If you don't want to be responsible for it, another way is to just publish it anonymously: make a GitHub that isn't attached to your real name etc, perhaps using a one-off disposable email address, and put it there. Then you don't have to think about what the lawyers think. Worst case it'll get taken down, but by that point it'll likely be popular enough that there'll be plenty of copies.
[Pirate flag emoji here]
Sure, on github it will (still) get the most attention, but perhaps another repository outside the US is a better fit.
You could also create a text document instead of a software that details the mechanism used to fool other MIDI decoders and publish only that (for now).
Finally, familiarize yourself with the Art. 6 Software Directive (2009/24/EC) / §69e UrhG — decompilation for interoperability. It may be your ticket for a legal status in Germany/EU.
What if the companies start auto subpoenaing the AI companies to try and tie the code to an account?
> Worst case it'll get taken down,
Eeh, worst case scenario you'll get sued as Microsoft will have no problem with handing over everything they have from your Windows installation information, GitHub accounts, NPM authentication and everything else they own today if the courts tell them to.
You can't just commit crimes on the open internet without really hiding IPs and what not, and expect that to not come back to haunt you eventually. Kind of poor form to suggest otherwise too.