Sources
Microsoft Paint Sends Your Prompt to a Remote Server for Moderation, Then Stamps the Returned GUID Into Locally Generated Pixels
Xusheng Li reverse-engineered Paint and Photos on 2026-08-24 and found four XOR-obfuscated .onnxe model files shipped locally (including a 302 MB mager.onnxe), so generation runs on the device, but the prompt still goes to a Microsoft server that returns a moderated prompt plus a GUID. That GUID gets embedded into the output image as an invisible watermark, and the app's separate visible-watermark toggle does not control it. On Copilot+ PCs the generation stays local while the moderation round trip does not, which means the local path still produces a per-request server-issued identifier in the file.
↳ Follow the thread