We checked OpenAI's own Sora and ChatGPT files for Content Credentials. Two of our results were wrong at first

Everyone looking at a clip online now asks the same thing: was this changed, and was it made by AI? Detection models answer with a score nobody can audit. There's another way to ask, at least for files that carry it: read the file's own signed provenance record, C2PA Content Credentials, and report exactly what that record establishes and what it doesn't.

We built a free checker that does that, and before telling anyone about it we ran it on real public files from OpenAI, Adobe, Capture One and Truepic. Two of the results were wrong at first, in instructive ways. Here's what we found.

One state per claim, never one verdict

A Content Credentials record makes several different claims, and they don't stand or fall together. So the checker reports each one separately, as one of four states:

• VERIFIED: established cryptographically or against an official list.
• DECLARED_ONLY: the signer says so; nothing independent backs it.
• CONTRADICTED: the evidence says otherwise, for example the bytes don't match the signature.
• INSUFFICIENT: there's nothing to decide on.

The claims: does the signature match these exact bytes (binding), who signed and is that signer on the official C2PA trust list (signer), what edits the signer declares, and whether the signer declares the content AI-generated.

The results

Every file's signature matches its bytes. Both OpenAI files and the Firefly image declare themselves AI-generated. None of the signers is VERIFIED against the official C2PA trust list. These sample files were signed before the official list replaced the interim one at the start of 2026, or by certificates that aren't on it, so a photo here reads "valid signature, signer not on the list", which is the honest answer.

Bug 1: an expired certificate looked like tampering

Our first pass marked the Sora video's and ChatGPT image's signers CONTRADICTED, our strongest negative. The only reason was that their signing certificates have expired since they signed. That is not evidence against the signature, and calling it "contradicted" would have told people OpenAI's own content looked forged.

Now an expired certificate never reads as tampering. If a validated timestamp shows the claim was signed while the certificate was valid (the Sora file has one), the signer is DECLARED_ONLY with that explanation. Without one (the ChatGPT image), it's INSUFFICIENT: "signer trust cannot be established; an expired certificate is not evidence of tampering." Only a revoked or invalid credential contradicts.

Bug 2: we missed OpenAI's own AI label

The ChatGPT image's top-level manifest only records that the file was opened. The AI-generation label (trainedAlgorithmicMedia) sits in the manifest of the ingredient it was made from. Reading only the top level, we reported "no AI label", which was wrong.

The fix reads ingredient manifests too. Our own review then pointed out that this opens an attack: anyone could reference a forged ingredient to plant a label. So a label only counts from an ingredient the C2PA tool confirms is hash-bound to the file and whose own manifest has no mismatch, walking the chain recursively through validated manifests only. The page names the ingredient the label came from.

What it doesn't establish

• It never says content is true. A valid signature binds bytes to a signer, not the pictured event to reality.
• A capture label is the device's own attestation, and a camera can film a screen.
• A file with no credentials is not evidence of fakery. Most files have none.
• A re-encode changes the bytes, so a platform re-upload no longer matches the original's signature or hash.

Try it

invinoveritas.dev/check hashes a file in your browser, so it never leaves your device, and looks it up. To check the credentials themselves, upload it (free, up to 2 GB):

curl -F "[email protected]" https://api.babyblueviper.com/verify-media

There's also a free MCP tool, verify_media, for agents. Two paid pieces are live at 100 sats per file. A publisher can register an original (a signed verdict plus a Bitcoin timestamp), so anyone with a copy can check it without uploading. And an AI deployer can register a file it generated as "declared synthetic" by its SHA-256 alone. Each declaration is attributed to whoever made it, several can coexist, and none can overwrite another, so nobody can label someone else's genuine recording as synthetic and lock them out.

That last piece matters for AI audio and video in particular. The EU AI Act's Article 50 asks providers of synthetic audio and video to mark output in a machine-readable way, and the two public showcase clips we checked from one popular TTS provider carried no credentials at all.