Microsoft secretly stamps images you generated locally on Copilot+ Windows PC

Microsoft Paint and Photos are secretly stamping AI-generated images with a hidden ID tied to the user's Microsoft account, a researcher has found – and even pictures made locally on a person's PC could be traced back to them.

Xusheng Li, a software developer at reverse-engineering security firm Vector 35, discovered that before Paint generates an image, the user’s prompt is sent to Microsoft for a safety check intended to weed out prohibited content.

Microsoft then sends back a unique watermark ID, which Paint quietly embeds into the image’s pixels.

This process happens even when the image is generated locally on a Copilot+ Windows PC.

The identifier is a GUID, or Globally Unique Identifier – which acts as a unique stamp for that particular AI generation.

While it doesn't contain a user's name, Microsoft can keep records connecting it with an account, device, IP address, or prompt, meaning that an apparently anonymous image shared online could potentially be traced back to its creator.

If Microsoft associates each prompt with the user who sent it, then the company could in theory identify users by referring to the watermark in an image,

Vector 35 research engineer Xusheng Li writes in his research paper.

While Li hasn’t demonstrated that Microsoft is using the identifiers to track users, users can’t see the stamps, don’t control their creation and may have no idea that they are there.

Invisible watermark stays after user turns off visible one

Paint already offers a visible AI watermark that places a Copilot logo on generated images which users can turn off.

Li said that it was while he was exploring this visible watermark that he stumbled upon the invisible stamp in the suspiciously large file it was housed in.

“This is part of my intuition as a reverse engineer, because the file is 1.67 MB in size, which is unusually large for such trivial functionality,” he said.

And this is when Li came across the 16-byte watermark GUID “payload”.

Microsoft is clear that Paint attaches a technical standard developed by the Coalition for Content Provenance and Authenticity (C2PA) to establish an image’s origins for copyright and verification purposes.

However, according to Li, he could find no disclosure explaining the “server issued watermark GUID, its association with prompt moderation, or its presence in the pixels.” adding that those details have “obvious privacy and right to know implications.”

Windows GDID connection

Microsoft identifiers have alarmed privacy advocates before.

Police tracking Scattered Spider hacker Peter Stokes relied on a persistent Windows Global Device Identifier (GDID), using it to correlate his activity even as he switched IP addresses, VPNs, and remote connections.

Though the tracking helped fight crime, this level of surveillance triggered a massive backlash among Windows users on social media.

Paint’s GUID isn’t the same as Windows GDID, as Li’s research suggests it identifies an individual’s AI generation rather than permanently identifying a particular device.

But the privacy principle is similar. A random invisible number means very little until someone has the records explaining what – or whom – it belongs to.

Li also discovered that Paint apparently refuses to return an AI-generated image if its invisible watermark can’t be successfully added. While Microsoft Photos contains similar watermarking technology, it appears to be able to continue if it fails.

Microsoft isn’t alone in watermarking AI content. Meta is developing Content Seal while Open AI uses technologies including C2PA and Google DeepMind’s SynthID.

Anthropic has started adding machine-readable watermarks to Claude-generated content.