"Local" AI image generation in Windows Paint and Photos is not local in the sense …

Top Story

“Local” AI image generation in Windows Paint and Photos is not local in the sense engineers assume. A reverse-engineering writeup by Xusheng shows that every image the two apps generate locally carries an invisible watermark: a server-issued GUID embedded into the pixels by an SVD-style encoder, delivered over the network from Microsoft’s prompt-moderation service before the on-device model ever runs. The practical consequence is that a machine that never leaves your desk still phones home to generate a single image, and the file you produce carries provenance you can’t see and can’t turn off.

The mechanism is worth being precise about, because it’s subtler than the usual “cloud AI” story. Windows ships real local models — Paint alone carries four .onnxe files (a 302 MB mager.onnxe, plus segmentation and inpainting graphs), XOR-obfuscated and decryptable with a key in segapi.dll. Generation runs on the NPU. But before generation, AIServices.dll POSTs the prompt and style to Microsoft’s moderation endpoint (apsaiservices-...b02.azurefd.net/v1/paint-cocreator/moderate-prompt) and gets back a JSON payload with a revisedPrompt, a promptGenerationId, and a watermarkId GUID. That GUID is threaded through StableDiffusionHelpers::GenerateAsync into Watermarker.dll’s WmkWriteWatermark, which quantizes selected image blocks to carry the 144-bit payload: a 0x4c marker byte, the 16 GUID bytes, and a byte-sum checksum. The embedding requires every bit to be placed at least three times, and if it fails — insufficient capacity, or a payload that isn’t exactly 16 bytes — Paint converts the whole generation into an error rather than returning an unwatermarked image. There is no option to decline.

Two details deserve emphasis because they change how engineers should think about this. First, the invisible watermark is entirely separate from Paint’s visible Copilot-logo setting. The visible logo is composited by AddPerceptibleWatermark and gated by a Never/Always/Ask-every-time option; the invisible GUID is added unconditionally by AddWatermark and ignores that setting entirely. Turning off the visible watermark does nothing to the invisible one. Second, the GUID is issued by Microsoft’s server as part of prompt moderation — the same endpoint that classifies the prompt with a containsHumanReference flag — so the watermark is not a local checksum or content hash. It’s an identifier assigned by Microsoft to a specific prompt-and-session, embedded in a way designed to survive the image.

That is the part that ought to make engineers uncomfortable. Even on a Copilot+ PC where the model and the pixels never leave the device, the image’s identity originates from a Microsoft server keyed to your prompt. The author confirmed the traffic with a live call using Paint’s own authenticated session: a cobalt-blue-circle prompt came back with watermarkId 83424621-03cb-40e3-9808-a9fae837156d, and the same prompt returned different GUIDs on repeat — these are per-generation, not per-user or per-version. A GUID in an image is enough to look up a prompt in Microsoft’s moderation logs if the server keeps them, which raises the stakes of what “local” generation means for anyone producing sensitive or proprietary imagery on Windows.

There’s also a disclosure gap worth flagging. Microsoft says it adds C2PA metadata to AI-generated images and restricts saves to C2PA-preserving formats (PNG, JPEG, GIF, .paint). But this invisible watermark is not C2PA — it’s a separate, undocumented pixel-domain embed with its own checksum and error handling, discovered by walking a DLL. The question is whether it exists in tension with the C2PA claim or is meant to complement it. That’s the concrete thing to watch: whether Microsoft documents the invisible GUID in its provenance disclosures, and whether the watermark’s per-generation GUIDs prove traceable back to a prompt. Engineers who assumed a locally generated image on their own machine was private to that machine now have a demonstrated counterexample — and should treat the local/cloud line on Windows AI features as a marketing boundary, not a trust boundary, until the provenance story is both visible and on the record. MS Paint and Photos inivisibly watermark even locally generated output with GUID

Also Today

My agent.md to improve LLM-assisted code quality · Source Fabien Sanglard’s agent.md is the rare LLM-coding post that names the actual bottleneck: not capability but taste. His rules — short function names, no magic numbers, enums over booleans, “stop telling me I am absolutely right” — are what turned an “infinitely patient junior CS major” into something close to a senior pair. But the honest part is the confession underneath: the trick does not let him skip reading code, it only moves his attention from style to architecture and design. The file is a scaffold for taste, not a substitute for it, and treating it as the latter is how spaghetti gets committed.

Amazon Hikes Hardware Prices By 60%, Blaming Memory Shortage · Source Amazon raised hardware prices by as much as 60%, jumping the Echo Dot from $49.99 to $79.99 overnight and blaming memory and storage component costs. This is RAMmageddon spilling out of data centers and into consumer gadgets: a 60% hike on a $50 speaker is pure DRAM passthrough, and it confirms the shortage has moved from a server-tier story to a household one. When a Kindle becomes the inflation poster child, the AI boom’s real cost isn’t tokens or GPUs — it’s every device with a memory chip in it. The hike is a reminder that memory pricing is now a tax every vendor pays, and their customers pay it a quarter later.

IPFS Maintainers Winding Down · Source IPFS’s core maintainers are winding down. Protocol Labs won’t renew Shipyard’s funding, so its IPFS work — Kubo, Helia, Boxo, Rainbow, IPFS Desktop, and the public gateways ipfs.io and dweb.link — ends September 30. Shipyard’s own claims make the loss sting: it cut gateway infrastructure costs 80% while tripling traffic, and had HTTP-native implementations waiting. Whatever reassurance its post tries to project, the practical read is bleak: the people who made IPFS usable are gone, and the projects they maintained now have no dedicated maintainers. A decentralized-storage ecosystem whose upkeep depended on a single funder was never really decentralized in the way that matters.

With Groq 3 LPX in Full Production, NVIDIA Extends Vera Rubin Inference for Agents · Source Nvidia’s Groq 3 LPX is now in full production, and the real news is the architecture behind it: Rubin GPUs handle long-context processing while LPX accelerators do fast token decode, with 256 LP30 accelerators linked chip-to-chip in a rack. In an Artificial Analysis run on Gemma 4 31B it claims 3,400 output tokens per second, 4x the nearest alternative. Splitting context processing from decode latency is the interesting part, because it treats agentic inference as two workloads with different economics rather than one. Whether the numbers survive third-party benchmarking matters less than the direction, which is that token generation is becoming a dedicated hardware product line.

Next.js 16.3 Released: Instant Navigation, Dev Memory Reduced by Up to 90%, Build Speed Greatly Improved · Source Next.js 16.3 attacks its oldest complaint, that Server Components feel slower than SPAs. Instant Navigations, gated behind two config flags, merges prefetch requests into one cached shell template, while Vercel says dev-memory use drops up to 90% and the build now runs TypeScript 7 natively. The engineering is real — disk caching, Node-stream SSR handling 22% more requests, a Playwright helper to catch regressions. But it also ships the familiar caveat list: static export incompatible with partial prefetching, cacheComponents breaking SSR when self-hosted on SST. It is worth upgrading for, but Instant Navigations should roll out route by route, which is exactly how a client-side caching model should join an otherwise server-driven framework.

In Brief

• A Lectronz essay argues Europe’s regulatory and compliance burden is pricing makers and micro-entrepreneurs out of existence one directive at a time. (Source)
• Xiaomi’s new CPU roughly matches Apple’s cores on single-threaded work and is considerably faster on multithreaded workloads, the company claims. (Source)
• Taiwan has indicted nine people — including, reportedly, an Nvidia senior manager and two Supermicro employees — over allegedly smuggling AI servers to China. (Source)
• New Sign in with Apple addresses will move from privaterelay.appleid.com to the private.icloud.com domain, after Apple declined to reverse the change. (Source)
• OpenAI is cutting the price of GPT-5.6 Sol across standard, batch, and flex modes through at least November 21. (Source)
• Slate reports more than 170,000 nonprofits lost all their data and asks whether Microsoft’s cloud posture is to blame. (Source)
• Apple is cutting jobs across its Vision Pro, Siri, and Intelligent Systems Experiences teams as it reprioritizes around AI and new devices. (Source)
• WebAIM’s 2026 Million survey finds more than one in four images on the web’s top home pages have alt text that is missing, vague, or copied from adjacent images. (Source)
• Uncle Bob has given up line-by-line review of AI-written code in favor of a metrics-and-constraints governance framework, drawing a public “trust, but verify” rebuttal from Grady Booch. (Source)
• A new measurement post shows benign long-form context can induce persistent activation drift that decouples an LLM’s behavior from RLHF alignment — a non-jailbreak safety bypass. (Source)
• One engineer documents letting Qwen 3.6/3.8 autonomously write a C compiler, riding the model’s unusually reliable tool-calling through the project. (Source)
• Hugging Face released GLiNER2.5, which predicts entity boundaries directly instead of enumerating spans, scaling linearly with document length and gaining 24.75 points on XNLI. (Source)

One Line

Avoid superlatives and praise. Stop telling me I am absolutely right. Give me the cold hard truth.

— Fabien Sanglard, agent.md