Researcher finds Paint and Photos embed server GUIDs

Security researcher Xusheng Li has reverse‑engineered Windows Paint and Photos and found the apps contact a remote moderation endpoint that returns a server‑issued GUID which is invisibly embedded into locally generated AI images and recorded in a C2PA manifest.

Li published detailed findings on Aug. 25–26, 2026, showing that when a user generates an AI image in Paint or Photos the apps send a prompt to a Microsoft endpoint. The endpoint replies with a persistent identifier Li calls an "InvisMark"; that identifier is written into the image itself and included in the image's C2PA provenance manifest, according to Li's write‑up and reporting by The Register and Briefia.

The technical trace Li mapped is straightforward: the client transmits prompt data to a moderation/moderation‑related API, receives a GUID in the response and then writes that GUID to the exported file as an invisible watermark. The C2PA manifest — a standard for content provenance — also records the same server‑issued identifier, providing a machine‑readable link between the generated file and the server response.

Those mechanics have immediate regulatory resonance in Europe. Article 50 of the EU AI Act establishes transparency obligations for certain AI‑generated content, and the presence of a server‑issued identifier tied to a moderation call raises questions about whether and how providers disclose provenance and whether identifiers create linkability back to users or sessions under GDPR. Privacy lawyers and compliance teams will be watching to see whether the InvisMark can be used to reconstruct who triggered generation or to correlate images with account activity.

Li's reverse engineering does not show that the GUID contains direct personal data, nor does it disclose how Microsoft generates, stores or links the GUIDs to user accounts or sessions. The Register and Briefia covered Li's post and underscored the potential for the identifier to act as a persistent tag; Li's blog post includes packet traces and code‑level analysis supporting his conclusions but stops short of demonstrating a user‑identifying payload inside the GUID itself.

Microsoft has not published technical documentation explaining the purpose, lifespan or linkability of the GUIDs in the C2PA manifests referenced by Li. That gap matters for organisations and HR teams adopting image generation in the workplace: vendors are expected to explain what data their systems emit and retain, how provenance markers are created, and whether users can opt out or remove embedded identifiers.

What wasn't disclosed is whether the InvisMark is tied to an authenticated Microsoft account, whether server logs retain mappings between GUIDs and user identifiers, and whether enterprise customers can disable the watermarking or access controls around the manifests. There is also no public independent audit demonstrating whether the GUIDs are treated as personal data under GDPR or how they are used for moderation or safety purposes.

For HR and employment‑law professionals, the finding underscores a wider shift: consumer and productivity tools increasingly bake provenance and moderation hooks into generated content, which can create unforeseen privacy and compliance obligations when used with employee data or for workplace purposes. As regulators in the EU and elsewhere push for clearer provenance and accountability in generative systems, employers will need to ask vendors specific questions about embedded identifiers, retention policies and the legal basis for any linkability between generated content and identifiable individuals.