The Camera-Proof the EU Is About to Mandate Just Got Forged With a Lottery Ticket

Key Takeaways

Security researcher David Buchanan published a working bypass of C2PA / Content Credentials, the cryptographic provenance standard platforms are racing to adopt. Using the spec’s exclusion-range feature, a signer can mark the entire file as excluded, so the signature and its trusted timestamp verify as valid while protecting zero bytes of the actual image.
His proof: a photo of a lottery ticket whose signed metadata claims it was created before the draw whose winning numbers it displays. He shot a real ticket, edited the numbers in afterward, and every verifier still reports it as authentic.
This is a verifier and specification weakness, not broken cryptography. The math is sound; the signature simply covers nothing. The fix is known, verifiers must strictly restrict which byte ranges may be excluded, but no vendor or spec fix had shipped as of the demonstration.
The timing is brutal. The EU AI Act’s machine-readable marking obligation (Article 50) hits its December 2, 2026 deadline, pushing platforms toward exactly this standard, just as it is shown to be forgeable. Meanwhile Apple is building its own system instead of joining C2PA, and Instagram, LinkedIn, and Threads strip the credentials on upload anyway.

Yesterday we wrote about Etsy demanding proof that your product photo is real, and pointed to the one technology actually built to supply that proof: C2PA Content Credentials, the cryptographic “this came from a real camera” stamp that Leica, Canon, Nikon, Sony, and Google’s Pixel now write at capture. It is the standard regulators and platforms are converging on. It also, as of this month, has a public, working forgery.

On October 2, 2026, security researcher David Buchanan demonstrated that a C2PA signature can verify as perfectly valid while cryptographically protecting none of the image it claims to authenticate. His headline example is almost cheeky: a photo of a lottery ticket whose signed, timestamped credentials insist it was created before the draw whose winning numbers it shows. Here is how the flaw works, why it matters a great deal right now, and, just as important, what it does not mean.

Diagram explaining the C2PA exclusion-range flaw: the signer marks the whole file as excluded, so the signature protects zero bytes yet still verifies as valid — The flaw in one picture: mark the whole file as

What Buchanan actually did

C2PA works by hashing a file and signing that hash, then wrapping it in a trusted timestamp so you can later prove the file existed, unchanged, at a given moment. Crucially, the spec includes an exclusion range: a way to leave certain bytes out of the signed hash, originally meant for legitimate reasons, such as redacting a privacy-sensitive field like GPS coordinates after the fact without invalidating everything else.

Buchanan’s insight is that nothing in the verifiers he tested stops a signer from excluding the entire file. Do that, and the signature and timestamp are computed over nothing at all. They still verify as valid, because the cryptography is working exactly as designed, it just has no content to protect. You can then alter any pixel you like after signing and the credential keeps reporting “authentic.” His lottery-ticket demo makes the point vividly: a real photo, signed and timestamped, then edited to show a winning combination, and the provenance data still swears it predates the draw.

David Buchanan holds a EuroMillions lottery ticket beside a clock, the photo he signed with C2PA metadata falsely claiming it was created before the draw — The actual proof of concept: Buchanan photographed a real EuroMillions ticket next to a clock, then attached a valid, trusted-timestamped C2PA signature whose metadata claims the file was created before the draw. The forgery lives in the file’s signed data, not the visible pixels (he notes the numbers are obviously edited in), and it still verifies as authentic. Image: David Buchanan (retr0id).

Why this is a spec problem, not broken crypto

This is the part worth being precise about, because it is easy to over-read. The underlying cryptography is not broken. Signatures, hashes, and trusted timestamps all do their jobs. The failure is in the design and the verifiers: the spec allows an exclusion range large enough to swallow the whole file, and the verifiers Buchanan tested do not reject that. A valid signature over zero bytes is still a valid signature, it just proves nothing useful.

The fix is understood and relatively contained. Buchanan’s own suggested direction is to define, per file format, exactly which byte ranges may legitimately be excluded, and to require verifiers to enforce those limits and refuse anything broader. That is a tightening of the standard and its checking tools, not a return to the drawing board. As of the demonstration, though, no vendor or the C2PA group had shipped such a fix. The honest framing for photographers: Content Credentials prove origin, who or what signed a file, they were never a guarantee that the pixels were not altered, and this flaw makes that gap concrete.

The worst possible timing: the EU is about to lean on this

A forgeable provenance standard would be an academic curiosity if nobody depended on it. The trouble is that a lot of people are about to. The EU AI Act’s transparency rules under Article 50 require AI-generated or manipulated content to carry machine-readable marking, and the grace period for already-deployed systems ends on December 2, 2026, roughly five weeks away. C2PA is the leading candidate for satisfying exactly that kind of obligation, which means regulators and platforms are being pushed toward the standard at the precise moment a working bypass is circulating.

It compounds a problem the industry already had. As we covered when Etsy started demanding proof-of-real, platforms want authenticity but have no reliable way to check it, and the tools that could help are fragmented and gated. A spec that can be made to say “valid” over an edited image does not help a marketplace, a newsroom, or a regulator separate real from fake.

The bigger mess: Apple went solo, and platforms strip the data anyway

Even setting the flaw aside, the provenance picture is messier than the pitch suggests. Camera makers largely rallied around C2PA, but Apple announced its own approach, Apple Reference Image, an opt-in mode on the iPhone 18 Pro that signs at the sensor rather than joining the open standard. So the single shared format everyone hoped for is already splitting in two.

And then there is the last mile. Instagram, LinkedIn, and Threads routinely strip Content Credentials when you upload, so even a perfectly signed, honestly captured photo usually arrives on the platforms where people actually see it with its provenance erased. Between a forgeable spec, a fracturing standard, and platforms that discard the data, the chain of trust has holes at almost every link.

Vertical graphic: photo proof that proves nothing, the C2PA Content Credentials forgery — Pin it: a researcher forged a cryptographically

What it means for photographers

Do not panic, and do not throw out Content Credentials. For the common case, an honestly captured photo signed at the sensor and verified with a strict tool, provenance is still a useful signal of where an image came from. What this flaw kills is the temptation to treat a green “verified” checkmark as proof an image is unedited. It is not, and now there is a public demo proving why.

Practically: treat a valid credential as evidence of origin, not of untouched pixels, especially until verifiers are updated to reject oversized exclusion ranges. Keep your own camera originals with intact EXIF data as a secondary trail, and stay skeptical of any single automated “real or fake” verdict, the same caution that makes today’s AI detectors and even contest screening unreliable on their own. Proving a photo is real is still an unsolved problem, and this month it got a little harder.

Frequently Asked Questions

Is C2PA / Content Credentials broken?

The cryptography is not broken. The weakness is in the specification and the verifiers: the C2PA exclusion-range feature lets a signer exclude the entire file from the signature, so the signature can verify as valid while protecting none of the image. Researcher David Buchanan demonstrated this on October 2, 2026. The fix is to restrict which byte ranges may be excluded and have verifiers enforce it.

What was the lottery-ticket demo?

David Buchanan photographed a real lottery ticket, signed and timestamped it with Content Credentials, then edited the numbers afterward to show a winning combination. Because the signature excluded the whole file, every verifier still reported the forged image as authentic, with a timestamp claiming it predated the draw.

Does this mean a verified photo could be fake?

It means a “valid” Content Credential proves origin, not that the pixels were never altered. With this flaw, a signature can report as valid over an edited image. Until verifiers are updated to reject oversized exclusion ranges, do not treat a green verification badge as proof that an image is unedited.

How does this connect to the EU AI Act?

The EU AI Act’s Article 50 requires machine-readable marking of AI-generated or manipulated content, with the grace period for already-deployed systems ending December 2, 2026. C2PA is a leading way to meet that kind of obligation, so platforms are being pushed toward the standard just as a working bypass has been published.

The bottom line

C2PA remains the most serious attempt yet to prove where a photo came from, and this flaw does not erase that. But it is a sharp reminder that provenance is a chain, and a chain is only as strong as its weakest link. A standard that can be made to certify an edited image, splitting between Apple and everyone else, with platforms stripping the data on upload, is not yet the bedrock that regulators and marketplaces are treating it as. The fix for this particular flaw is clear and should come. The broader lesson is older: a checkmark is a claim, not a proof, and “is this photo real?” is still a question technology cannot fully answer.