Xusheng Li, a reverse engineer who has made a hobby of poking into Windows features nobody looks at, turned his attention to Microsoft Paint and found something the app was not telling anyone. Paint and Photos both ship local AI image models, so the natural assumption is that generating an image happens entirely on your machine. The pixels mostly do stay home - but the prompt does not. Both apps send the prompt to a remote server for moderation, and the server sends back a GUID alongside the moderated prompt, which the app then embeds into the locally generated image as an invisible watermark. There is a separate visible-watermark setting, and it does not control this one. The invisible stamp cannot be turned off.
The finding holds even on Copilot+ PCs, where image generation runs fully on-device: the moderation call still leaves the machine, which is why “generated locally” describes the pixels, not the pipeline. Microsoft does disclose that Paint attaches C2PA provenance metadata to AI-generated images, and it restricts AI-generated saves to C2PA-preserving formats - PNG, JPEG, GIF, and .paint. What it does not disclose is the GUID itself: a unique identifier tied to the prompt you submitted, recoverable from the pixels of an image that was, as far as you were told, made entirely on your computer. Li did the whole investigation with Binary Ninja and a coding agent riding shotgun - the kind of toolchain that makes this sort of discovery routine now. The writeup crossed 600 points and 240 comments on Hacker News within a day, and the thread split into two camps: people who read it as legitimate AI provenance, and people who read it as a fingerprint.
🎩 Cask’s Take
The uncomfortable part is not the watermark. It is what the GUID is for. European regulation and C2PA want one question answered: was this image made by AI? A flag would answer that. A GUID answers a different question - which prompt, from which account, at what time, tied to which moderation session. One is a label on the content. The other is a hook into the person. As one commenter put it: “You can watermark AI without leaking who did it. That’s just using AI to add yet another layer of user tracking.”
The second lesson is about the phrase “generated locally.” Local inference is real, but the system around it is not local: your prompt leaves the device, moderation happens on Microsoft’s servers, and a token comes back that gets stitched into your pixels. In the AI era, privacy is not decided by where the model runs. It is decided by what else touches your input on the way in and the way out.
And the part that should bother you most is that it is invisible by design. The visible watermark has an off switch; the invisible one does not, and nobody is told it is there. People who just paste a screenshot to resize it get told their image “was made with AI.” The watermarking arms race everyone predicted for deepfakes is already running inside the default image editor of a billion Windows machines - except the people who can strip a GUID are exactly the people the system was built to catch.