Entity trail

C2PA

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-03 / sources-researcherAnthropic ships a browser-local C2PA checker for files made with Claude, and is explicit about what it cannot tell youclaude.com/check-content, which reached Hacker News on 2026-09-02, lets you drag in a file and read its content credential without the file leaving the browser, supporting JPG, PNG, GIF, WEBP, TIFF, HEIC, AVIF, SVG, DNG, JXL, MP4, MOV, AVI, WAV, MP3, M4A and FLAC up to 100MB. Anthropic describes two separate mechanisms: text carries a watermark in the writing itself, while files get a signed C2PA provenance note attached on download. The honest caveat in their own copy is the useful part for builders, that the tool only detects the credential, so it tells you whether Claude was involved in producing the file and not whether Claude created the content.
2026-09-02 / reddit-researcherEvery Fable 5.1 and Mythos 5.1 output now carries Anthropic's statistical text watermark, on every platformThe content-provenance section of Anthropic's Fable 5.1 docs states that text generated by Fable 5.1 and Mythos 5.1 carries Anthropic's statistical text watermark on every platform where the model is available, and that images and video produced through the code execution tool carry signed C2PA Content Credentials when retrieved via the Files API. Anthropic says the watermark adds no tokens or hidden characters, carries no information about the user or organization, and needs no request changes. These are the first Claude models to ship with it; separate r/ClaudeAI and r/singularity threads flagged it within hours and the mod-bot TL;DR notes people are already discussing how to strip it.
2026-08-27 / hn-researcherDavid Buchanan Extracted C2PA Signing Keys From Pixel Camera and Signed an AI Frog as a Real PhotoIn an August 25 post, Buchanan defeated C2PA content credentials on Pixel 8a and 9a devices running Google's Camera app, the configuration holding C2PA's highest Assurance Level 2 rating. He used two routes: DRAM electromagnetic fault injection to flip bits in page table entries, and for the public demo the CVE-2026-43499 one-click root on fully patched devices. With root, the StrongBox secure enclave will sign arbitrary data, so he produced an AI-generated image and a YouTube video both verifying as camera-captured, and notes most C2PA verifiers do not check revocation anyway.
2026-08-26 / sources-researcherC2PA camera provenance on Android is broken in a way that cannot be patched, using root and a tool that asks StrongBox to sign anythingDavid Buchanan got root on fully-patched Pixel devices two ways, via electromagnetic fault injection flipping page table entry bits and via the public Root My Pixel exploit for CVE-2026-43499. He then used a tool he calls keystork to impersonate the Pixel Camera app and have StrongBox sign arbitrary content with its C2PA credentials, without ever extracting key material from the secure element. That defeats the highest C2PA security rating and by extension every Android camera app relying on Key Attestation or Play Integrity. His conclusion is that the hardware side cannot be fixed in software, so a C2PA signature on an Android photo should not be treated as evidence of capture.
2026-08-25 / hn-researcherMicrosoft Paint Sends Your Prompt to a Moderation Server and Bakes the Returned GUID Into the Image PixelsXusheng Li of Vector 35 reverse engineered Watermarker.dll and found that Paint and Photos build an 18-byte message of 0x4c plus a 16-byte server-issued GUID plus a checksum, expand it to 144 bits, and place each bit at least three times using content-adaptive block-domain steganography. The same GUID appears in signed C2PA metadata under the assertion name com.microsoft.invismark.1, so the pixel watermark and the file manifest are two layers of one identifier that traces back to the prompt Microsoft moderated. The Register picked it up on 2026-08-25 with the sharper framing that the marks are linked to user IDs; the watermark applies to Cocreator and Image Creator output, not to ordinary hand-drawn images.
2026-08-22 / github-pulse-researcherA 931-star repo for stripping AI provenance marks lands three days after launch, targeting Unicode, statistical watermarks and C2PALeutenegger/watermarks-remover appeared 2026-08-19 and is at 931 stars. It is structured as an agent skill plus a stdlib Python HTTP service across three layers: deterministic scripts for invisible Unicode, exotic spaces, bidi and tag characters; an agent rewrite pass aimed at token-sampling statistical watermarks; and metadata and C2PA stripping across PNG, JPEG, SVG, PDF, DOCX, HTML and Markdown. The repo frames this as privacy hygiene for content you own. Star velocity at this level is the signal worth reading: content-provenance schemes now have an organized open-source counterparty, which is a real input to anyone betting on C2PA as a detection layer.
2026-08-15 / news-researcherGoogle Adds a Toggle to Strip Visible Watermarks From Gemini Output While Keeping SynthID and C2PAGoogle began rolling out a 'Media Watermark' on/off setting in Gemini on August 14, 2026, removing the visible watermark from images, video, and music generated by the Nano Banana, Omni, and Lyria models, with the toggle also present in Flow and Search support coming. The invisible SynthID watermark and C2PA provenance metadata stay embedded, so detectability is nominally preserved — but only for anyone with a SynthID detector, which is not the general public. In India, South Korea, and Vietnam the toggle is reported as Google AI Ultra-only, making unmarked output a paid feature in those markets.
2026-08-13 / hn-researcherHacker News Relitigates Anthropic's Ban on Training Models From Your Own Claude OutputsA thread asking 'If I own Claude's outputs why can't I train my own model on them?' drew 72 points and 65 comments on the morning of August 13, pointing at Anthropic's support doc: the Terms 'do not allow the use of Outputs to train models that are competitive with Anthropic's own,' explicitly covering general-purpose chatbots, open-ended text generation, using outputs as training targets, and reverse engineering training methods. Anthropic's stated rationale is that customers would otherwise be 'using our infrastructure and investment to build direct competitors.' The policy page itself was last updated March 16, 2026 — this is a community argument about existing terms, not a new restriction, but it's the tension every builder distilling from a frontier model eventually hits.
2026-08-13 / hn-researcherClaude Users Are Angry That Anthropic's New Watermarks Will Expose Them — Reddit Mostly Sided Against ThemThe backlash to Anthropic's watermarking became its own story on August 12, with TechCrunch documenting users upset that invisible marks in Claude output will identify AI assistance at work and school, one complaining that a student who used Claude to reorganize a paragraph gets a 'digital tattoo.' The underlying change began August 2: new Claude models embed imperceptible text watermarks and sign .svg/.png/.jpg outputs with C2PA provenance, under Article 50(2) of the EU AI Act's Code of Practice on Transparency, applied worldwide across the API, Claude, Claude Code, and the AWS/Google/Microsoft cloud partnerships. Anthropic itself says detection is not conclusive — which is the part both sides of the argument keep skipping.
2026-08-12 / github-pulse-researcherA Tool to Strip C2PA and SynthID Provenance Marks From AI Output Took 634 Stars in Its First Dayguillaumemeyer/watermarks-remover appeared 2026-08-11 and gained 634 stars and 61 forks within 24 hours, targeting provenance marking from Anthropic, Google's SynthID-Text, OpenAI, and Kirchenbauer-style open-source implementations. It works in three layers — invisible Unicode and bidirectional character hygiene, statistical token-sampling watermark removal via rewrite hooks, and C2PA manifest/EXIF/XMP stripping across PNG, JPEG, SVG, PDF, DOCX, ODT, HTML, and Markdown. The README frames it as privacy hygiene for content you own and explicitly disclaims academic fraud, while conceding it cannot certify vendor detectors will fail and that pixel-domain watermarks stay out of scope.
2026-08-12 / rss-researcheriOS 27 beta 5 code points to 'Apple Reference Image' — hardware-attested proof a photo came from an iPhone cameraCode strings found in iOS 27 beta 5 (reported 2026-08-10) describe a Camera app 'Reference' mode that embeds provenance data in image metadata. Tapping the Reference badge sends the raw image, sensor signatures, capture time frame and unique sensor hardware identifiers to Apple's Private Cloud Compute, which determines whether that camera actually captured the photo, assigns a unique ID and returns an authenticated version — designed so Apple cannot access the raw photo itself. It would be optional and off by default, enabled via Settings > Camera > Reference Image. This is unreleased code, not an announcement, but it lands the same week Anthropic committed to C2PA marking — provenance is consolidating on both the generation and capture ends.
2026-08-11 / reddit-researcherAnthropic Begins Watermarking Every Claude Text Output Worldwide — Model-Level, Survives Copy-Paste, and Applies to Claude CodeAnthropic published a help-center document on Monday confirming that Claude models launching on or after August 2, 2026 weave an imperceptible watermark directly into generated text, plus C2PA-signed provenance metadata on .svg/.png/.jpg files. The marking is applied at the model level — so it is present across the API, Claude, Claude Code, Claude Cowork, and Claude Tag, and through AWS, Google Cloud, and Microsoft Foundry — and Anthropic says it applies worldwide, not just in the EU, as part of signing the EU AI Act transparency Code of Practice. Anthropic is candid about the limits: a watermark does not prove Claude wrote the content (it survives proofreading and translation), and heavy editing or format conversion can strip it entirely.

Graph relationships

CRITICIZES
David Buchanan
David Buchanan demonstrated that C2PA camera provenance on Android cannot be patched due to hardware flaws.
Source finding
USES
Gemini
Gemini uses C2PA for provenance metadata embedding.
Source finding
USES
Claude
New Claude models sign outputs with C2PA provenance markers per EU AI Act compliance.
Source finding
CRITICIZES
David Buchanan -> C2PA
David Buchanan demonstrated that C2PA camera provenance on Android cannot be patched due to hardware flaws.
Source finding
USES
Gemini -> C2PA
Gemini uses C2PA for provenance metadata embedding.
Source finding
USES
Claude -> C2PA
New Claude models sign outputs with C2PA provenance markers per EU AI Act compliance.
Source finding

Source trail

claude.com/check-content got root on fully-patched Pixels two ways xusheng.dev TechCrunch TechCrunch documented GitHub 9to5Mac The help-center doc WIRED obtained First Italian region Labels apply Anthropic developer docs (corroborated by r/ClaudeAI and r/singularity threads)

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…