Remember when a local file was actually yours? Silly me, I almost forgot we’re living in a cyberpunk dystopia where Redmond feels entitled to tag every single pixel you push around your screen.
Security researcher Xusheng recently went spelunking through the latest updates for Windows classics—specifically MS Paint and the Photos app—and found something that should make your skin crawl. Even when you’re working entirely offline, generating or editing images locally with the help of built-in ai tools, these applications are quietly embedding an invisible GUID (Globally Unique Identifier) directly into the file’s metadata.
Let that sink in. You open a blank canvas, doodle something stupid, or run a local AI upscaler, and Windows slaps a digital leash on it.
Now, the tech apologists are already crawling out of the woodwork. “Oh, it’s just for provenance!” they cry. “It’s to help trace deepfakes and verify authentic media!” Sure, Jan. And telemarketers are just calling to check on my mental health.
Here’s the problem with this “harmless tracking” narrative: it completely destroys the boundary between cloud telemetry and local privacy. For decades, the implicit social contract of desktop software was simple. What happens on my local machine stays on my local machine unless I actively choose to upload it. MS Paint—yes, the stupid little drawing program we used to draw poorly proportioned cars in 1998—is now acting as a snitch.
By injecting a permanent GUID into locally generated ai outputs, Microsoft is creating a breadcrumb trail straight back to your hardware, your OS install, and potentially your Microsoft account. It doesn’t matter if you pulled the ethernet cord out of the wall. Your computer is still whispering secrets about what you’re creating to the Mothership the second it catches a whiff of an internet connection.
What makes this particularly insidious is the invisibility of it all. There’s no toggle switch. There’s no prompt asking, “Hey, would you like to permanently brand this image with a unique identifier that links it to your identity?” It’s just baked into the code, forced upon you under the guise of safety.
We’ve sleepwalked into an era where software companies treat our own hardware as hostile territory. They assume guilt by default. Every image is a potential crime, every user a suspect, and every local tool a mandatory surveillance node. If Microsoft can justify putting a tracking ID in MS Paint, what’s next? Notepad? Are my grocery lists going to start containing telemetry data?
We need to stop normalizing this creep. When everything becomes a watermark, privacy becomes an illusion. It’s time to start stripping these tags, auditing our binaries, and reminding Big Tech that not everything we create needs to be cataloged in their permanent ledger.
Here is my hot take: If your software needs to secretly tattoo a GUID onto a local doodle just to help corporations sleep at night, you don’t have a “provenance tool”—you have a spy ring disguised as an office accessory.