BlendedBoris Blog: Simple Blockchain Ownership Registration

Content Credentials Flaw: What the C2PA Timestamp Hack Means for Blender Artists Who Need Dated Proof of Authorship (2026) | Blended BORIS | Digital Art IP

On 2 October 2026, security researcher David Buchanan published a photo of a lottery ticket carrying Content Credentials that say it was taken hours before the EuroMillions draw of 28 August 2026. The ticket shows that draw's winning numbers. The signature and the trusted timestamp both check out, yet the numbers were edited in after the draw. The trick works because the C2PA standard lets a signer leave parts of a file out of the signature, and nothing stops the signer from leaving out all of it.
The demonstration has spread through security and photography circles over the past two weeks, with detailed write-ups on 19 and 26 October. We found no public fix or statement from the C2PA standards body as of 29 October. For artists, the timing is awkward. Content Credentials, the label built on the C2PA standard, are being promoted as the way to show where an image came from and whether AI was involved, and Europe's AI Act now requires AI-generated content to be marked in a machine-readable way.
Blender artists rarely attach Content Credentials to their work today. But many of you rely on the same idea: a signed, dated record that says "this file existed at this time". Buchanan's lottery ticket is a useful lesson in what such a record really proves, and what it has to cover before it is worth anything in a dispute.
TL;DR: what the Content Credentials timestamp hack means for 3D artists

C2PA lets signers exclude byte ranges of a file from the signed hash. Buchanan excluded the whole file, so his valid signature and valid timestamp covered nothing, and he could change the image afterwards. Verification tools did not flag it. The lesson for Blender artists: a timestamp only proves something about the exact bytes it covers. Keep the original files, make sure any proof you use is tied to a hash of the complete file, and combine several kinds of evidence instead of trusting one badge.

What did the C2PA timestamp hack show?

In his post How to Hack Time, With C2PA, Buchanan explains that he photographed a real ticket, then edited the winning numbers into the image after they were announced. The file's C2PA manifest says the picture was created at 13:58 on 28 August 2026, before the draw. A trusted timestamp from an RFC 3161 time-stamping authority backs that up, and the claim signature is valid.
The catch sits in one line of the manifest. C2PA lets a signer list byte ranges to be excluded from the hash, because some file formats need parts of a file to stay changeable after signing. Buchanan's manifest excludes a single range starting at byte zero with a length of 3,995,383 bytes: the whole file. The stored hash is therefore the hash of nothing. The signature and the timestamp are cryptographically correct, but they vouch for zero bytes of the actual image.
Buchanan writes that the verification tools he could find did not flag anything unusual. He points back to an earlier warning by forensics researcher Neal Krawetz, who wrote: "Any excluded bytes can be altered without detection." The new part is showing how easily a signer can push that to the extreme.

Why can't the C2PA standard simply ban exclusions?

Exclusions exist for practical reasons. Formats such as PNG store checksums inside the file, and those change when the manifest is added, so the signed hash has to skip them. Buchanan notes that removing exclusions from the specification is therefore not simple. His suggestion is to define, for each file format, exactly which parts may be excluded, and to have verifiers reject anything outside those limits.
A WorkOS analysis published on 19 October frames the problem the same way: verifiers answer the question "does this signature validate?" instead of "what does this signature actually cover?" Until verification tools check coverage, a green tick on a Content Credentials viewer says less than most people assume.
This is not the first crack. In August 2026, Buchanan showed that a rooted Android phone could make Google's Pixel Camera app sign an AI-generated image as if it were an unedited photo. He reports that Google closed that report as "Won't fix (infeasible)". In 2025, Nikon suspended its Content Credentials service for the Z6III after a flaw allowed signed images to be mixed with unauthentic ones. None of this breaks the underlying cryptography. It shows that the rules around what gets signed matter as much as the signature.

What do Content Credentials actually prove for artists?

At their best, Content Credentials show which tool or device signed a file and what edits it recorded. They were never designed to prove that an image is true, or that the person who posted it made it. A creator can attach accurate credentials to a stolen render, and many platforms strip the metadata on upload anyway, so most viewers never see it.
That is why we have repeatedly warned that labels and signatures are weak evidence on their own. When ChatGPT added real cartoonists' signatures to AI cartoons, as we covered in our report on AI fake artist signatures, the visible signature meant nothing. And when a German court looked at an "it was AI" defence, it relied on the human raw version and sworn statements, as explained in our article on the Frankfurt AI copyright ruling. Courts look at the whole story of how a work was made.
The EU angle makes this more pressing. The AI Act's transparency duties have applied since 2 August 2026, and generative AI systems already on the market before that date have until 2 December 2026 to mark their outputs in a machine-readable way. C2PA is one of the main candidates for that marking. Marketplaces already ask for AI labels, as our piece on the Steam AI disclosure fight shows. If those labels lean on signatures that can cover nothing, honest artists need their own proof to fall back on.
Type of proofWhat it can showWhat it cannot show on its ownHow to make it stronger
Content Credentials (C2PA)Which tool or device signed the file and the edits it recordedThat the signature covers the whole file, or that the signer made the workCheck the manifest for large exclusions; keep the original file
RFC 3161 timestampThat some data existed at a given timeWhich data, if the signed hash covers only part of the fileTimestamp a hash of the complete file, not a manifest field
File metadata (EXIF, .blend properties)Author name, dates and software, as writtenAnything reliable: metadata is easy to editTreat as a supporting detail only
Blockchain timestamp of a file hashThat the exact file with that hash existed by the recorded timeWho created it or whether it is originalKeep the exact file; pair with working files
Saved .blend versions and sculpt layersHow the work developed, step by stepA trusted date, if only stored on your own driveTimestamp key versions; back them up
Copyright registrationA public record of your claim at a date (US: key for suing and statutory damages)That no one made it earlierRegister important works early
Proof that covers your actual file.

BlendedBoris records a blockchain timestamp of your Blender work from inside Blender, so you have dated proof of authorship to set beside your saved versions and registrations.

👉 Protect your Blender work with BlendedBoris

What makes a timestamp worth something in a dispute?

Buchanan's demonstration does not mean timestamps are useless. It means a timestamp is only as good as what it covers. A trusted time-stamping authority or a blockchain record proves that a particular hash existed at a particular time. If that hash belongs to the complete file you later show a court or a marketplace, anyone can recompute it and check the match. If it belongs to an empty input or a small slice of the file, it proves almost nothing about the work.
For 3D work, that points to a few habits. Keep the exact file that was timestamped, unchanged, because a single re-save produces a new hash. Timestamp more than one stage: an early blockout, a sculpt in progress and the finished asset tell a much stronger story together. Our guides on auto-save and version control in Blender and saving and backing up Blender projects show how to keep those stages without filling your drive.
Independence matters too. A record that you control alone, such as metadata in your own file, is easy to question. A record held by a third party, such as a public blockchain, a time-stamping authority or a copyright office, is much harder to fake after the fact. We compare the options in our guide to art registration and provenance and in our technical guide to blockchain copyright in Blender.

Should Blender artists use Content Credentials at all?

Yes, where your tools support them, as one layer among several. A credential that records your editing app and your edits is still useful context, and it may help buyers and platforms that look for AI labels. Just do not treat a valid badge as the whole case. If you inspect someone else's file, look at the manifest itself: a hash exclusion that covers most or all of the file is a red flag, whatever the viewer says.
Also expect the badge to disappear. Social platforms often remove embedded metadata when they recompress images, and 3D formats rarely carry Content Credentials at all. The originals on your own machine, plus independent dated records of them, are what survive. The same logic sits behind digital certificates for artwork and blockchain ownership certificates for 3D artists: they help when they point to a specific, verifiable file.

What should Blender artists do now?

  1. Keep your originals untouched. Store the exact .blend files, textures and full-resolution renders you might need as evidence, separate from working copies.
  2. Save versions as you work. Incremental saves and sculpt layers show how your model developed. They are hard to fake in bulk.
  3. Timestamp complete files. Whatever tool you use, make sure the dated record is tied to a hash of the whole file, not to a label or a field inside it.
  4. Timestamp more than the final. Record a blockout, a mid-stage version and the finished asset, so the dates tell the story of your work.
  5. Use Content Credentials as context, not proof. Turn them on where your tools offer them, but keep your own evidence too.
  6. Check suspicious credentials. If someone shows a signed file to claim your work, ask for the manifest and look for large hash exclusions.
  7. Register key works. Registration adds a public, dated record. Our step-by-step guide explains how to register copyright as a 3D artist.
  8. Act with evidence. When you find a copy, file a takedown with your dated files attached, following our DMCA takedown guide for Blender artists.

Where does this fit in the bigger picture?

Provenance is becoming infrastructure for creative work, and it is still being built. Labels, signatures and laws are all moving at once, while AI tools make copies cheaper every month, as our report on the open-source Hi3D 3D generator showed. The sister blog covers metadata and watermarking in Blender, court decisions that affect artists and artists' rights in AI training.
Our sister sites looked this week at who controls designs and the records behind them.

Conclusion

Buchanan's lottery ticket is a neat trick with a serious point. A signature and a timestamp can both be valid while protecting nothing, and today's verification tools may not notice. Content Credentials will likely improve, and the EU's marking rules will keep them in the news. For Blender artists, the lasting lesson is simple: evidence is only as good as what it covers. Keep the exact files, tie your dated records to complete file hashes, and build a trail that does not depend on a single badge.
Your files, your dates, your proof.

BlendedBoris adds a blockchain timestamp to your Blender work from inside Blender, giving you dated proof of authorship to use alongside saved versions, Content Credentials and copyright registrations.

👉 Get started with BlendedBoris

FAQ: the Content Credentials timestamp flaw and 3D artists

What are Content Credentials?

Content Credentials are signed provenance records based on the C2PA standard. They are embedded in a file and can show which device or app created or edited it, and whether AI was involved.

What did David Buchanan show on 2 October 2026?

He published a lottery ticket photo whose C2PA manifest excluded the entire file from the signed hash. The signature and trusted timestamp were valid but covered zero bytes, so the edited image still verified.

Is the C2PA cryptography broken?

No. The signatures and timestamps work as designed. The problem is that the standard allows exclusions without strict limits, and verifiers did not check how much of the file a signature covers.

Has the C2PA fixed the problem?

We found no public fix or statement as of 29 October 2026. Buchanan suggests defining which parts of each file format may be excluded and making verifiers enforce those limits.

Does this affect blockchain timestamps of my Blender files?

The same principle applies to any timestamp: it proves something only about the exact data it covers. A timestamp tied to a hash of your complete file can be checked by recomputing that hash, so keep the exact file unchanged.

What does the EU AI Act require here?

Article 50 transparency duties have applied since 2 August 2026. Generative AI systems already on the market before then have until 2 December 2026 to mark outputs in a machine-readable way, and C2PA is one of the main candidates.

How can BlendedBoris help?

BlendedBoris records a blockchain timestamp of your Blender work from inside Blender. That gives you dated proof that supports your saved versions and copyright registrations, but does not replace them.
2026-10-29 16:32 News