Microsoft Paint silently watermarks your local AI images with a server-issued GUID

A security researcher has discovered that Microsoft's Paint and Photos apps invisibly embed server-issued tracking identifiers into AI-generated images — even when those images are generated entirely on-device using local models on Copilot+ PCs.

What reverse engineering found

Researcher Xusheng Li, who has previously reverse-engineered other undocumented Windows components, discovered through binary analysis that both Paint and Photos follow a hidden sequence when generating AI images. Even when generation uses local ONNX models shipped inside the Windows app, the user's prompt is still silently transmitted to a Microsoft server for "moderation." That server returns a GUID (a globally unique identifier) alongside the moderated prompt. The GUID is then invisibly embedded into the pixels of the generated image as a watermark.

The invisible watermark is entirely separate from, and uncontrolled by, Paint's visible watermark feature — the optional Copilot logo that can appear in the corner of AI-generated images. Toggling off the visible watermark has no effect on the GUID embedding. Microsoft provides no user-facing toggle to disable it.

Why "local AI" isn't fully local

The finding punctures a key marketing premise of Copilot+ PCs: that AI processing happens on your device, protecting your data. The Paint and Photos implementation is partly local — the image pixels are computed on the device — but the prompt text leaves the machine before any image is generated. That server interaction also embeds a persistent per-image identifier, invisible to the user, that travels with the image in any C2PA-compliant format.

Notably, Paint restricts AI-generated images to only four formats: PNG, JPEG, GIF, and the app's native .paint format. These happen to be the formats that preserve C2PA (Coalition for Content Provenance and Authenticity) metadata intact. The format restriction is not explained to users, but it has the effect of ensuring the watermark survives every export.

What Microsoft discloses — and what it doesn't

Microsoft does publicly disclose that Paint adds C2PA metadata to AI-generated images, as part of its support for AI content provenance standards. The EU AI Act, Article 50, requires that AI-generated content be labeled, and C2PA is the industry-standard mechanism for doing so. Anthropic made a similar announcement last week about Claude's text watermarking for the same regulation.

What Microsoft does not disclose in its user-facing documentation is the invisible GUID watermark embedded in the image pixels, or that the user's prompt is transmitted to a remote server even during "local" generation. Li's research was partly inspired by reading Anthropic's watermarking announcement and wondering whether Windows apps were doing something similar — it turns out they were, and more.

The broader question

The invisible GUID means Microsoft has the technical capability to link any Paint- or Photos-generated AI image back to the server session that processed the moderation request — and therefore, potentially, to the account or device that created it. Whether Microsoft retains that association or uses it for anything beyond content moderation is not addressed in their documentation.

Privacy advocates are likely to flag this as the kind of "local AI" implementation detail that undermines user trust: the computation may happen on your device, but the data does not stay there. Microsoft has not yet publicly commented on Li's research findings.