
The Takeaway: A Wake-Up Call for Ownership
Anthropies is not the answer to AI watermarking. But it's a necessary question. It forces us to confront the uncomfortable truth that "ownership" in the AI era is a legal fiction, not a technical reality. The watermark is just the visible tip of an iceberg of conditional terms, opaque algorithms, and unilateral control.
We don't need more tools; we need more trust. And trust isn't built by a single developer writing code in a weekend. It's built through transparent governance, clear legal frameworks, and open dialogue between creators and users. Hoskinson's gesture is a reminder that the decentralized ethos — the belief that users should own their digital labor — is still alive, even if it's hiding in a four-star GitHub repo.
As the AI industry races toward regulation and monetization, the real battle won't be over watermarking techniques. It will be over who gets to define the terms of engagement. Will it be the companies that write the contracts, or the communities that challenge them? Anthropies may be a small shot across the bow, but it signals a larger war ahead.