What happened
Tom’s Hardware reports that developer Xusheng Li discovered previously undocumented watermarking behavior in Microsoft Paint and Photos when their AI image-generation features are used. The report says the apps apply both visible Copilot branding in some cases and an invisible watermark intended to identify or verify that AI participated in creating an image.
Tom’s Hardware reports that developer Xusheng Li investigated the AI features in Microsoft Paint on Windows 11 after finding that the app could call a remote image-generation API. The report says Li also found four apparent model files in the application path for local processing: one file resembling an ONNX model and three encrypted ONNX-like files. The article presents this discovery as the starting point for examining how Microsoft’s AI image features mark generated content.
According to Tom’s Hardware, Li found a file named watermarker.dll while probing the application. The report says Li initially believed the file handled only visible watermarking, including a Copilot logo placed in the lower-right corner of an image. The article says further analysis, assisted by an AI tool, identified a separate function called WmkWriteWatermark for invisible watermarking, in addition to the visible-watermark function AddPerceptibleWatermark.
Tom’s Hardware reports that the invisible watermarking process mixes a server-issued globally unique identifier, or GUID, into image pixels. The report also says Paint attaches C2PA Content Credentials to saved files, with code associated with ProvenanceHelper.dll and provenancesdk.dll. The source does not establish what the GUID specifically identifies, whether it maps to a prompt, account, session or other event, or whether Microsoft retains a corresponding record.
The article reports different failure behavior in Paint and Photos. In Paint, Tom’s Hardware says the watermark is mandatory for Stable Diffusion image-generation output and that image generation fails if WmkWriteWatermark cannot be written. In Photos, the report says the app still returns the image but logs an error when the watermarking process has a problem. Tom’s Hardware also reports that prompts from local image-generation workflows are sent to Microsoft servers for moderation. The article speculates that the processing may relate to Article 50 of the EU AI Act, whose transparency rules the report says took effect on August 2, 2026, while noting that the rules do not specifically call for a prompt-specific GUID. Microsoft’s response, if any, is not included in the supplied report.
Read the primary source: tomshardware.com ↗
Why it matters
The reported behavior could give users, platforms and investigators another way to identify AI-assisted images, but it also raises unanswered questions about what information is embedded, how it is linked to a user or request, and how long related data may be retained. The source does not independently confirm Microsoft’s implementation or explain its privacy safeguards.
If the report is accurate, Microsoft’s consumer-facing image tools are treating provenance as part of the generation pipeline rather than as an optional post-processing feature. That matters because an image can look ordinary to a viewer while carrying machine-readable information indicating that AI participated in its creation. C2PA credentials and pixel-level watermarking serve different technical roles, but the source does not provide enough detail to assess how they interact or how reliable either mechanism is in practice.
The reported distinction between visible and invisible marks is important for public understanding. A visible Copilot logo can signal AI involvement to a person looking at the image, while an invisible mark may be useful to software that processes large numbers of files. Tom’s Hardware does not report tests showing whether the hidden mark survives resizing, cropping, recompression, screenshots, format conversion or deliberate removal. Without those tests, the practical detection value remains uncertain.
The reported use of a server-issued GUID also creates a privacy question that the article does not resolve. A GUID could be designed only to support provenance verification, but its implications depend on what Microsoft associates with it and who can query or interpret that association. The source does not say whether the identifier is unique to a prompt, image, account, device, moderation request or generation event. It also does not report retention periods, access rules, user disclosures, or whether the identifier can be disconnected from personal information.
The story is therefore consequential mainly as a report about product behavior and accountability, not as proof that Microsoft has created a comprehensive tracking system. Tom’s Hardware attributes the technical findings to Li’s reverse engineering, and the supplied source contains no independent replication, Microsoft documentation, or Microsoft statement confirming the implementation. The report also does not establish that the mechanism is legally required, that it applies to every AI feature in Paint and Photos, or that it provides a dependable answer about an image’s origin.
What to watch next
The key next steps are Microsoft’s response, technical documentation, and clarification of which Paint and Photos versions are affected. Further scrutiny should establish whether the reported watermark survives common edits, what the server-issued GUID represents, how C2PA credentials are handled, and whether users receive meaningful notice or control.
Microsoft’s public response would help establish whether the reported functions are intentional, what versions of Paint and Photos contain them, and whether the behavior varies by region, account type or generation model. Documentation should clarify the relationship among the visible watermark, pixel-level GUID embedding and C2PA credentials. It should also explain what information the GUID encodes and whether Microsoft maintains a lookup service or associated logs.
Independent technical testing is needed to determine the watermark’s real-world durability. Researchers should examine images produced through local and remote workflows and test ordinary editing operations, including cropping, resizing, compression and file-format changes. They should also compare Paint’s abort-on-failure behavior with Photos’ error-logging behavior to see whether both applications use the same implementation and whether failures are visible to users.
Privacy and user-control questions deserve particular attention. Users need clear notice when a supposedly local workflow sends a prompt to Microsoft servers for moderation, as reported by Tom’s Hardware. They also need to know whether saved files can be stripped of credentials, whether removing them affects functionality, and whether organizations can manage or audit the process. None of those controls or policies is described in the supplied source.
The legal and standards context remains unsettled. Tom’s Hardware links the behavior tentatively to Article 50 of the EU AI Act but explicitly notes that a prompt-specific GUID is not what the article says the rule requires. Future reporting should distinguish between legal compliance, voluntary provenance engineering and product-specific design choices. Until Microsoft or independent researchers provide more evidence, the scope, durability, identifiability and effectiveness of the reported watermarking should be treated as meaningful unknowns.
