Industry

Microsoft's AI images carry a hidden ID. Here is what it can and cannot reveal

A researcher found a server-issued ID hidden in the pixels of AI images made in Windows Paint and Photos. What it means, without the panic.

Multi Chats Team
September 16, 2026 · 6 min read

Windows Paint can generate an AI image. Nothing about the file it produces looks unusual, at any zoom level.

A reverse engineer pulled one apart in August. Hidden across the pixels were sixteen bytes issued by a Microsoft server, tied to the one prompt that produced the picture.

What Xusheng Li found inside a Paint file

Li is a software developer at Vector 35, the company behind the Binary Ninja reverse engineering tool. He published his analysis on 21 August 2026. The Register wrote it up four days later.

Here is the sequence he traced.

Before Paint draws anything, it sends your prompt to a Microsoft moderation endpoint. The server replies with several fields. One of them is a watermarkId, a GUID. Paint encodes that GUID into the image itself, using a Microsoft algorithm that the file's own metadata names com.microsoft.invismark.1.

The change is real but invisible. In one 512 by 512 test image, Li counted 193,376 of 262,144 pixels altered by the watermarking step.

The same GUID also lands in the file's C2PA provenance record, as what that standard calls a soft binding.

Photos does the same thing through the same component. One difference stands out. If watermarking fails, Paint refuses to hand you the image at all. Photos logs the error and gives you the picture anyway.

Paint links your generations to each other

This is the part that goes further than marking a file.

Li found that Paint sends the previous generation's ID back to Microsoft with the next request, in a field called lastPromptGenerationId. That lets successive requests be tied together on Microsoft's side. It reaches past a single image to a whole run of them.

Something else is worth knowing here. Paint has two paths, one that generates in Microsoft's cloud and one that runs a model on your own PC. Li's point is that local does not mean offline. Your prompt still travels to Microsoft before anything is drawn, and the finished file goes back to be signed.

How far a lookup key actually reaches

Pull the GUID out of an image and you have a random-looking string. Something like 83424621-03cb-40e3-9808-a9fae837156d, which is the real value from Li's test run.

It contains no name and no email address.

It is a lookup key. It means something only to whoever holds the table it points into, and that party is Microsoft. Microsoft's Image Creator support page says the company collects device and user identifiers along with user prompts, to facilitate abuse prevention and monitoring.

So the privacy consequence is conditional, and it deserves to be stated that way. If those prompt records are kept and linked to accounts, an image you posted anonymously could in principle be walked back to the account that made it. Li does not claim Microsoft does this. Microsoft did not respond to The Register's request for comment, and had said nothing publicly as of writing.

A stranger who downloads your image learns nothing from the ID. They get a number with no key to it.

Why does an invisible ID exist at all?

The obvious place to look is European law, and Li is careful about how far that goes.

The EU AI Act's transparency rules started applying on 2 August 2026. One of them says AI-generated or altered content must carry machine-readable marks so it can be detected.

Sitting alongside that is the Code of Practice on Transparency of AI-generated Content. About 190 organisations had signed by 31 July 2026. The provider signatories include Microsoft, Google, OpenAI, Anthropic, Meta, Mistral, Cohere, Black Forest Labs, Aleph Alpha and Synthesia. Its two task forces launch in September 2026.

Li makes a precise observation about the fit. The rules ask for a detectable, machine-readable mark. They do not ask for an identifier unique to a single prompt.

That same support page does tell you about the C2PA layer. Images from Image Creator, or any other AI feature in Paint, "will contain C2PA manifest helping users identify that it is an AI generated image". It says nothing about the server-issued GUID, nothing about its link to prompt moderation, and nothing about its presence in the pixels. That gap is the actual story here.

Two hidden marks can answer two different questions

Provenance marking is a category, and the systems inside it are not interchangeable.

Content Credentials, the C2PA standard, is metadata attached to a file that describes how the file was made. The coalition behind it lists Microsoft, Adobe, OpenAI, Google, Meta, Amazon, Sony and the BBC.

Google's SynthID works differently. Google's documentation says every image its Gemini image models generate includes a SynthID watermark, and describes SynthID as imperceptible to people. What Google says it encodes is that the content came from a model. Google's documentation does not describe it carrying the prompt or the user.

Keep that distinction. One kind of mark answers "did a machine make this file". Another answers "which request made this file". Both are invisible to you. They disclose very different things.

Our own image generation, checked before writing this

We run image generation through eight models from OpenAI, Google and xAI, so the question lands on us too. We went and read our own code rather than assuming.

We do not write an identifier of our own into the image. Nothing MultiChats adds reaches your pixels.

We do not remove anything either. The image bytes come back from the provider and go into storage exactly as received, with no re-encoding and no metadata stripping.

So what the provider marked is what you get, and the three providers document that very differently. Google says its Gemini image models all include a SynthID watermark. OpenAI's help centre says supported images from ChatGPT, Codex and its API carry both C2PA metadata and a SynthID watermark. It adds that its own verification tool "does not identify who created the content". xAI says nothing at all. Its image generation documentation covers pricing, editing and video. Watermarking and provenance never come up, and we are not going to guess on its behalf.

What to take from this

Assume an AI image carries something. That is where the law is pushing, and most of the large providers have signed up to it.

The useful question to ask of any image tool is narrower than "is there a watermark". Ask what it embeds, whether that thing is tied to your individual request, and how long the records behind it are kept. Where a company documents this properly, the answer is already public.

For Paint and Photos, part of the answer had to be reverse engineered. Li got there because a Windows system file struck him as too large for what it claimed to do.

Sources