A weekend project about LLM guardrails, copyright, and why proving your code is yours turned out to be a lot more complex than it should be.
This is a firsthand look into an experimental weekend project, not legal advice. If any of this matters to your actual business, talk to an actual lawyer in your jurisdiction. I use multiple LLMs daily as idea generators for code, production work, and research.
So don’t read the next few paragraphs as naive surprises. I’m not pointing fingers at the model providers or pretending I didn’t know what I was walking into over the last 4 years of use. I’m just trying to work within the tools we’ve actually been given, ethically, and see how far that can get you.
The rabbit hole
It started with a paper I found while reading through arXiv: Verifiable Provenance and Watermarking for Generative AI, which builds an evidentiary framework mapping cryptographic provenance and watermarking schemes to the actual proof thresholds used in courts and regulation.
The finding that stuck with me, paraphrased from a conversation about the paper, was that no single scheme on its own clears the bar under realistic adversarial conditions. It’s the combination of methods that holds up, not any one of them in isolation.
And CLASP: Training-Free LLM-Assisted Source Code Watermarking via Semantic-Preserving Transformations. https://arxiv.org/pdf/2510.11251
CLASP reformulates source code watermarking into two stages: Semantically Consistent Embedding, which uses LLMs to perform semantics-aware watermark insertion from a fixed transformation space, and Differential Comparison Extraction, which recovers watermark bits through retrieval-grounded comparison against the most likely original code
That sent me down a rabbit hole for the weekend, using three frontier LLMs, Gemini, OpenAI, Perplexity, and Claude Sonnet 5, to both research the problem and try to build something real out of it as a challenge. What I found surprised me, not because the models refused things, but because of exactly which things they refused and which they didn’t.
Some even locked down, failing to proceed any further. There are always two sides to every guardrail, and it is good for when someone nefarious tries to circumvent the systems, but on the other side, what about the good ideas trying to provide preventive measures caused by the ouroboros machines themselves?
Testing the guardrails on my own code
I’ve been using LLMs since close to their public release. With years of writing Java and Python, I can count on one hand the times I’ve had genuine pushback on a code request. This weekend was different, and for a specific reason: I was trying to get an LLM to respect our proprietary licence header that we had coded in, sitting at the top of our own file.
A closer look at what Privacy Enhancing Technology actually means for vector memory and where the software you use every day really stands.
There’s a category of software that nobody threat-modeled yet, and it’s the one most of us are using every day now. Every time you tell an AI agent something, a decision, or a code action, that’s a data collection event. Somewhere, in a data center rack, a provider just wrote down and stored a piece of you.
As we’ve moved further into thinking seriously about privacy, we’ve spent a lot of time reading comments on web boards, forums, the usual places people talk honestly when nobody’s watching. There’s a real divide out there. Some users feel powerless, like the decision was already made for them somewhere upstream.
Others feel genuinely liberated by what’s happening with current technology, like a door just opened that used to be locked. We sit firmly in the second camp with a strong leaning into privacy, and this piece is really an attempt to explain why and to walk through what’s actually happening under the hood when people talk about privacy in AI software, not just assert it.
Most memory products treat this the way software treated user data in 2012. Centralize it, store it in someone else’s cloud, and call the privacy policy the privacy strategy. We built VEKTOR the other way, local-first, zero egress, your SQLite file on your machine. But “we don’t send your data anywhere” is a start, not a finish. So we sat down and asked ourselves a harder question: if we actually held ourselves to the standard the privacy engineering field uses, Privacy Enhancing Technologies, PETs, where would we land?
The honest answer is partly there, further along than most competitors, and with real gaps we can name specifically. This piece walks through where we actually stand, what we built and hardened this week to close part of the biggest gap, and what’s still being worked on.
We’re not waiting for AI companies, corporations, or governments to define this future for us. That resonates with something we believe at a basic level: people should be in control of their own sovereignty, their own software, not dictated to by Silicon Valley or by any government. It’s an engineering constraint we build against. Local, air-gapped software is your highest ground as a citizen here. No corporation can be told what to do by a government if their reach never touches the provider's cloud because your data or their model was never in it.
We all have the ability to decide what software we use, who we support, and how much privacy we hand over to companies and governments. We don’t need to feel powerless. You make a choice every time you click on a set of terms, every time you hit accept or decline on a cookie banner, every time you allow a government to pry further into your software or your home under the guise of “if you haven’t done anything wrong, you have nothing to worry about.”
Any time I hear that line, I shake my head. Privacy is a right. It’s not something you forfeit based on your ability to prove innocence. It exists to protect human dignity, autonomy, and civil liberties, not to shift the burden onto the individual to demonstrate they aren’t guilty of something.
Not because of the headline numbers, though those are striking enough. Claude authored over 80% of the code merged into Anthropic’s own codebase, and so are other frontier companies now. Engineers are shipping eight times more output per quarter than they did two years ago. An agent completing tasks that would take a skilled human sixteen hours, working continuously, without being redirected once.
What got me was the graph showing lines of code per engineer over time. Flat for four years. Then a sharp bend upward in 2025 when Claude started running code rather than just suggesting it, the ouroboros, a binary Gödel machine feeding code back into itself. Then steeper again in 2026 when agents started working autonomously over longer horizons.
Smart cookies, Anthropic. In just a few years they managed to get the moola, 1 trillion, in fact. Purchasing strategic infrastructure like Vercept, Bun, Coefficient Biohealth, Fractionless AI, and Stainless, the SDK experts, for whom Anthropic was one of their first larger clients, makes sense strategically.
I looked at that graph and felt two things at the same time. Genuinely impressed. I really like Anthropic, and, if I’m honest, I'm a little concerned.
Pretty much all of the brains and infrastructure in AI will be consolidated into a handful of companies, reminiscent of the 80's when Microsoft made deals with all the hardware manufacturers so Windows was the only licensed OS allowed. That's why Linux was smart to pivot to servers and retained 60% of market share to this day, Ubuntu is great; it works and very rarely has any reliability issues, along with Red Hat and Debian.
A self-indulgent weekend divergence from the usual Vektor memory business content. Consider what happens when you give a developer two days off, unlimited internet archive access, and too many ideas crammed into one article."
Writing this article began organically. Which is a funny thing to even have to say in 2026.
What does organic even mean now? I don't care, man; I just want to be free to express myself, man.
I did not write this on a mechanical typewriter.
I wrote it on a PC with my stubby index fingers running Windows software that, miraculously, does not blue screen every ten minutes anymore. It only took Microsoft thirty years to pull that off.
To the left sits an analog record player with some secondhand Yamaha bookshelf speakers I found at a charity shop; to the right of me sits a modern dark wood-paneled Zen PC case, a processor that would have occupied an entire room thirty years ago, and a GPU that can synthesize gargantuan piles of AI slop or brilliant code in roughly ten seconds flat.
And yet, for all that raw power, it still comes down to an algorithm. It always has.
The Sharper Image and the Death of Wonder
When I was a kid I used to walk into The Sharper Image store at Faneuil Hall Marketplace in Boston and just stand there. Looking at technology I could not afford while the staff watched me carefully to make sure I did not break anything.
I also grabbed some brightly colored rock salt candy; I loved that stuff, some core memories right there.