In the quiet of a GitHub repository with only four stars, a tool was born that claims to do what many thought impossible: strip the invisible watermark from Anthropic's Claude outputs. But as I traced the code back to the silence of 2017—when I spent three months auditing Bancor’s Solidity contracts and found integer overflows that no one else saw—I recognized a pattern. This isn’t just a technical tool. It’s a legal grenade wrapped in an open-source license.
Charles Hoskinson, the founder of Cardano, released Anthropies on August 16, 2026, as a free, open-source utility to remove the tournament-sampling watermark that Anthropic embedded in its AI-generated text. The tool’s name is a deliberate pun: “Anthropic” + “lies”? Or “Anthropic” + “pies”? Either way, it’s a provocation. But the real story isn’t in the code—it’s in the contractual contradiction that Hoskinson has unearthed.
Context: The Watermark and the Law
Anthropic’s watermark, introduced to comply with the EU AI Act’s transparency requirements (effective August 2, 2026), uses a key-guided tournament sampling that biases the model’s word choices subtly enough to be invisible to humans but detectable by machines. The idea is noble: make AI-generated content identifiable. But Hoskinson’s argument—and his tool—turns this on its head. He points to Anthropic’s own terms of service, which state that output ownership is transferred “subject to your compliance with our Terms.” In legal jargon, this is a condition precedent: if you violate the terms (say, by stripping the watermark), you never truly owned the output. The watermark, then, isn’t a transparency feature—it’s a leash.
Core: The Technical Architecture and Its Limits
Anthropies dissects the problem into three layers. Layer 1 removes git trailers (co-authored-by signatures). Layer 2 strips C2PA metadata from images. Layer 3, the hardest, targets prose—the natural language where the watermark is most deeply embedded. The solution for prose is a “non-origin rewrite”: the tool actively detects whether the model it’s rerouting through is itself a watermarked provider (Claude, Gemini, etc.) and refuses to execute the rewrite on that same model. Instead, it routes the text through a third-party LLM that doesn’t apply watermarks—effectively replacing one AI’s output with another’s.
This is where the technical honesty begins. Hoskinson himself admits that prose is the “difficult layer.” Code, by contrast, is almost watermarked-free because syntax offers little room for statistical bias. The tool’s demo uses code snippets, which are its strongest case. Based on my own experience auditing ERC-721 implementations during the 2021 NFT craze, I know that code is structurally resistant to probabilistic watermarking—it’s like trying to hide a signal in a binary tree. The real test will be with long-form prose, and that test is still pending. The codebase has zero independent verification, no peer review, and only four stars on GitHub. We audit not to judge, but to understand, and what I understand is that this tool is a proof of concept, not a production-ready solution.
Contrarian: The Tool’s Real Value Is Legal, Not Technical
The conventional reading is that Anthropies is a watermarks removal tool. But the contrarian angle is that its true purpose is to expose the fragility of Anthropic’s terms of service. Hoskinson’s legal argument—that the “subject to your compliance” clause makes watermarks removal a breach that voids ownership—is a clever bit of contractual interpretation. If accepted, it would mean that every Claude user who ever used the output for commercial purposes without stripping the watermark (and thus complying with the terms) might not actually own the content. This is a bomb under the entire AI-as-a-service model.
But here’s the blind spot: the tool itself may not be necessary for this argument. The legal critique stands independently of the code. The code merely provides a demonstration—and a way to force the issue. Hoskinson has chosen Apache 2.0 licensing, which grants patent protection and ensures the tool cannot be easily killed by a single legal action. Authenticity is not minted, it is verified, and in this case, the verification lies in the legal reasoning, not the technical execution.
Another contrarian insight: by focusing on code as the primary demonstration, Hoskinson may be overstating the tool’s effectiveness. Code is the easiest target; prose is the hardest. If the tool fails on prose, its narrative collapses. But the legal argument survives regardless. The tool is a Trojan horse for a larger debate about who truly owns AI-generated content.
Takeaway: The Vulnerability Forecast
The real vulnerability here isn’t in Anthropic’s watermark—it’s in the contractual architecture that underpins all AI services. Hoskinson’s intervention will likely force AI companies to revise their terms of service, making ownership transfer unconditional and explicit. In the long run, this strengthens the AI industry, not weakens it. But in the short term, it creates a wave of anxiety and a potential PR crisis for Anthropic, which is reportedly preparing for a $2 trillion valuation IPO.
Solitude clarifies the signal amidst the noise, and the signal from this event is clear: the battle over AI content is shifting from technical watermarking to contractual rights. The tool may fade, but the legal precedent it sets will echo. As I wrote in my 2022 report on stablecoin failures, the most dangerous vulnerabilities are often hidden in plain sight—in the fine print, not the code. Anthropies is a reminder that in the race to regulate AI, the law is the most powerful tool of all.