How to Tell If Photo Is AI Generated?

Why Your Eyes Can't Be Trusted Anymore

Here's an uncomfortable reality: in testing, only 0.1% of people correctly identified every deepfake they were shown, according to aggregated deepfake statistics. That's not a typo. Nearly everyone fails at this task, and the failure rate is getting worse as the technology improves.

The science backs this up. A peer-reviewed 2025 study found that AI-generated faces — including faces of real celebrities — are "essentially undetectable as synthetic to most human observers." Even showing participants real photos side-by-side for comparison produced only limited gains, and knowing a celebrity's face well gave just modest improvements. The researchers called for new detection methods "as a matter of urgency."

So what about the classic tricks we've all learned? Check the hands. Count the fingers. Look for weird teeth or melted backgrounds. Those clues are disappearing. Veteran photojournalist David Carson, writing for Stanford's JSK Fellowship, put it bluntly: six-fingered hands "will soon be relics of AI image generation's infancy." Modern image models have largely fixed the artifacts that used to give them away, and he describes detection as "an ever-evolving, unwinnable game of cat and mouse."

Images do remain somewhat easier to verify than video — people explicitly told to watch for synthetic content were still 36% less likely to correctly identify a fake video than a fake image. But "relatively easier" is not the same as "easy." Human accuracy on high-quality deepfake video averages just 24.5%, which is worse than a coin flip. Manual review alone, the data suggests, is not a reliable control.

Part of the problem is us, not just the technology. Research into social media deception found that users rely on cognitive heuristics — mental shortcuts — that actually increase vulnerability to AI-generated content, and cognitive biases amplify trust in fabricated images. Our instincts about what "looks fake" are calibrated to an older generation of tools.

Why should business leaders care beyond curiosity? Consider these numbers:

• 62% of organizations experienced a deepfake attack in the past 12 months.
• Deepfake fraud accounted for 11% of all fraud detected globally in 2025.
• Generative AI fraud losses are projected to reach $40 billion by 2027.

The practical takeaway is that your eyes — and your employees' eyes — should be treated as a weak first check, not a verification system. The reliable methods are shifting toward provenance tools and automated detectors, which we'll cover next. And because verifying images at scale is repetitive work, it's exactly the kind of task agent skills can automate; SkillzBench is building a free directory and benchmarking platform so you can see which skills actually perform before you rely on one.

Check Provenance First: Metadata and Watermarks

Staring at a photo and squinting at hands and teeth is a losing game — peer-reviewed research shows AI-generated faces are now "essentially undetectable as synthetic to most human observers," and only 0.1% of people correctly identify every deepfake shown to them, per deepfake statistics. That's why experts increasingly point to provenance instead: verifying where an image came from, not what it looks like.

The most promising standard is C2PA Content Credentials, often described as a "nutrition label" for images. Embedded at the moment of capture or creation, these credentials record an image's origin and edit history — which camera took it, which tool generated it, what changed along the way. Veteran photojournalist David Carson, writing in a Stanford JSK analysis, calls authentication at the moment of creation "the clearest path forward for building public trust in news photography."

Alongside metadata, companies embed invisible watermarks directly into image content. Google's SynthID is the leading example, designed to survive cropping, filters, and lossy compression — degradation that would destroy ordinary metadata.

Two free tools make these checks accessible to anyone:

• OpenAI's Verify tool — a free checker that looks for both C2PA Content Credentials and SynthID watermarks in uploaded images.
• The Adobe Content Authenticity Chrome extension — surfaces Content Credentials directly in your browser as you browse.
• Automated detectors like Hive Detect, which offers free uploads and "likely model attribution" for flagged images.

There is one critical caveat, and it comes directly from OpenAI's own documentation: "no signal detected" does NOT mean an image is real. Content Credentials rely on metadata, which can be stripped. Watermarks can be degraded. And an image generated by another company's model simply won't carry OpenAI's signals at all. A detected signal is a strong, reliable indicator; the absence of one tells you almost nothing.

That asymmetry matters for business readers. Deepfake fraud accounted for 11% of all fraud detected globally in 2025, and 62% of organizations experienced a deepfake attack in the past 12 months, according to fraud research. Treating provenance checks as one layer in a broader verification workflow — rather than a single pass/fail test — is the only defensible approach.

If you want to build that verification workflow into an automated pipeline — say, an agent that screens incoming images before they reach your team — agent skills can handle it. SkillzBench is building a free directory of vetted, benchmarked skills plus a free MCP connector so any agent can use them; join the waitlist to test them at launch.

Run It Through an AI Detector as a Second Check

Visual inspection only takes you so far when AI-generated faces are "essentially undetectable" to most human observers, as a recent peer-reviewed study put it. When your eyes can't be trusted, automated detectors offer a useful second opinion.

Several free tools will analyze an uploaded image and return a confidence score — and sometimes a guess at which model produced it. Options worth knowing include:

• Hive Detect — an upload tool that also exists as a Chrome extension and an X bot, with likely model attribution on its consumer tools
• Sightengine — a free AI image detector that a working photojournalist testing these tools found helpful
• AI or Not — performed well in the same hands-on testing, though the free version limits functionality

A veteran photojournalist who tested these detectors while researching AI's impact on photojournalism described the whole field as an "ever-evolving, unwinnable game of cat and mouse" — generators improve, detectors adapt, generators improve again. That framing matters, because none of these tools publishes independent accuracy benchmarks. No third party has systematically verified how often Hive, Sightengine, or AI or Not produce false positives or false negatives.

The research community sees the same problem at a larger scale. An Interpol-affiliated review of more than 400 detection studies published between 2022 and 2025 found the field is active but hampered by inconsistent evaluation datasets, which makes different detection methods difficult to compare. The review's authors call for forensically relevant benchmark datasets and greater explainability — in other words, even the researchers building these systems lack a common yardstick.

So treat detector scores as a signal, not a verdict. A high "AI-generated" confidence score is a strong reason for suspicion; a low score proves nothing, since newer models routinely evade detectors trained on older ones. The same logic applies to provenance checks: the absence of a watermark or metadata signal doesn't mean an image is real.

For teams that handle images at volume — marketing teams vetting stock assets, newsrooms verifying submissions, procurement teams reviewing vendor graphics — running each suspicious image through a detector manually doesn't scale. This is where agent skills come in: an AI agent can be equipped with a skill that routes uploaded images through detection and provenance checks automatically. SkillzBench is building a free directory of vetted agent skills plus a free MCP connector to attach them to your agent, with security scanning and benchmarking so you can see which skills actually lift performance. The waitlist is open now if you want detection workflows like this on autopilot.

Use detectors as one layer in a habit stack: provenance metadata first, automated detection second, and context — source, account history, cross-references — as the final tiebreaker.

Build a Verification Workflow That Doesn't Rely on One Check

If a single employee glancing at a photo is your only defense against AI-generated fraud, you're relying on a control that statistically doesn't work. Human detection accuracy on high-quality deepfakes averages just 24.5%, and fraud research is blunt about what that means: manual review alone is not a reliable control.

That's why verification needs to be a layered routine, not a one-shot judgment. Start with provenance: check for C2PA Content Credentials and invisible watermarks using a free tool like OpenAI's Verify, which reads origin metadata and SynthID signals embedded in the content itself. Then run the file through a free automated detector such as Hive Detect or Sightengine, which return confidence scores and, in Hive's case, likely model attribution. Finally, verify the source independently — call the sender, cross-check the claimed event, or request the original file.

One rule matters above all: no signal does not mean real. OpenAI explicitly warns that metadata can be stripped, watermarks can degrade, and images from other generators won't trigger its checks. Treat every "clean" result as one data point, not a verdict.

The organizational gap here is wide. According to the same research, 61% of executives have no established deepfake protocols, and over half of employees have never received deepfake identification training. Meanwhile, 62% of organizations experienced a deepfake attack in the past 12 months. A simple, repeatable checklist closes most of that gap without expensive tooling.

A practical verification checklist for teams:

• Invoices and payment requests: run attached images through a provenance check, then confirm the request through a known contact channel — never one supplied in the original message.
• Identity documents: compare against C2PA credentials where present, run automated detection, and require liveness verification or a second document for high-value accounts.
• Marketing and PR assets: verify licensing and origin before publication; a fabricated image published under your brand carries legal and reputational risk.
• Executive communications: treat any unexpected image or video involving leadership as unverified until confirmed by two independent channels.

Document each step so the routine survives staff turnover. Teams that want to automate this kind of multi-step verification can also explore agent skills — SkillzBench is building a free directory and MCP connector for exactly that purpose, with every skill security-scanned and benchmarked before it earns a trust score. Whether you automate or keep it manual, the principle stands: layer provenance, detection, and source confirmation, and never let one check — especially eyeballing it — be the decision.

Automate the Rest with AI Agent Skills

Here's the uncomfortable truth about everything we've covered: manual checking doesn't scale. If a business receives dozens of images a day — in invoices, listings, press submissions, social media claims — eyeballing each one for telltale artifacts isn't just unreliable, it's practically impossible. The numbers back this up: research shows that manual review alone is not a reliable control against deepfakes, and 62% of organizations experienced a deepfake attack in the past twelve months.

That's where automation comes in. The verification workflow we've described — checking for C2PA Content Credentials, running images through free detectors like Hive Detect or Sightengine, flagging anything suspicious for human review — is exactly the kind of repetitive, rule-based process that AI agents handle well. Instead of a person pasting every image into three different tools, an agent can run the same images through provenance and detection checks automatically, apply the "no signal ≠ real" rule consistently, and escalate only the files that warrant a human's attention.

This is precisely what agent skills are for. Skills are instruction packages that extend what agents like Claude Code, Codex, Cursor, and Gemini CLI can do — and image verification is a natural fit. Imagine a skill that instructs an agent to check uploaded images for Content Credentials metadata, route them through detection services, and flag suspicious files before they reach a decision-maker. That workflow turns a manual chore into a background process.

The catch, of course, is quality control for the skills themselves. Published research found that roughly 26% of published skills carry at least one vulnerability — so grabbing random skills off the internet and wiring them into your workflow creates its own risks. This is the problem SkillzBench is being built to solve: a free, independent directory of agent skills where every version is pinned, security-scanned, license-checked, and benchmarked in a sandbox — with and without the skill, on the same model — so you can see the actual Lift in percentage points before you trust it with a task like image verification.

SkillzBench is pre-launch and actively under construction, but you can get ahead of the curve now:

• Browse the free skills directory to see what kinds of verification and automation skills are emerging
• Join the waitlist for the MCP connector, which will let you attach chosen skills to any agent — with the agent seeing only what you've selected
• Watch for the security scanning and benchmarking results that will show which skills genuinely help and which are risky
• Build your image-verification workflow now, manually, so you know exactly what to automate first

AI-generated images aren't going away — billions have been created since 2022, with tens of millions more added daily, according to Stanford's JSK analysis. The winners in this environment won't be the people with the sharpest eyes. They'll be the ones who build verification into their systems — and who choose their tools with the same skepticism they apply to the images themselves.