Microsoft Paint is quietly tagging local AI images with server tracking IDs

Microsoft Paint is hiding invisible tracking IDs inside your AI-generated images—even when you make them on your own PC.

Reverse engineer Xusheng discovered that Paint and Photos embed a server-issued ID directly into image pixels. Even on Copilot+ PCs that run image generation locally, the apps still send your text prompt to Microsoft servers for moderation. The server returns a 16-byte unique identifier, which Paint silently bakes into the pixel data. If this watermarking step fails, Paint aborts the process entirely rather than returning a clean file.

Why it matters: Turning off the visible Copilot watermark in Paint settings does not disable this invisible pixel marker. Because every generated image gets a server-issued ID stamped into its pixel grid, local AI creations can be linked back to remote moderation logs.

Know this: Paint limits AI image saves to metadata-preserving formats like PNG, JPEG, GIF, and .paint, ensuring the underlying mark stays intact.

Turns out the humble MS Paint hasn't just gained AI powers—it's learned how to silently tag its work, too.