Google Earth's AI Deepfake Tool Only Lasted One Day

On Thursday, July 31, 2026, Google launched an AI image-editing feature inside Google Earth that let users modify satellite imagery using plain-text prompts — and by Friday, it was gone. The tool, powered by Gemini's Nano Banana 2 image model, survived less than 24 hours before researcher Henk van Ess demonstrated that its stated safeguards were functionally nonexistent. Google pulled the feature the same day van Ess published his findings.

The Claim

Google's pitch for the feature was straightforward: users could select a location in Google Earth and describe changes they wanted to see, and the Nano Banana 2 model would generate a modified satellite view. The company promoted the tool as a creative feature — a way to imagine alternate versions of real-world places. To address obvious concerns about misuse, Google said it had implemented two layers of protection: content filters designed to prevent harmful or sensitive prompts from being fulfilled, and C2PA-standard watermarks embedded in every generated image to signal that the output was AI-modified.

The watermark layer leaned on third-party infrastructure. Google's approach relied on Hive, an AI content detection company, whose tools are designed to identify AI-generated imagery and flag it accordingly. The thinking, presumably, was that even if a bad actor generated misleading satellite imagery, the embedded provenance signals would allow platforms, researchers, or journalists to detect the manipulation. That two-layer defense — block the worst prompts upfront, watermark everything that gets through — is a fairly standard framework for responsible AI image deployment in 2026.

The feature's creative range appeared broad. Multiple reports indicate users were generating imagery well beyond the politely benign: a kaiju attacking downtown Los Angeles, flooded neighborhoods, and heavily altered disaster scenes. The AOL coverage noted these examples specifically, and the range itself tells you something about how wide the tool's generation envelope was before the shutdown.

What We See

The two-layer defense collapsed almost immediately, and in both directions simultaneously. Van Ess — an investigative journalist and researcher who has tracked AI misinformation for years — reported that he faced zero friction when prompting for geopolitically sensitive imagery. He generated fake satellite views depicting refugees near the U.S.–Mexico border and what appeared to be bomb craters near a hospital in Gaza. Nothing was refused. No prompt was softened, redirected, or flagged. The content filters that Google described in its launch materials simply did not engage.

The watermark layer failed separately. Van Ess demonstrated that the C2PA provenance signals embedded in Google Earth's AI output could be stripped by re-encoding the imagery as video — a step that is trivially easy with any standard video export workflow. After that re-encoding, Hive's AI detection tool failed to flag the output as AI-generated. This is significant because it is not an exotic attack. It does not require specialized tooling, adversarial machine learning knowledge, or access to internals. It is the kind of thing a motivated misinformation actor could work out in an afternoon.

Our read is that the most revealing part of this story is not that the filters failed — filter bypass is a well-documented problem across every major AI image model — but that Google anchored a creative-generation tool directly to a platform that carries specific institutional authority. Google Earth is not a general image generator. It is where journalists, researchers, lawyers, and intelligence analysts go to verify what a place actually looks like. When AI-generated output appears inside that interface, it inherits that credibility signal. A fake satellite image of a Gaza hospital produced by a standalone AI art tool is harmful. The same image, generated inside Google Earth's interface and exported with apparent geospatial metadata attached, is something different in kind.

Google's own shutdown statement acknowledged this dynamic. The company said it was pulling the feature because "people uniquely trust Google Earth for a reliable view of the world." That is a candid admission that the launch team either did not anticipate this authority-transfer problem or anticipated it and launched anyway. Neither reading is flattering.

Where It Falls Short

The obvious gap in this episode is the absence of adversarial pre-launch testing. The vulnerabilities van Ess found — prompt filter bypass, watermark strip via video re-encode — are not novel. Both are documented failure modes that appear regularly in AI safety literature and in coverage of other image generators. A basic red-team exercise conducted before launch would have surfaced both within hours. Decrypt's coverage frames this as a "deepfake fears" story, which undersells the actual problem: this was not a case of unforeseen misuse of a robust tool. It was a case of known attack surfaces being left open in a uniquely high-trust context.

The 24-hour timeline also raises questions about Google's internal review process. Nano Banana 2 is not a new model that appeared without warning — it is part of the Gemini family that Google has been developing and deploying for some time. The content policies governing Gemini-based image generation presumably exist. What changed when that same generation capability was routed through the Google Earth interface? The answer appears to be: the content policy context did not transfer. The guardrails that may function adequately in a standalone Gemini image tool were not re-evaluated for a geospatial authority context before the feature shipped.

What remains unanswered is whether Google intends to relaunch a revised version, or whether this is a permanent withdrawal. The company's statement at pulldown did not commit to either path. Given that the underlying problem — AI image generation anchored to authoritative geospatial data — is structural rather than a fixable prompt-filter bug, a relaunch would require rethinking the feature's basic design, not just patching its filters.

Sources