Microsoft's AI watermarks can be traced back to users

AI images created with Microsoft Paint and the Photos app carry invisible watermarks that could in principle be tied to individual users. That is the finding of an analysis published on August 25, 2026 by security researcher Xusheng Li of reverse-engineering firm Vector 35. The core discovery: even locally generated images receive an identifier issued by Microsoft's servers.

Technically it works like this: before generating an image, the app sends the prompt to Microsoft servers for moderation. "Your prompt is sent to Microsoft for moderation, and the returned GUID is encoded into the pixels," Li writes in his analysis. The 16-byte globally unique identifier ends up invisibly in the image — on top of the C2PA provenance data in the metadata.

The chaining is what makes it sensitive: according to the analysis, follow-up requests also transmit earlier prompt IDs, allowing series of images to be linked together. If Microsoft stores the mapping of prompt IDs to accounts, an anonymously shared image could later be traced to a user — a tracking capability The Register compares to the once-controversial invisible printer dots.

Provenance labeling of AI images is generally considered desirable and is encouraged by the EU AI Act's transparency rules; C2PA metadata, however, can be stripped, while the pixel watermark survives screenshots. Exactly that robustness turns it into a privacy issue: the marking happens without any visible notice to users. Microsoft initially did not respond to the researcher's inquiries.

For businesses, the takeaway is: anyone generating AI images with Windows' built-in tools should assume every image carries a server-issued, potentially traceable identifier — a point that belongs in internal AI policies.