Xusheng Li reverse-engineered Microsoft Paint and Photos and found something that should concern everyone who generates AI images on Windows.
Even when you run image generation locally on a Copilot+ PC, your prompt is sent to a remote Microsoft moderation server. The server returns a GUID. That GUID gets embedded into your locally-generated image as an invisible pixel watermark — on top of C2PA metadata already added to the file.
The watermark is separate from the visible watermark toggle in settings. You cannot disable it. There is no opt-out.
How it works
Li traced the network call:
- Paint sends your prompt + style selection to
apsaiservices-a0fqcjc6bzbhgdcd.b02.azurefd.net/v1/paint-cocreator/moderate-prompt - A 16-byte GUID comes back — tied to your moderation session
- That GUID is written into the image pixels via a watermarking algorithm in
Watermarker.dll - Image saves are restricted to C2PA-preserving formats: PNG, JPEG, GIF, and .paint
The local models themselves are real — 302 MB of ONNX weights for "mager" (the image generator), plus segmentation and inpainting models. They're just encrypted with keys that changed between versions. But the pipeline routes every prompt through a cloud moderation layer regardless of where inference runs.
The response arrived in hours
Within hours of Li's write-up, ShadowAqueduct released an updated watermark-remover at 767 GitHub stars that handles this exact scheme. It strips C2PA, clears pixel-level watermarks, and scrubs invisible Unicode marks from text — all via a curl-able service or as an agent skill for Claude, Codex, and Grok.
This is the pattern now. Every time a vendor ships a new tracking mechanism, a repo appears that defeats it before the PR team finishes the launch post.
What this signals
"Local AI" is marketing. The models may run on your NPU, but the pipeline is controlled by someone else's server — every prompt moderated, every output stamped with a traceable ID. Microsoft says the GUID is for moderation audit trails. But the architecture makes no distinction between accountability and surveillance.
The deeper question: if Microsoft embeds tracking watermarks into locally-generated images, what else is being logged? The prompt is already on their server. The GUID ties back to your session. How long until the image itself is too?