A C2PA check of OpenAI's own Sora and ChatGPT files found valid signatures but unverified signers

A developer ran a new checker for C2PA Content Credentials against public media files from OpenAI, Adobe, Capture One and Truepic — including a Sora video and a ChatGPT image — and published the findings on dev.to. Every file's signature matched its bytes, both OpenAI files declared themselves AI-generated, and none of the signers could be confirmed against the official C2PA trust list. The checker's first pass also returned two wrong answers, and the corrections illustrate how easily signed provenance can be misread.

Four states instead of one verdict

The tool deliberately avoids a single pass/fail verdict. A Content Credentials record makes several independent claims, so each is reported separately as VERIFIED (established cryptographically or against an official list), DECLARED_ONLY (the signer says so, with nothing independent behind it), CONTRADICTED (the evidence points the other way) or INSUFFICIENT (nothing to decide on). The claims evaluated are whether the signature binds to the file's exact bytes, who signed and whether that signer sits on the official C2PA trust list, which edits the signer declares, and whether the content is declared AI-generated.

What the OpenAI files showed

According to the dev.to write-up, the Sora video and the ChatGPT image both had VERIFIED binding, with edits and AI-generation declared at the DECLARED_ONLY level. The Sora signer also came back DECLARED_ONLY, while the ChatGPT image's signer was INSUFFICIENT. An Adobe Firefly image matched the Sora pattern, and photos signed by Capture One and a Truepic camera app showed verified bindings but nothing declared about edits or AI generation.

No signer reached VERIFIED because the sample files were signed before the official trust list replaced an interim one at the start of 2026, or with certificates that are not on the list. The honest output in those cases is that the signature is valid but the signer cannot be independently confirmed.

Expired certificates are not tampering

The first pass marked the Sora and ChatGPT signers as CONTRADICTED, the strongest negative, solely because their signing certificates had since expired. As the author points out, that is not evidence of forgery, and reporting it as such would have made OpenAI's own media look forged. The corrected logic treats expiry as neutral: when a validated timestamp shows the file was signed while the certificate was live, as the Sora file has, the signer reads DECLARED_ONLY with an explanation; without one, as with the ChatGPT image, it reads INSUFFICIENT. Only a revoked or otherwise invalid credential now counts as contradicted.

The AI label was hiding in an ingredient

The second error went the other direction. The ChatGPT image's top-level manifest only records that the file was opened; the actual AI-generation label, trainedAlgorithmicMedia, sits in the manifest of an ingredient the image was built from. Reading only the top level produced a false "no AI label" result. The fix walks ingredient manifests, but carefully: a label only counts when it comes from an ingredient the C2PA tool confirms is hash-bound to the file and whose own manifest has no mismatch, checked recursively through validated manifests. The result page names the ingredient the label came from, since naively trusting ingredient references would allow a forged ingredient to plant a label.

What a valid signature does not prove

The post is explicit about the limits. A signature binds bytes to a signer, not the depicted events to reality. Capture labels are the device's own attestation, and a camera can film a screen. A file with no credentials is not evidence of fakery, since most files carry none. And re-encoding changes the bytes, so a platform re-upload no longer matches the original's signature or hash.

The free checker hashes files in the browser so they never leave the device, with an upload endpoint for a deeper credentials check. There is also a free MCP tool, verify_media, for agents, plus paid registry features: a publisher can register an original with a signed verdict and a Bitcoin timestamp, and an AI deployer can register a generated file as declared synthetic by its SHA-256 hash. Each declaration is attributed to its maker, several can coexist, and none can overwrite another, so nobody can relabel someone else's genuine recording as synthetic.

Why it matters

Detection models return scores nobody can audit; signed provenance returns claims anyone can check. But this exercise shows that the checking itself is error-prone in instructive ways — an expired certificate reads like tampering if you are careless, and an AI label can live one manifest deeper than expected. Regulation is adding pressure: the EU AI Act's Article 50 asks providers of synthetic audio and video to mark output in a machine-readable way, and the author found no credentials at all on two public showcase clips from a popular text-to-speech provider. Separating what is cryptographically established from what is merely declared is what makes provenance useful rather than misleading.