A security researcher quietly published a finding that should concern any freelancer, designer, or small team running Windows: MS Paint and the Windows Photos app are embedding invisible GUID watermarks inside images you create or edit locally — no cloud sync, no Microsoft account, nothing uploaded anywhere. The watermark is baked into the image file itself. The sharp pitfall hiding beneath the headline is this: stripping EXIF metadata doesn't remove it, because this isn't metadata — it's embedded in the pixel structure of the image, meaning the usual privacy hygiene most teams rely on does exactly nothing here.
This isn't a theoretical vulnerability or a privacy-policy footnote. It's a behavioral fact discovered through reverse engineering, and it hits a specific nerve for anyone producing visual content on Windows — stock photographers, social media managers, AI art editors, journalists, agencies doing client work — because it means every locally edited image carries a fingerprint that can potentially be traced back to a specific machine or Windows installation.
What Is This Actually?
The researcher behind xusheng.dev reverse-engineered both the modern MS Paint (the redesigned Store version Microsoft ships with Windows 11) and the Windows Photos application and found that both apps embed a GUID — a Globally Unique Identifier — into image output as an invisible watermark. The key word in that sentence is invisible, and it's doing a lot of work.
Most people familiar with image privacy think first about EXIF metadata: the structured data block attached to JPEG and PNG files that stores camera model, GPS coordinates, timestamps, and so on. Stripping EXIF has been standard practice for privacy-conscious creators for years. Tools like ExifTool make it trivial. The problem here is that this watermark isn't in the EXIF block. It appears to be embedded at the image data level — steganographically, in the signal of the image itself — which means metadata strippers leave it entirely intact.
A GUID (Globally Unique Identifier) is a 128-bit identifier generated by an algorithm designed to be unique across all machines and all time. Your Windows installation has one. Your Microsoft account has one. Apps themselves can generate GUIDs tied to installation instances. The critical unanswered question — and one the HN thread wrestles with extensively — is what this particular GUID identifies. Is it tied to your hardware? Your Windows installation ID? Your Microsoft account? Or is it an app-level identifier that rotates or changes?
That ambiguity matters enormously for the severity assessment. If the GUID is tied to your Windows machine GUID (a value that persists through reboots, is constant across reinstalls unless you specifically regenerate it, and is visible to Microsoft), then any image you edit in Paint is permanently linked to your specific PC. Cross-reference two images from different sources that share the same GUID, and you know they came from the same machine. If it's a more ephemeral identifier, the tracking surface is smaller — but it still exists, and it still happens without disclosure.
The closest historical precedent is the printer tracking dots scandal. Since at least the early 2000s, major color laser printer manufacturers have embedded nearly invisible yellow dot patterns into every page printed, encoding the printer's serial number and the timestamp. Intelligence agencies used this to identify document sources; it's how the NSA identified Reality Winner in 2017. The underlying principle is identical: a physical output device bakes a unique identifier into every artifact it produces, without telling the user. What Microsoft appears to have done is bring that same logic into software image editors.
The affected applications are the modern Microsoft Paint (distinct from the legacy mspaint.exe, though both ship with Windows 11) and Windows Photos. Both are Store applications, updated silently via the Microsoft Store, meaning the behavior could have been introduced at any point in the update history without a changelog entry most users would read. The researcher does not specify exactly when the watermarking was introduced, which means there's no clean "safe before this date" line to draw.
Why This Matters Right Now
Twelve months ago, the conversation around AI-generated image provenance was mostly theoretical. Today, it's institutional. The Coalition for Content Provenance and Authenticity (C2PA) standard — backed by Adobe, Microsoft, Google, Sony, and others — is being actively deployed to attach cryptographic provenance metadata to AI-generated images. Microsoft has been vocal about wanting to watermark AI content.
That policy context makes this finding land very differently than it would have in isolation. When a company is publicly championing content provenance and simultaneously embedding invisible identifiers in the output of its bundled image editors, the two things start to look connected — whether or not they actually are.
The timing is also significant because Windows is the operating system of choice for the vast majority of small creative agencies, freelancers, and independent designers. MacOS users running GIMP or Affinity aren't affected. Linux users aren't affected. But if you're a solo designer on a Windows laptop doing client work in Paint to knock out a quick asset, or if you're an AI artist who runs ComfyUI locally and then opens the output in Windows Photos to crop or color-correct, you're potentially stamping every finished file with a machine-linked identifier.
Another dimension: the AI art workflow intersection. A large population of technically intermediate users — people who run local Stable Diffusion or Flux models — are generating images on their own hardware specifically to avoid cloud-based tracking. If they then open those images in Windows Photos to make minor edits, they may inadvertently add an identifier they spent hardware money to avoid creating in the first place. That's a specific betrayal of a specific user expectation.
Privacy regulations are tightening globally. GDPR has teeth. The idea that a default, bundled application might be embedding unique identifiers traceable to a specific person's machine into files they create and share raises genuine questions about whether this constitutes processing of personal data under Article 4 of GDPR — and whether the absence of disclosure violates Article 13.
Practical Implications for Small Teams
The stock photography and asset creator. Freelancers who shoot photos or create digital assets for stock platforms often process images through whatever is fastest on their machine. For Windows users, that frequently means Paint or Photos for quick crops, resizes, or minor edits. If those images carry a GUID tied to their machine, they're essentially signing every asset with an invisible signature. For some purposes that's fine. For others — particularly if the same creator submits to multiple competing platforms under different profiles, or if there's any reason to keep asset sources confidential — it introduces a traceability they didn't consent to.
The agency doing client work. Creative agencies regularly handle assets from multiple clients on the same workstations. If images processed through Paint on an agency machine carry the machine's GUID, those images are linked at the fingerprint level across clients. That's not a catastrophic risk in most cases, but it's a data point that could theoretically be used to establish that two clients' assets were processed by the same third party — something that might matter in competitive contexts or under NDAs.
The AI art workflow. This is arguably the highest-concentration risk area. People running local image generation specifically for privacy reasons — avoiding Midjourney's cloud, running ComfyUI or Automatic1111 locally — then routinely open outputs in Windows Photos to review them. If Photos is watermarking on open/save operations, not just on explicit export, then reviewing an image in Photos and saving it overwrites the clean local-generation origin with a Windows machine fingerprint. Worth understanding exactly when the watermarking triggers: on open, on save, on export, or only when using specific editing functions.
The journalist, researcher, or whistleblower. This is the most severe use case. Documentarians, journalists, and researchers who work with sensitive visual evidence need to know that the tools they use for even minor image processing may embed identifiers. The printer dots parallel is direct here: that technology has been used in real investigations to identify sources. Software watermarking that survives metadata stripping and is embedded invisibly in pixel data carries the same forensic utility.
The small marketing team. Marketing managers and social media coordinators who use Paint to resize banners, add text to photos, or quickly mock up assets for client approval — this is probably the largest population by volume. Most will look at this finding and conclude it's low-stakes for their work, which is probably correct in aggregate. The risk is real at the margins: sharing an image publicly that carries a machine identifier creates a persistent link between that file and that workstation, which could be relevant if the image later becomes evidence in a dispute, DMCA claim, or legal matter.
How to Respond and Act on This
The first step is understanding your actual exposure. The watermarking appears to trigger when images are saved through Paint or Photos. If your workflow involves only opening images in these apps for viewing — not saving through them — your exposure may be lower. But "may be" is doing heavy lifting there. Until the exact trigger conditions are fully documented by independent researchers, treating any save operation through either app as potentially watermarking is the conservative position.
For teams that need to act now, the practical path is switching image editing tools for any work where provenance privacy matters. This doesn't require buying anything — free, open-source alternatives exist and are mature:
GIMP has been the standard open-source Photoshop alternative for two decades. It handles everything from basic crops to complex compositing, has no known steganographic watermarking, and the source code is auditable. The UI is notoriously non-intuitive for newcomers, but for teams already using it, no change is needed.
Krita is better suited for illustrators and digital painters, and has grown into a genuinely capable photo editing tool. It's also fully open-source, actively developed, and widely reviewed without any identified watermarking behavior.
For teams that need something closer to a commercial experience, Affinity Photo 2 is a one-time purchase (approximately $70) rather than a subscription, runs locally, and comes from a company (Serif) with a much smaller data collection surface than Microsoft.
The metadata hygiene step — stripping EXIF before sharing — remains worth doing, but as noted, it won't address steganographic pixel-level watermarks. What would help for verification purposes is using steganalysis tools to test whether specific editing operations introduce detectable payload. Tools like StegExpose or zsteg can identify certain classes of LSB steganography, though they're not guaranteed to detect all implementations.
For Windows users who want to keep using Paint for legitimate non-sensitive work, the practical advice is to compartmentalize: use Paint for quick-and-dirty internal edits where provenance doesn't matter, and route anything client-facing, publicly shared, or sensitive through an audited alternative.
Network administrators at small agencies may want to audit which apps have Store update permissions on workstations and consider whether silent Store updates should be gated for production machines. A behavior introduced silently through a Store update, with no changelog disclosure, is a real workflow risk.
Alternatives to MS Paint and Windows Photos for Privacy-Conscious Teams
| Tool | Best for | Free plan | Starting price | Key differentiator |
|---|---|---|---|---|
| MS Paint (Windows) | Quick edits, internal mockups | Yes | Free (bundled) | Fastest access on Windows; subject of this finding |
| Windows Photos | Image viewing, basic editing | Yes | Free (bundled) | Convenient; same watermarking concern applies |
| GIMP | Professional editing, complex workflows | Yes | Free | Open-source, auditable, no known watermarking |
| Krita | Illustration, digital painting, photo editing | Yes | Free | Strong open-source community; actively developed |
| Affinity Photo 2 | Commercial-quality editing without subscription | No | ~$70 one-time | No Adobe cloud dependency; one-time cost model |
| Adobe Photoshop | Full professional suite | No | ~$23/mo | Industry standard; Adobe has its own privacy considerations |
| Canva | Marketing assets, team collaboration | Yes | ~$15/mo (Pro) | Browser-based; cloud-dependent by design |
| ExifTool (CLI) | Metadata inspection and stripping | Yes | Free | Audits and removes EXIF; does not address pixel watermarks |
One note on Canva and cloud-based tools: they solve the local-watermarking problem by moving image processing to a server you don't control, which trades one privacy concern for another. For teams already comfortable with that trade-off (and most are), they're fine. For teams specifically trying to keep images off third-party servers, cloud editors don't help.
What the HN Community Is Saying
The 266-comment thread on Hacker News at the time of this analysis breaks along predictable but genuinely informative lines.
The most upvoted skeptical position centers on the severity interpretation: several technically experienced commenters push back on characterizing this as sinister until the exact nature of the GUID is established. If it's an app-instance identifier that changes on reinstall, or a session-level value, the tracking surface is much smaller than a persistent machine ID. The counterargument — and it's a good one — is that the mechanism of invisible steganographic embedding into pixel data is the alarming part, independent of what the GUID currently identifies. The infrastructure for tracking is in place; what it tracks today could change in a future update.
Privacy-oriented commenters draw the printer tracking dots comparison extensively, and that framing resonates. The dots were benign-seeming until they weren't. Several commenters note that even if Microsoft's current intent is benign (C2PA compliance, AI content identification), the watermarking system creates a capability that can be retasked.
Practitioners in the thread — people who actually work in digital forensics or content authentication — mostly take a measured position: invisible watermarks in locally generated content are normal in professional content authentication systems (Getty, Adobe Stock, etc.), but those are opt-in commercial systems. What's different here is that it's a bundled OS tool applying watermarks without disclosure, which changes the consent calculus entirely.
Several commenters flag the AI art community impact specifically, noting that the privacy-conscious local-generation crowd is the group most directly harmed by a tool that re-watermarks images they specifically kept local to avoid cloud fingerprinting.
A thread of skeptics argues this is simply not a meaningful risk for 99% of users. That's probably numerically correct. The 1% for whom it matters, though, includes exactly the people who most need to know about it.
Risks and Things to Watch
The immediate risk to flag isn't malicious intent on Microsoft's part — it's the gap between capability and disclosure. The steganographic infrastructure exists now. Whatever the current GUID represents, a future update could associate it with something more personally identifying: a Microsoft account ID, an Entra/Azure tenant identifier, or a Windows hardware hash. Silent Store updates mean that association could change without notification.
Vendor lock-in risk is subtler here than in typical SaaS discussions. The concern isn't that you'll be "locked in" to Paint — it's that if you've been producing images with Paint for years without knowing about watermarking, you have a historical corpus of files that may carry identifiers you can't now remove without pixel-level steganalysis and re-encoding. That historical trail doesn't disappear.
The GDPR exposure question is real and unresolved. If the GUID is linkable to a natural person — which it would be if tied to a Windows account or hardware ID — then embedding it into image output constitutes processing of personal data. Microsoft's disclosures don't appear to cover this specifically. A motivated EU regulator or privacy advocate could file a complaint; the outcome would depend on whether the GUID is established to be personal data under Article 4. Small teams operating in the EU should flag this for legal review if the concern is material to their work.
What to watch: independent steganalysis. The researcher's finding needs replication and expansion. Specifically: does the watermark persist through JPEG re-saves at different quality settings? Does converting to PNG remove it? Does resizing or rotating the image preserve it? The resilience of the watermark to common image processing operations determines how much of a practical fingerprint problem it creates at scale. Watch for follow-up posts from the security research community over the next 30–60 days.
The hype-vs-reality tension: some coverage of this story will overstate it into "Microsoft is spying on you through Paint." That's not what the evidence shows, and overclaiming weakens the legitimate concern. The accurate frame is: a trusted default tool is silently adding non-consensual identifiers to locally created files, the mechanism is technically capable of persistent tracking, and the absence of disclosure is a governance failure regardless of current intent.
Frequently Asked Questions
Does this affect every image saved in Paint, or only AI-generated images?
Based on the researcher's findings, the watermarking appears to apply to images saved through Paint and Windows Photos generally — not exclusively to AI-generated content. Any image you open and save through these apps, whether it's a photo you took with your phone, a scanned document, or an AI-generated file, may receive the embedded watermark on save. The finding is not restricted to AI output, though that's the context getting the most attention due to the provenance debate.
Can I remove the watermark after it's been added?
This is the difficult part. Steganographic watermarks embedded at the pixel level are designed to be resilient. Standard metadata stripping (ExifTool, right-click > Properties in Windows, etc.) won't touch it. Re-encoding the image with heavy compression might degrade the watermark payload, but there's no reliable "remove this specific watermark" tool without knowing the exact embedding algorithm. The practical answer for most teams is: once it's there, assume it's there. Prevention is the actionable strategy, not remediation.
Does this apply to PNG files or only JPEG?
The researcher's post covers both formats, though JPEG and PNG handle image data very differently. JPEG's lossy compression could theoretically degrade LSB-based steganography; PNG is lossless and would preserve it exactly. The exact embedding technique Microsoft is using matters here, and until more researchers analyze the implementation, it's safer to assume both formats are affected.
Does switching to a Microsoft account affect anything?
If the GUID is tied to a Windows installation or hardware ID rather than a Microsoft account, signing in or out of a Microsoft account may not change the embedded identifier. If it's account-linked, account changes might produce different GUIDs. The current state of independent verification doesn't give a clean answer here, which is itself the problem.
Is the Windows Photos app's watermarking behavior identical to Paint's?
The researcher found watermarking behavior in both applications. Whether they use identical GUIDs (suggesting a shared Windows-level identifier) or distinct app-level GUIDs is important for understanding the tracking surface. Identical GUIDs across apps would be significantly more concerning because it would mean cross-app image activity could be correlated. This is a key question for follow-up research.
Would running Paint in a sandboxed environment or virtual machine change the GUID?
Potentially, yes. Virtual machines have their own hardware IDs, so a Windows installation inside a VM could have a different machine GUID than the host. However, running a full Windows VM just to use Paint for image editing is a disproportionate operational response for most teams. The cleaner solution is using a different editor entirely. The VM approach is more relevant in specific forensic or investigative contexts where maintaining separation from a primary machine ID matters.
Does this affect older versions of Paint (the legacy mspaint.exe) that shipped with older Windows builds?
The researcher focused on the modern Paint application distributed through the Microsoft Store, which is distinct from the classic mspaint.exe that shipped with Windows versions through Windows 10. Legacy mspaint.exe is unlikely to have this behavior given its age and the fact that it doesn't receive Store-based updates. However, Microsoft's Windows 11 defaults push users toward the modern Store apps. If you're specifically running classic mspaint.exe from a pre-Store distribution, the finding may not apply — but confirming this would require independent verification.
Should I be concerned about Windows Photos specifically for image viewing (not editing)?
The question of whether the watermark is embedded on open versus on save is important and not fully resolved. Our reading of the available reporting suggests the watermark is introduced during save/export operations, not simply by opening a file. However, Windows Photos' "auto-save" behaviors and its integration with OneDrive can blur the line between "viewing" and "modifying" a file. If Photos has auto-enhance features enabled, or if it automatically creates edited copies, those saved versions would be the risk surface. Disabling auto-edit features and treating any save operation as potentially watermarking is the conservative approach.
Final Verdict
For most users running Windows for ordinary work — internal documents, casual design tasks, social posts — this finding is a genuine privacy concern but not an immediate operational emergency. Microsoft has not disclosed the watermarking, the GUID's exact linkage to identifiable information is not fully established, and the practical exploitation path for most use cases is limited.
For a specific subset of Windows users, this matters a lot right now.
If you produce images for commercial distribution under attribution-sensitive conditions, work with legally sensitive visual materials, operate in a privacy-regulated industry, are part of the AI art community that runs local generation specifically to avoid cloud fingerprinting, or work in journalism or research where source protection is material — this is a workflow change you should make before the end of the week. Switch to GIMP, Krita, or Affinity Photo for anything that matters. The cost of switching is low; the cost of retroactive identification isn't.
The broader signal here is worth taking seriously even if your immediate risk is low. This is a default bundled tool — not a niche app, not something you opted into — silently modifying the files it produces in a way that creates a forensic connection between you and your output. That's a category of behavior that should require explicit disclosure and ideally explicit consent. It didn't get either.
What this finding also signals is that the era of treating "local" as synonymous with "private" is eroding in ways that go beyond cloud syncing. The machine running the software, not just the network it's connected to, is becoming part of the data trail. Small teams that care about clean operational hygiene should audit their default tool choices accordingly — not out of paranoia, but out of the reasonable expectation that when a tool edits your files, it shouldn't be adding fingerprints you didn't ask for.
The practical audit for a small team takes about 30 minutes: identify who uses Paint or Windows Photos for anything that gets shared externally, document which file categories go through those apps, and decide which of those workflows needs to move to an auditable alternative. That's the whole thing. It's not complex. The harder part is getting teams to take a finding like this seriously before it becomes a problem, rather than after.