Charles Hoskinson released a tool named Anthropies. It removes Anthropic’s invisible watermark from Claude outputs. The code is open source. The timing is deliberate. Two weeks after the EU AI Act’s transparency mandate took effect, the Cardano founder fires a precision shot at the center of AI governance.
This is not a technical breakthrough. It is a tactical escalation. The tool’s real target is not the watermark itself, but the legal and contractual architecture that supports it. The code does not lie, but it does hide — and Hoskinson is forcing the hiding to stop.
Context: The Regulatory Trigger and the Legal Trap
Anthropic’s watermark is a response to the EU AI Act, which requires AI-generated content to be machine-detectable. The company deployed a “tournament sampling” method — a subtle bias injected at the token generation level, leaving a statistical fingerprint across the entire output. It is not a visible string; it is a distributional signature.
Hoskinson’s counter is a three-layer deconstruction tool. Layer 1 removes git co-author trailers. Layer 2 strips C2PA image metadata. Layer 3 targets prose — the hardest part — by routing the text through a non-origin LLM (e.g., GPT) to rewrite it, scattering the original probability distribution. The tool refuses to execute on Claude itself, because rewriting inside a watermarked model would simply re-apply the mark. This is not a naive hack. It is a deliberate architectural choice.
But the real story is not in the code. It is in the legal framing. Hoskinson’s X post attached a legal argument: Anthropic’s terms of service transfer ownership of outputs “subject to your compliance with our Terms.” He argues this is a condition precedent. If the user violates the terms — by stripping the watermark — ownership never transferred. The user has been using content they don’t actually own. This is a bomb aimed at the foundation of every AI content license.
Core Analysis: The Three-Layer Architecture and Its Hidden Weakness
Let’s examine the technical layers. Layer 1 and 2 are trivial. Git trailers and C2PA metadata are deterministic markers. Stripping them is a one-liner. The difficulty is Layer 3: prose. The tool’s effectiveness here depends entirely on the quality of the non-origin rewrite model. If the rewrite model is watermarked too (e.g., GPT-4 with its own detection scheme), the watermarks may compound. If the rewrite model is not watermarked, it introduces a new distribution that may or may not preserve the original meaning. The trade-off is between watermark removal and semantic fidelity.
Based on my audit experience, I’ve seen this pattern before. In 2020, I tested Harvest Finance’s auto-compounding vaults and discovered that excessive rebalancing eroded profits. The same principle applies here: the more aggressively you rewrite, the more you lose the original signal. The tool’s “humanize” mode likely introduces randomness that destroys the watermark but also degrades quality. The code does not disclose the success rate, latency, or text fidelity metrics. That is a red flag.
More importantly, the tool’s demonstration focuses on code. The analysis report explicitly states that code carries almost no watermark signal because syntax has little substitution space. Hoskinson chose the easiest target. The prose layer is acknowledged as the “difficult” one. This is not a disclosure of humility; it is a strategic choice to maximize initial impact. The tool’s real-world effectiveness against natural language — the domain where watermarks matter most — remains unproven.
Check the gas, then check the truth. The GitHub repo has 4 stars. No independent validation. No peer review. The tool is a concept, not a product.
Contrarian Angle: The Real Battle Is Legal, Not Technical
Hoskinson’s tool is a rhetorical weapon disguised as code. The technical functionality is secondary to the narrative it enables. The tool’s purpose is to create a concrete example for a legal argument. The “condition precedent” interpretation is not settled law — it is a plausible reading that has not been tested in court. But it does not need to win in court to change behavior. It only needs to sow doubt.
Retail investors see a hero fighting AI censorship. Smart money sees a liability play. If the legal argument gains traction, AI companies will be forced to rewrite their terms of service, acknowledging that output ownership is conditional. This will increase compliance costs and create uncertainty for downstream users. That uncertainty is the real alpha — the friction that hedge funds and arbitrageurs will exploit.
Precision is the only hedge against chaos. Hoskinson’s Apache 2.0 license choice is a deliberate legal shield. It prevents Anthropic from using patent claims to stop forks. The tool is designed to be an unkillable public good. But that also means it can be weaponized for fraud. Deepfake content, fake reviews, academic dishonesty — the tool is neutral, but its most likely use cases are not noble.
The market reaction has been muted. ADA barely moved. The narrative is still in the “seed” phase. The real test comes when Anthropic responds — or refuses to respond. Silence is a sign of weakness. If they ignore it, the legal argument gains credibility. If they fight, they validate it.
Takeaway: The Long Tail of Contractual Attack Vectors
Hoskinson’s Anthropies is not about removing watermarks. It is about exposing the contractual fragility of AI-generated content ownership. The tool will not change the watermark arms race overnight. But it changes the conversation. Every AI company now knows that their terms of service can be weaponized against them. The next phase will not be technical — it will be legal and regulatory.
Volatility is the tax on uncertainty. The uncertainty Hoskinson has created will persist until the courts clarify the condition precedent argument. That may take years. In the meantime, the code is out there, and the narrative is in motion. The real battle is not between Claude and a Python script. It is between the promise of ownership and the fine print that takes it away.
Backtest the assumption, not just the data. The assumption that AI outputs are free and clear is now open to challenge. The data supporting that assumption was always buried in the terms of service. Hoskinson just dug it up.