Anthropic is rushing toward a $2 trillion IPO, but its watermark—designed to comply with the EU AI Act—just met a ghost from crypto's past. Charles Hoskinson, the founder of Cardano, dropped a free, open-source tool called Anthropies on August 16, 2026. Its stated goal: strip the invisible tags from Claude's output. The immediate reaction? Four GitHub stars and a flurry of legal arguments. But beneath the surface, this is not a technical hack. It is a philosophical landmine buried in a service contract. Code over hype.
Hoskinson's move is a direct response to Anthropic's implementation of a 'key-guided tournament sampling' watermark—a method that injects a detectable statistical pattern into the text at generation time, rather than adding a post-hoc string. The European Union's AI Act, effective August 2, 2026, requires that AI-generated content be machine-detectable, and Anthropic was one of the first to comply. The company's service terms claim that users 'own' the output, subject to compliance with the Terms. Hoskinson's weapon is not a brute-force algorithm; it is a legal scalpel. He argues that this 'subject to your compliance' clause is a condition precedent—meaning ownership never transfers if the user violates the terms. And what constitutes a violation? Removing the watermark. The circular logic is elegant: to truly own your Claude output, you must not alter it, but the watermark ensures you can never be certain it's yours. Truth decays slowly.
Context: The Three-Layer Architecture of Anthropies
Anthropies is not a single tool but a three-layer decomposition framework. Layer 1 handles 'Co-Authored-By' git trailers—deterministic removal of metadata that signals AI involvement. Layer 2 strips C2PA image credentials by re-encoding the image file. Layer 3, labeled 'Prose,' is the hardest. It attempts to remove the statistical watermark by routing the text through a non-origin LLM (e.g., GPT-4o) for rewriting. The key insight: rewriting within the watermarked model (Claude, Gemini) would simply re-apply the watermark, so the tool explicitly refuses to do so, entering an 'orchestrate' mode that routes to external models. This is a technically honest design—it admits the tool cannot operate inside the watermarked ecosystem. Based on my experience auditing decentralized identity protocols, this self-limiting architecture is rare in activist tooling. Most projects overpromise. Hoskinson underpromises technically, but overpromises legally.
Core: Where the Real Battle Lies
The tool's effectiveness is asymmetric. Code carries almost no watermark signal because syntax leaves little room for stochastic manipulation. Demonstrating the tool on code is like showing a lockpick works on a cardboard box. The real test is natural language prose—where the watermark is strongest because token choices are abundant. The third layer's reliance on external LLMs for rewriting introduces a new set of problems: fidelity loss, semantic drift, and the question of who actually authored the rewritten text. If Claude's watermarked output is rewritten by GPT, does the output belong to the user, OpenAI, or Anthropic? The tool does not answer this—it only hands off the problem. This is the hidden cost of the 'non-origin rewrite' strategy: it trades one dependency for another.
Meanwhile, the legal argument is the headline grabber. Hoskinson's reading of the 'subject to your compliance' clause as a condition precedent is plausible but unlitigated. In contract law, courts often distinguish between promises and conditions. If the clause is interpreted as a mere promise, users who breach may be liable for damages but still retain ownership. Hoskinson's interpretation is the aggressive one—and it hinges on the word 'subject.' If adopted, it would mean that millions of Claude users have never legally owned the text they generated, even if they paid for the API. This is not just a rhetorical jab; it threatens the entire business model of AI companies that assert 'you own your outputs.' Build anyway.
Contrarian: The Tool's Real Weakness Is Its Strength
Anthropies is brilliant as a narrative weapon but mediocre as a practical tool. The prose layer is unproven; the code layer is trivial; the legal argument is untested. Its reliance on external LLMs means it cannot operate in a closed loop—if Anthropic ever blocks routing to competing models, the tool's core function evaporates. Moreover, the project is a single point of failure: Hoskinson controls the repository, and his notoriously combative style (he has spent 2026 arguing about technical credit with Ethereum proponents) suggests the tool may be abandoned once the media cycle passes. The 4-star GitHub count is not a bug; it is a feature of the current bear market, where survival matters more than gains. Yet, the tool's Apache 2.0 license ensures it cannot be killed by a single lawsuit. Hoskinson has weaponized open-source governance to create a legally forkable asset. The ultimate irony: the tool is more decentralized than the concept of 'AI sovereignty' it defends.
The contrarian angle is that the tool's greatest impact may be on the AI industry's compliance architecture. If even a handful of legal scholars adopt Hoskinson's condition-precedent argument, we could see a wave of user agreements revised to include explicit ownership transfer language that cannot be revoked. This would force AI companies to choose between a clean, unconditional ownership grant (which weakens their control over misuse) or a conditional grant that leaves users uncertain. The tool itself may never be used widely—but its legal shadow could reshape the contracts of every major AI provider. This is the kind of slow, structural decay of trust that the 'Truth decays slowly' signature captures. Hold the line.
Takeaway: The Battle Is Over Who Controls Our Digital Labor
Hoskinson's Anthropies is not a tool for the masses. It is a signal flare. It says: 'The watermarks are not just compliance features; they are chains on your intellectual output.' The real question is not whether you can strip a watermark, but whether you should have to. In a world where AI is becoming the default for writing, editing, and coding, the ability to assert ownership over your own work is existential. The EU AI Act's transparency requirements are well-intentioned, but they create a surveillance infrastructure that benefits the model provider more than the user. The tool's modest adoption—4 stars—reflects the current market's indifference, but the idea is viral. It will not be the last such tool. The open-source community will inevitably produce more sophisticated watermark removers, and the cat-and-mouse game will escalate. The only sustainable solution is not a better watermark or a better removal tool—it is a radical rethinking of who owns the output of intelligence. Until that happens, every watermark is a leash.
Hold the line.