Through reverse-engineering the WIC calls in MS Paint and Photos, Xusheng demonstrates that a stable per-machine GUID is written into image metadata unconditionally on every save. He emphasizes that this happens with no user-facing toggle and applies to purely local, non-AI images, meaning any two saved files can be trivially correlated back to the same install.
By submitting the piece under the headline emphasizing that Paint and Photos 'invisibly watermark even locally generated output with GUID,' the submitter frames the behavior as a covert tracking mechanism rather than a legitimate provenance feature. The 663-point score within hours signals broad community agreement that this crosses a line.
The editorial acknowledges that C2PA credentials, Bing Image Creator watermarks, and Copilot provenance metadata serve legitimate regulatory, journalistic, and trust-and-safety needs. The objection is not to watermarking itself but to applying it indiscriminately to images that had nothing to do with generative AI, which turns a provenance tool into a surveillance identifier.
The editorial highlights that there is no KB article, no release note, and no official statement acknowledging the GUID insertion in the versions where the code path is demonstrated. Combined with the absence of any user setting to disable it, this pattern suggests Microsoft either did not want users to know or did not consider the behavior worth documenting — either of which undermines trust.
Security researcher Xusheng published a reverse-engineering write-up showing that Microsoft's built-in MS Paint and Photos apps embed an invisible identifier — a GUID — into images they save. The watermark is applied unconditionally, not just to AI-generated content, and there is no user-facing setting to disable it. The post walks through the disassembly, the calls into the Windows Imaging Component (WIC), and shows exactly where in the file's metadata the identifier gets written.
The mechanism is not steganography in the traditional sense — pixels aren't being modulated. Instead, the GUID is stashed in a metadata block that most image viewers ignore but that anyone with a WIC-aware parser (or a hex editor and five minutes) can extract. The identifier appears stable across saves from the same install, which means multiple images written by the same machine can be correlated back to that machine with a single string comparison.
The Hacker News thread hit 663 points within hours, which is roughly the threshold at which "someone at Microsoft's PR team is having a bad day." As of publication there is no official statement, no KB article acknowledging the behavior, and no mention in the Paint or Photos release notes for the versions where the write-up demonstrates the code path.
Microsoft has, for the last two years, been under sustained pressure to prove that generative-AI output can be traced. C2PA content credentials, invisible watermarks in Bing Image Creator, provenance metadata in Copilot — the whole industry has been converging on "we can tell if a machine made this." That is a defensible goal. Regulators want it, journalists want it, and the trust-and-safety crowd has been begging for it since 2023.
What this write-up documents is different: the watermark is being applied to images that had nothing to do with AI generation. If you open a photo of your dog, crop it in Paint, and hit save, the file now carries an identifier tied to your install. If you screenshot a Slack message, paste it into Paint to blur a name, and save the PNG, that PNG now carries an identifier. The line between "provenance for synthetic media" and "per-machine tracking of every image you touch" has been erased, and it was erased without a changelog entry.
The comparison to Xerox's yellow tracking dots keeps coming up in the thread, and it's the right comparison. In 2004 the EFF confirmed that color laser printers were embedding invisible yellow dot patterns encoding the printer's serial number and a timestamp on every page. That practice was undocumented, deployed at the request of law enforcement, and took years to reverse-engineer. Twenty years later, the same pattern — invisible identifiers embedded silently by trusted software — is back, this time in the default image editor shipped with every copy of Windows.
The practical threat model matters here. For most users, this is a privacy nuisance: the GUID doesn't obviously encode their name, and Microsoft hasn't (yet) said what they'd do with it. But GUIDs don't need to be personally identifying to be personally identifying. If you upload three images from the same Paint install to three different accounts on three different services, and any downstream party (subpoena, breach, ad partner, government request) can join those metadata blobs, you have been deanonymized by an install ID you never knew existed. Whistleblowers, journalists sharing screenshots of leaked documents, people posting redacted images to public forums — this is the exact population for whom "my default image editor writes an ID card into every file" is a real problem.
There's also the C2PA angle. Microsoft is one of the founding members of the Coalition for Content Provenance and Authenticity, whose entire pitch is that provenance metadata should be cryptographically signed, user-visible, and verifiable. This behavior is none of those things. It's an opaque identifier written silently to a metadata field, with no signature, no key, no verifier, and no disclosure. That is the opposite of what C2PA was designed to be — and it undermines Microsoft's position that it can be trusted to steward the standard.
If you or your users edit images in Paint or Photos and then ship them anywhere — customer support tickets, GitHub issues, internal wikis, marketing pages — you are now leaking a per-install identifier. A few practical implications:
First, strip metadata on any image that touches your public surface. `exiftool -all= file.png` is the blunt instrument; ImageMagick's `-strip` flag works for pipeline use; `oxipng --strip all` handles PNGs specifically. If you have a CMS or a customer-facing image upload, adding a metadata scrub at the ingest layer is now table stakes rather than paranoia. The good news is that the GUID lives in a standard metadata chunk, which means the same tools you'd use to strip EXIF from photos will also nuke this.
Second, audit your screenshot workflow. Windows' built-in Snipping Tool goes through the same WIC pipeline. If your incident-response process involves pasting screenshots into Paint to redact PII before sharing them externally, you are currently annotating your redactions with a machine ID. Move that workflow to something that writes files directly — GIMP, IrfanView, or even a scripted `magick convert` — until Microsoft ships a toggle.
Third, for teams building anything provenance-related, this is a case study in why "invisible" and "trustworthy" don't coexist. If your product embeds identifiers into user content, document them, sign them, and give users a switch. Otherwise you are one Hacker News post away from being the villain in someone's threat model.
The likely near-term outcome is a KB article, a mea culpa framed as "this was intended as content-provenance telemetry," and a Group Policy toggle in the next Windows update — the same arc as basically every telemetry-in-Windows story since 2015. The longer-term question is whether regulators, particularly under the EU AI Act's provenance provisions, treat undisclosed per-install identifiers in default OS tooling as a compliance issue. If they do, this stops being a Paint bug and starts being a template for how not to implement provenance at platform scale. Until then: assume every image that leaves a Windows machine carries a passport, and strip accordingly.
AI-generated text warning (I submitted - but did not author - the piece), but it seems MS Paint and MS Photos add both a visible (can be turned off) and invisible (cannot be disabled and happens silently in the background with no user notice) watermarks to photos that have been AI-manipulated, even
The AI aspect of this is a red herring. The real problem is that they're secretly adding in a unique identifier into every image you create. If somebody does not like your meme, they can just send a copyright subpoena to Microsoft to instantly get your full name, address, email, phone number, a
My goodness, this has nothing to do with AI problems.I don't understand that people still buy an OS from a company that actively hates it's customers.The amount of things they pull should not even be succesful on a OS you get paid FOR to use.
Keep an eye on this.A few months back, MS incorrectly tried to stamp a Copilot "watermark" (just an auto-added note) to any and all Azure DevOps commits, regardless of whether an LLM was actually involved. They removed it after a lot of github issues were submitted to the source of the iss
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
Injecting hidden GUIDs into local files without explicit user consent is a massive privacy overreach. It makes you wonder what other local tools are silently tagging user generated content.