Anthropies: The Code That Strips Watermarks and the Legal Argument That Matters More

Four stars on GitHub. One day old. A tool that claims to remove Anthropic's invisible watermark from Claude outputs. The author: Charles Hoskinson, Cardano founder. The tool: Anthropies. The technical architecture: three layers. The problem: the layer that matters most — prose — is the hardest. s heart. Anthropic deployed a tournament sampling watermark to comply with the EU AI Act, effective August 2, 2026. The watermark is not a hidden string appended to text. It is a statistical bias injected at generation time, a pattern that survives synonym substitution and punctuation changes. Hoskinson's response is not a conventional post-processing script. It is a routing system that sends text through a non-Claude LLM to overwrite the distribution. The clever part: the orchestrator detects the host model and refuses to rewrite if the source is already watermarked. The implication: the tool cannot operate within the ecosystem it aims to attack. It requires an external, non-watermarked endpoint. s heart. I have spent years auditing smart contract logic and system architectures. The first thing I check is the boundary between the theoretical claim and the practical constraint. Anthropies works well on code. Code, by its structural nature, carries minimal watermark signal. Low entropy syntax leaves little room for statistical bias. The tool's success on code is a foregone conclusion. The real test is prose. Natural language has high entropy. The tournament sampling embeds itself in the choices between equally probable tokens. To remove that, you must rewrite the entire passage through another model. That changes meaning. That changes style. The tool's documentation admits this: prose is the 'difficult layer.' The gap between the demo and the use case is the gap between code and natural language. s heart. The legal argument is the second layer. Hoskinson points to Anthropic's terms of service: 'We assign to you all our rights, title, and interest in and to the Output, subject to your compliance with our Terms.' The phrase 'subject to your compliance' is a condition precedent. If the user violates the terms — for example, by using Anthropies to strip the watermark — the ownership never transfers. The user never truly owned the output. This is not a settled legal interpretation. No court has ruled on it. But it exposes a structural weakness in the AI company's promise. The user receives a token, not a title. The tool is distributed under Apache 2.0, which includes a patent grant. Hoskinson has closed the legal path for Anthropic to sue the tool out of existence. The code can be forked. The argument can be copied. Contrarian angle: the bulls are not wrong about the signal. The tool is a warning, not a product. Hoskinson himself said so. The 4-star count is a feature, not a bug. It means the project is untainted by adoption. The legal argument is the real product. If it gains traction among legal scholars, it could force AI companies to rewrite terms of service. The tool becomes a precedent for a new class of 'policy hack' — open-source code paired with a legal brief, designed to expose the gap between marketing and contractual reality. The tool's effectiveness is secondary. Its existence as a reference point is the primary output. Takeaway: The lasting impact of Anthropies will not be measured in watermark removal success rates. It will be measured in the number of AI company terms of service that are updated in the next six months. The tool is a cold probe into the assumption that users own what they generate. The answer is: they do not. Not yet. The code is law until it is not. s heart.