Sora Videos: What the Watermark Does and Doesn't Prove

The clip is 22 seconds long, it arrived in a group chat, and it shows something that would be a serious story if it were real. You scrub back to the corner looking for the little animated mark that would settle it. There is nothing there, and you are now trying to work out whether that means anything.

It does not. A Sora watermark is evidence when present and nothing at all when absent. A visible mark identifies the tool that made a clip; missing marks are the default state of essentially every video online, including every real one ever shot on a phone. The asymmetry is the whole point, and it is the part that keeps tripping people up.

What the mark is, and what it was built for

As of mid-2026, video generated through OpenAI's Sora app has generally carried a visible identifying mark on downloaded clips, typically animated so it moves position across the frame rather than sitting still in one corner. The movement is deliberate: a static mark in a fixed position is trivially cropped or covered, while a moving one forces a more aggressive edit that leaves its own traces.

Underneath that sits a second, quieter layer. OpenAI has embedded C2PA Content Credentials in its generated media since February 2024, and the same open standard is supported by Adobe Firefly, Microsoft's Bing and Designer tools, and Google's 2026 Nano Banana image models. Content Credentials are a cryptographically signed manifest attached to the file, recording what produced it and, optionally, what happened to it afterward. The C2PA specification is public, and anyone can read a surviving manifest with free tooling.

Both layers were designed for a specific purpose worth being precise about: helping honest files carry their history. Neither was designed to defeat a motivated adversary, and the people who built them have never claimed otherwise. That distinction gets lost the moment a clip goes viral and someone declares the absence of a mark to be proof of authenticity.

What the Sora watermark proves, and what it cannot

Reduce it to logic and the confusion clears up.

A visible mark, present and unedited, is decent evidence that the clip came from that tool. Not conclusive, since a mark can be faked by anyone with basic editing software, and people do fake them, occasionally to make real footage look synthetic. But as a starting point it is informative.

A visible mark that is absent tells you exactly one thing: this file does not currently display that mark. The set of files without one includes every camera recording ever made, every AI clip that has been cropped, every AI clip that has been re-encoded by a platform, and every screen recording of anything. That set is so large and so heterogeneous that membership in it carries no information.

Crop is the trivial attack, and cropping costs nothing beyond a slightly tighter frame. Re-encoding, letterboxing, filming a screen with another phone, and running the clip through any editor that re-renders the pixels all achieve the same effect with varying degrees of quality loss. None of it requires skill.

The metadata layer, and why it usually is not there

Content Credentials are more robust than a visible mark in one sense and more fragile in another.

More robust, because they are cryptographically signed. You cannot convincingly forge a credential chain claiming a file came from a given provider without that provider's signing key, so a valid manifest is meaningfully harder to fake than a drawn-on logo.

More fragile, because metadata is not pixels. It rides alongside the file, and it survives only as long as nothing along the path discards it. Platforms routinely strip metadata on upload, usually as a side effect of transcoding for delivery rather than as a policy choice. A screenshot destroys it. A re-upload destroys it. Sending a clip through a messaging app that compresses media usually destroys it.

So the honest expectation is this: for any video that reached you through more than one hop of ordinary internet sharing, there is probably nothing left to read. That is not a scandal and not evidence of tampering. It is the normal behavior of the systems everyone uses.

Watermarking that lives inside the content itself is the proposed answer to that fragility, and it has its own boundary. Google's SynthID marks images produced by Gemini models, and as of mid-2026 there is no public third-party API to verify SynthID; verification runs through Google's own tooling. Even a robust watermark, in other words, is only as useful as public access to the verifier.

What to check instead, and in what order

Here is the decision framework. The two right-hand columns are the point, because most verification mistakes come from misreading a negative result.

Work top to bottom, and notice that the first two are cheap and the highest-value action is the third. Chasing the original file from whoever posted it first does more for you than any tool, because compression is the great destroyer of evidence in this domain. Bellingcat found in September 2023 that a leading image detector missed seven of ten AI images after ordinary social-media-level compression. Video is worse, since it is compressed harder and more often.

When you do reach for a scan, the useful ones report structure rather than a verdict. AI Detector 360's AI video detector produces a frame-by-frame timeline so you can see where in a clip the signal concentrates instead of averaging everything into one number, alongside C2PA and EXIF provenance inspection, and our AI image detector does the same for stills with a likely-generator attribution. Video costs 25 credits per scan and images 5, which matters if you are checking a batch rather than a single clip. What those confidence levels mean, and the conditions where we expect them to be unreliable, is written up on our methodology page.

For the manual side, our practical deepfake checklist covers what to look at in the footage itself, and the broader guide to detecting AI-generated video walks through the workflow across tools. Expectations for accuracy are set honestly in our writeup on how well image detectors actually benchmark.

Run the framework against a real deadline and you see why the order matters. An evening producer at a regional station gets a 40-second clip of a warehouse fire from a stringer she has used before, forwarded from a source she has never met, 50 minutes before the broadcast. No visible mark. No credentials, because it arrived through a messaging app. A frame-level scan returns a middling score at low confidence, which is what compressed short clips usually return. She has three options and only one good one: she can run it, she can drop it, or she can spend fifteen of her fifty minutes asking the stringer to get the original file and the name of whoever shot it. The tools cannot make that call for her, and pretending a score could is how newsrooms end up issuing corrections.

When the answer is still unresolved at air time, say so on the record rather than implying certainty either way:

This footage was provided to us by a third party. We have not been able to independently verify when or where it was recorded, or confirm how it was produced.

The counter-argument, and where the rules are heading

The obvious objection: if watermarks are this easy to strip, why not just require them by law and be done with it?

The EU has done roughly that, and it is worth seeing exactly what it does and does not solve. The AI Act's Article 50 transparency obligations become applicable on August 2, 2026, requiring that AI-generated content be marked in a machine-readable way, that deepfakes be disclosed, and that people be told when they are interacting with an AI system. That is a serious rule with real force behind it.

What it changes is the behavior of compliant providers and deployers, which is genuinely valuable at scale, since most content is made by people who are not trying to deceive anyone. What it does not change is the physics. A legal duty to mark does not make marks survive a platform transcode, does not reach a model running on someone's own hardware outside the rule's scope, and does not stop a bad actor who has already decided to break a law. Regulation raises the floor. It does not close the gap, and a verification practice that assumes it will is going to be wrong at the worst possible moment.

What nobody can verify yet

Some honest gaps, because the confident version of this article would be worse.

Nobody publishes reliable figures for what share of AI-generated video circulating online still carries usable provenance. Nobody has a public benchmark for video detection accuracy under real-world compression that is comparable across tools, which means any vendor accuracy claim, including any AI Detector 360 might be tempted to make, should be read as a claim about a dataset the vendor chose. And there is no public accounting of how often provenance metadata survives specific platforms, because that behavior changes silently with every pipeline update.

What we can say with confidence is narrow and useful. Provenance signals are worth checking first because they are cheap and occasionally decisive. Their absence is not evidence. Detection scores are evidence to weigh rather than proof, ours included, and they weaken as compression increases. The strongest move available to almost anyone is still the least technical one, which is finding who posted the file first and asking them for the original. Sometimes the unglamorous answer is the one that holds up.