C2PA camera proofs can be forged on a rooted Pixel
Two stories worth your afternoon: the cryptographic system built to expose AI forgeries just got broken on its strongest implementation, and open-source speech recognition got absurdly fast.
The content-credential system meant to prove a photo came from a real camera has been broken at its strongest point. Security researcher David Buchanan demonstrated working C2PA forgeries today that verification tools accept as genuine captures straight out of the Pixel Camera app — including an AI-generated image certified as an unedited photograph and a YouTube video stamped "captured with a camera." Google pulled that label from the video after his post went up; the underlying capability remains. His toolkit, keystork, uses root access on an Android phone to command its hardware security chip into signing arbitrary files — exactly what C2PA's trust model is supposed to make impossible.
The break isn't in the cryptography itself — it's in how Android proves a device deserves signing keys in the first place. Key attestation checks for unlocked bootloaders and stale patch levels, but a phone rooted through an exploit looks pristine on all of those, so Google's servers happily provision C2PA credentials to it. Public one-click exploits now root fully patched Pixel phones using a Linux-kernel bug, and low-cost hardware fault-injection attacks need no software bug at all — hardware flaws in shipped devices largely can't be patched away. Buchanan says he reported the whole chain to the relevant parties at least 90 days ago; Google closed his report as "won't fix (infeasible)" and paid him a $7,500 bounty anyway. Every other Android C2PA camera app leaning on the same attestation inherits the problem — an attacker just picks the cheapest vulnerable device in the ecosystem.
The timing stings: Apple is reportedly building its own media-provenance scheme for iPhones — we covered the rumors in Apple's iOS 27 could prove iPhone photos aren't deepfakes — and full vertical integration may genuinely resist this attack class better than Android's patchwork. But the lesson holds regardless of vendor: "cryptographically verified" means "signed by a device that looked trustworthy at provisioning time," not "true." Until verifiers routinely check key revocation — Buchanan notes most still don't — provenance metadata will keep raising the cost of fakery without ever quite stopping it.
What to watch: whether the C2PA conformance program rewrites its mobile requirements, and whether Google patches the kernel bug on Pixels — Meta already fixed the same vulnerability on Quest headsets weeks ago, prompted by nothing nobler than VR cheating.
IBM's new open speech models turn fast transcription into a solved-and-cheap problem. Granite Speech 5.0 Turbo CTC ships as two 470M-parameter English recognition models under Apache 2.0 and non-commercial licenses, and IBM reports throughput above 12,600 RTFx on an Nvidia H200 — more than 3.5 hours of audio transcribed in one second with batched inference, roughly 20 times faster than earlier Granite Speech models. Accuracy stays respectable, at 5.00% and 4.85% word error rate respectively on the Open ASR Leaderboard's public short-form sets. The encoder-only design gives up speech translation and keyword biasing, which positions these squarely for on-device and edge use. The LocalLLaMA community's early verdict: impressed by the speed, already asking for languages beyond English. It slots into IBM's broader open-model push we covered earlier today in IBM's open Granite 4.2 models learn agent skills via reinforcement learning.
If a rooted phone can forge a camera-signed image, would you still trust a "verified authentic" label — or is provenance marketing until the hardware changes? Tell us in the comments.
Sources: David Buchanan (retr0id) · NVD — CVE-2026-43499 · Root My Pixel (GitHub) · keystork (GitHub) · IBM Granite on Hugging Face · r/LocalLLaMA discussion
