Forged C2PA credentials sign an AI image as a real Pixel photo
One rooted Pixel and the camera's own enclave keys can stamp any file as a genuine capture — the standard many AI detectors lean on just failed.
Copy markdown
A fake frog, signed as a real Pixel photo
Security researcher David Buchanan produced an AI-generated frog image and a synthetic video that both carry valid C2PA Content Credentials attesting they came straight out of a Pixel Camera. The forgeries verify as authentic in standard C2PA validators.
The trust chain: root the phone, sign anything
C2PA on Android leans on Google's Key Attestation and Play Integrity to prove media came from a real camera. A root exploit — a software privilege escalation (CVE-2026-43499) or hardware fault injection — lets you call the KeyStore/StrongBox API to sign arbitrary bytes with the camera app's own key. You never extract the key; the secure enclave signs your fake for you.
What this means for your 'verified real' badge
If you're building AI-image detection or an authenticity badge on C2PA, treat a valid credential as 'unproven origin,' not 'genuine' — most verifiers don't even check certificate revocation, and the analog hole (point a camera at a screen) sidesteps signing entirely. Practitioners point to publisher-signed provenance, RAW-file workflows, and disclosure rules as sturdier ground.