The GitHub repository went live on August 16, 2026. Four stars. One commit. The README describes a tool named Anthropies—a name that sounds like a parasite but acts like a scalpel. Charles Hoskinson, the Cardano founder, released it with a clear mission: strip Anthropic's invisible watermark from Claude outputs.
An anomaly is just a story waiting to be read. The anomaly here is not the tool itself—it is the gap between the narrative it generated and the on-chain (or in this case, on-repo) signal. A tool that claims to dismantle a core component of AI transparency policy, yet has zero verified users, zero independent audits, and a codebase that is essentially a single-person weekend project. The pattern emerges only after the dust settles.
Context: The Watermarking Arms Race
Anthropic's watermark is not a simple string hidden in the output. It is a "key-guided tournament sampling" mechanism—a statistical bias injected during generation. It selects tokens with a slight preference based on a secret key, creating a detectable pattern across the entire text distribution. This is fundamentally different from post-hoc watermarks like C2PA metadata. The EU AI Act, effective August 2, 2026, requires providers to make AI-generated content machine-detectable. Anthropic implemented this method to comply.
Hoskinson's response: a three-layer tool that attempts to remove these signals. The first layer strips git co-author trailers. The second re-encodes C2PA image metadata. The third—the hardest—targets the prose itself. The method: route the text through a non-Claude LLM (like GPT or Gemini) and rewrite it. This is called "non-origin rewrite." The tool explicitly refuses to rewrite using Claude or Bard, because that would re-apply the watermark. It is a clever, counter-intuitive design choice.
Every transaction leaves a scar; I map the wound. In this case, the wound is the watermark signal. The scar is the rewritten text. The question is whether the scar is still recognizable.
Core: The Evidence Chain
Let me trace the technical signal. The tool's effectiveness depends on a critical assumption: that the external LLM endpoint does not itself re-apply a different watermark. If the rewrite model has its own detection mechanism, the output is simply re-tagged. Hoskinson's code does not check for that. It assumes a "clean" rewrite environment.
Based on my experience auditing 50 DeFi protocols for compliance in 2025, I learned that assumptions are the root of most security failures. The same applies here. The tool's Layer 3 (prose) is untested. No benchmarks, no success rate, no text fidelity metrics. The GitHub repository provides none. The only evidence of effectiveness is the code itself—and the code is primarily a demonstration on code snippets. The README notes that "code carries almost no watermark signal because syntax has little substitution space." This is a crucial admission: the tool's easiest target is the one where the problem is least severe.
I do not predict the future; I trace the past. The past here is a pattern: every "anti-watermark" tool in the last two years (e.g., GPTWatermarkRemover, NoMark) has failed to achieve meaningful adoption. None exceeded 100 stars. Anthropies fits the pattern. Four stars on day one is not a breakout. It is a whisper.
Yet the legal argument is what elevates this from a toy to a signal. Hoskinson parsed Anthropic's Terms of Service: "Subject to your compliance with our Terms, we assign to you all rights to the output." He argues this is a condition precedent—meaning if you violate the terms (e.g., by stripping the watermark), the ownership never transferred. You never had the rights to the content. This is a lawyer's attack, not a developer's fix. The Apache 2.0 license was chosen strategically: it grants patent protection and ensures the code cannot be easily taken down via DMCA or patent claims.
Contrarian: The Narrative vs. The Reality
Correlation is not causation. The narrative that "Hoskinson has built a tool to free users from AI control" is compelling. But the data tells a different story. The tool's actual utility is limited to code snippets. For prose—the domain where watermarks matter most—the effectiveness is unknown. The tool essentially says: "We can't remove the watermark, but we can rewrite your text using another AI." That is not removal; it is replacement. And it introduces a new set of problems: authorship ambiguity, semantic drift, and potential plagiarism.
Furthermore, the legal argument is untested in court. The "condition precedent" interpretation is one lawyer's reading. No precedent exists. Anthropic's silence is notable—they are preparing for a $2 trillion IPO. They have no incentive to engage with a 4-star GitHub repo. But silence can be a signal. It may indicate that the legal argument has enough merit to avoid public confrontation, or it may indicate that they see it as irrelevant.
The contrarian truth: Anthropies is not a watermark removal tool. It is a provocation. It is a move in the chess game of AI governance, not a technical solution. The tool's real impact will be on the next iteration of service terms and regulatory debate. The EU AI Act's enforcement will likely require more robust watermarking that resists simple rewrite attacks. The industry will adapt.
Takeaway: The Next Signal
The market should not look at the GitHub stars. It should look at the legal filings. If Anthropic modifies its Terms of Service in the next 90 days to explicitly state that output ownership is unconditional, that will be the signal that Hoskinson's argument was taken seriously. If they do not, the tool will fade into obscurity, leaving only a footnote in the history of AI regulation.
I trace the past. The past says that no single-person open-source project has ever changed the behavior of a trillion-dollar company. But the past also says that every such company eventually faces a regulatory reality. The anomaly is not the tool. The anomaly is the readiness of the legal system to handle AI content provenance. That is the story yet to be written.