Google launched ARTEMIS on September 9 — an open-source Android automation framework that hits 99%+ on AndroidWorld Benchmark. Within days, Minitap co-founder Nicolas Dehandschoewercker opened the repo and noticed something familiar: 228 of 229 files were identical to Minitap’s own mobile-use project. The giveaway wasn’t the matching agent name, or the identical WhatsApp test example. It was a shared file-reading bug. Nobody copies a bug by accident.
What Google Shipped #
ARTEMIS is genuinely useful. It turns natural-language instructions into reliable Android automation, integrates as a native MCP server with Claude Code, Antigravity, and Codex, and drives real devices — capturing screenshots and Logcat output along the way. Technically, it’s a strong project. That’s exactly the problem.
Minitap’s mobile-use is an open-source multi-agent framework that achieves 100% on AndroidWorld across 116 tasks and 20 apps. It was built by Pierre-Louis Favreau, Jean-Pierre Lo, and Nicolas Dehandschoewercker, released under Apache 2.0, and published months before ARTEMIS appeared. When Dehandschoewercker opened Google’s repository, he found the original pyproject.toml still contained mobile-use’s version number, 3.6.3, alongside all three of his team’s names — under a Google LLC copyright header.
The Force Push #
A sloppy fork with no attribution would be bad. What Google did was different. The commit that replaced the three Minitap authors with another name was a git force push — a deliberate rewrite of the public history. It wasn’t an omission. Someone made a decision to remove those names and push it through. The Hopper agent, named after a Minecraft character by Minitap engineer JP Lo, appeared in ARTEMIS word-for-word with the same system prompts. The WhatsApp New Year example — send Happy New Year to Alice, Bob, and Charlie, same comments, same cleanup — was identical. And the file-reading bug that exists in mobile-use exists in ARTEMIS too. That bug is the timestamp.
Minitap documented the full case in a post titled “I Expected Better from Google.” The community response was swift: GitHub issue #61 called it theft outright, issue #79 demanded deletion for author rights violation, and the Hacker News thread called it “pretty damning.”
What Apache 2.0 Actually Requires #
Apache 2.0 is one of the most permissive open-source licenses in common use. You can fork it, modify it, ship it in a commercial product, and never release your changes. But it has four concrete obligations per the official license text:
- Retain all copyright, patent, trademark, and attribution notices from the original source
- Mark modified files with notices stating they were changed
- If the original includes a NOTICE file, include a readable copy of its attribution notices in your distribution
- Include a copy of the Apache 2.0 license itself
That’s it. Google didn’t need permission to fork mobile-use. It didn’t need to release ARTEMIS under Apache 2.0. It didn’t need to credit Minitap in marketing materials or on the product page. It just needed to not strip the authors from the source and commit history. That was the minimum, and it didn’t clear it.
Google’s Response #
After Minitap’s public blog post, a Hacker News thread, and three GitHub issues asking for deletion of the repo, Google added an acknowledgement: ARTEMIS “includes source code developed by Minitap.” The commit history was not restored. The author names were not restored to pyproject.toml. The community consensus was firm — too little, too late.
It’s worth noting that Google isn’t the first large organization to mishandle open-source attribution. Verizon settled a BusyBox GPL violation. Orange S.A. paid €900,000 for GPL non-compliance. The Apache 2.0 license has been tested in court. The consequences are real, even if enforcement is slow and unglamorous.
What Developers Can Do #
If you maintain an open-source project under Apache 2.0 and care about attribution, the license alone may not be enough protection in practice. A few things that make violations harder to hide:
- Add a NOTICE file listing contributors by name — derivative works must include it
- Embed SPDX identifiers in every source file — stripping them becomes deliberate and visible
- If attribution is core to why you’re open-sourcing the work, consider AGPL or SSPL instead — these impose stronger conditions on how derivatives are distributed
And know what you’re signing up for when you choose Apache 2.0. It’s a gift with conditions, not a gift with no strings. The conditions are minimal, but they exist.
The Bottom Line #
Apache 2.0 is the most permissive license in common use among production software. If you can’t clear the bar it sets, something deliberate happened. Minitap built something good. Google found it useful, took it, rewrote the history, and only acknowledged the original team when the community forced the issue. The acknowledgement was the minimum possible response. Whether that’s good enough is a question each developer gets to answer for themselves — starting with which projects they contribute to and which licenses they choose.