Microsoft's "local" AI image generator still calls a server before it can finish a single picture.

In August 2026, developer Xusheng Li published a reverse-engineering writeup of Windows Paint and Photos' “local” AI image generation feature — the one that draws pictures using your device's own chip. The finding: before Paint draws anything, it sends your prompt to a Microsoft server for moderation. The server returns a revised prompt and a GUID, a unique ID for that request. Only then does the on-device model generate the image. The mechanism was independently confirmed within days by Tom's Hardware and Neowin.

What actually gets embedded

Paint takes the server-issued GUID and stamps it into the finished image: an invisible, pixel-level watermark designed to survive normal edits. The same ID is written into the file's own metadata, under a C2PA field named soft-binding. The watermarking step is mandatory — if the server call fails, Paint doesn't fall back to handing you an unwatermarked image. It aborts the generation entirely. No server response, no picture, regardless of how much of the actual drawing happened on your own hardware.

This isn't a leak. It's a definition problem.

Nothing here is a security bug or an accidental data exposure — Microsoft isn't secretly uploading your photos, and no outlet has disputed the mechanism. It's a deliberate design choice, and that's exactly what makes it worth examining. “Local” describes where computation happens. It says nothing about whether a server has to approve the request first, what leaves the device to get that approval, or whether the output can be traced back to a specific request afterward. Paint's image generation is honestly “local” by the narrow, technical definition — the pixels really are computed on-device — and still requires a live server round-trip to function at all.

Why the gap matters beyond one Windows feature

A vendor can call a feature “on-device” and be completely accurate about where the compute runs, while the architecture separately decides whether a network call is required, whether an identifier gets attached to the output, and what happens when the network isn't there. None of that is visible in the word “local” itself — it only becomes visible when someone goes and checks what the software actually does, the way this reverse-engineering did.

That's the bar worth holding any “offline” or “local-first” claim to, including one you're building yourself: does the feature keep working, in full, with no network reachable at all? If the honest answer is “mostly, except for this one server call,” the claim is marketing with good intentions, not an architectural guarantee.

Sources: Xusheng Li, “Microsoft Paint and Photos Embed Server-Issued GUIDs as Invisible Watermarks,” xusheng.dev, 20 Aug 2026. Tom's Hardware, “Microsoft Paint and Photos apps add invisible watermark to AI-generated content, developer reverse-engineers GUID embedding,” Aug 2026. Neowin, “Microsoft hides watermarks in AI images made with Paint and Photos, researcher claims,” Aug 2026. Hacker News discussion thread, 861 points / 436 comments at time of writing.