The Verge published an investigative report on October 29, 2025 revealing a series of issues with OpenAI's internal video generator Sora as it spreads in the real world. Sora embeds C2PA (Content Credentials) metadata in videos it generates and publishes via the share feature; this metadata is intended to cryptographically record creatorship, the generation tool and timestamps so platforms or users can determine whether content is "synthetic" or AI‑generated.
However, the reporters' tests exposed two key failure points. First, when viewed directly via OpenAI's "share link," the page displays the video's credential; but once a user downloads the video as an MP4, or copies the shared content through third‑party tools and reuploads it to mainstream social platforms, the C2PA metadata is frequently stripped. Metadata can be lost in many ways: browser downloads, platform transcoding, web scraping, or third‑party editing tools can all remove it, turning a file labeled as "synthetic" back into an ordinary file with no provenance.
Second, even if metadata is fully passed to a platform, not all platforms will read or trust those credentials. The Verge notes that if a platform does not proactively implement ingestion and verification mechanisms, or transcodes and rewrites the file container upon upload, the presence of C2PA is essentially meaningless. The investigation also demonstrated another scenario: simple post‑processing (minor visual adjustments, cropping, changes to encoding bitrate, etc.) can cause some automated detectors to return "unable to determine" or to misclassify content as authentic, indicating that feature‑based detection methods remain highly vulnerable to high‑quality synthesis.
The report emphasizes that C2PA itself is not a silver bullet; it is more like a key that must work across the ecosystem (mandatory signing on the creator side, platform‑side reading and display, and user‑side visual cues). The current reality is that technical standards have not been uniformly enforced, interoperability between platforms is insufficient, and tool makers and platform operators are adopting the standard at uneven paces.
The report's advice to younger users and content creators is straightforward: do not blindly trust surface "source" labels. Sora's case shows that even industry‑endorsed content credentials can break along upload, download, and re‑sharing chains. To mend this gap, the report suggests three directions: first, platforms must establish native support and verification workflows for credentials like C2PA; second, browsers and common editing tools should improve preservation of metadata in media containers; third, stricter industry standards or regulatory requirements are needed to avoid blind spots that arise when credential adoption is voluntary.
The report's concluding takeaway is clear: Sora reveals not just a product flaw but a systemic lag in the deepfake detection ecosystem as generative AI rapidly evolves. For those seeking to maintain trust in the information age, merely "embedding metadata" is insufficient; technology, platforms, and regulation must be combined to rebuild the boundary between real and fake.