Google Put a Prompt Box on Google Earth. It Lasted a Day.

TL;DR

On Thursday, Google shipped AI image generation inside Google Earth: zoom to any coordinates on the web app, tap "create image," type what you want to see, and Nano Banana 2 paints it onto the real satellite, aerial and 3D map data underneath. Global rollout, no waitlist. Within hours, open-source researchers had produced a burning oil terminal at Iran's Kharg Island, a flooded US Capitol complex, a damaged US military base in Bahrain, and a bomb crater at a Gaza hospital. By Friday Google had rolled the feature back "while we work on implementing stronger guardrails." The interesting failure is not that a model made a fake. It is where the fake was made: inside the product people open to check whether an image is real.

What actually shipped

Google's own announcement is short and cheerful. "Just zoom in to a place in Google Earth on web, tap 'create image,' and type whatever you want to see." The post lists five intended uses: visualizing history, generating educational infographics via Gemini, real estate planning, project visualization, and creatively reimagining a place. It was available globally to Google Earth web users on day one.

Google did ship guardrails, and they are worth naming precisely, because they are the ones most teams would have shipped too. Generated images did not appear in the shared Google Earth experience for other users. Every output carried a SynthID watermark. And Google told NPR that it prevents "image creation on harmful topics" and is "continually updating our protections."

Google's launch post suggested reimagining your neighborhood. The internet reimagined the Capitol underwater.

"Nothing was refused"

Open-source investigator Henk van Ess went straight at the harmful-topics filter and reported back to NPR in three words: "Nothing was refused." His four documented outputs were refugees massed at the Mexican border, a nuclear plant dropped into Iran, a fatal crash on an Amsterdam street, and a hospital with a bomb crater in Gaza.

The Federation of American Scientists published its own teardown the same day. Nuclear analyst Matt Korda's examples land harder than the usual safety-post hypotheticals: fictional Russian ICBM silos placed next to the real ones, fabricated mass protests and refugee waves, and, because he clearly enjoyed himself, a pre-eruption Pompeii.

Washington Post reporter Evan Hill summarized the reaction: "The opportunities for abuse and disinfo are literally boundless." Bellingcat researcher Jake Godin made the more measured version of the point to NPR, and it is the one worth internalizing, because faking satellite imagery has always been possible: "It's just streamlining the process, which I think is going to make it proliferate more."

The watermark was real. It just was not the problem.

SynthID is not marketing. Google DeepMind embeds it at pixel level, it is imperceptible, and it is explicitly designed to survive cropping, filters and lossy compression. You verify it by uploading the file to Gemini or to the SynthID Detector portal and asking.

Read that last sentence again, because it contains the whole failure. Verification is an action somebody has to choose to take. Think of SynthID as a serial number stamped on a counterfeit bill: genuinely there, genuinely conclusive, and completely useless unless the cashier owns a scanner and thinks to reach for it. A social feed has no cashier.

Google's own rollback statement names the mechanism without quite admitting it: "we've also seen people sharing screenshots of generated imagery that appear to violate our policies." The image left the product and entered the distribution layer, where the label is inert by default.

Grounding is what made it dangerous

Here is the part that matters if you build with image models, and it is the opposite of the usual lesson. The problem was not a weak model. It was a well-grounded one.

Ask a generic text-to-image model for "satellite photo of Kharg Island on fire" and you get a plausible-looking nothing: invented coastline, invented road layout, invented buildings. That is precisely what geolocation-based verification eats for breakfast. The entire OSINT method is matching what is in the frame against known ground truth, and a hallucinated geography fails on the first landmark.

Google Earth's version conditioned generation on the actual satellite, aerial and 3D data for the exact coordinates you were looking at. Correct coastline. Correct roads. Correct building footprints. One fabricated event dropped into an otherwise verifiable scene. The grounding that made the feature genuinely useful for the geospatial professionals Google cited is the same grounding that removed the analyst's primary tell.

Van Ess put the structural version of it best: "the fake is made inside the thing people use to check whether pictures are true."

The transferable lesson

If you bolt a generator onto an authoritative reference dataset, the output inherits that dataset's credibility and carries it out the door. Your provenance labels do not inherit anything, because they live in a different layer than the trust does. Any product that mixes generated content into a surface users treat as a record of reality has this problem, whether the record is satellite imagery, medical scans, security camera footage, or an archive.

What happens next

Google has given no timeline and no description of what the stronger guardrails would be. Note also what was rolled back: the surface, not the model. Nano Banana 2 remains available elsewhere, so the capability was never in question, only its placement inside a product whose entire value is that you can trust what it shows you.

The realistic fix is not a better prompt filter, since van Ess walked through the existing one without breaking stride. It is either refusing photorealistic output for real coordinates, or rendering results in a visually unmistakable non-photographic style. Both cost Google most of the demo. That is probably why the guardrails shipped the way they did.

Key Takeaways

• Google launched prompt-driven image generation in Google Earth web globally on Thursday July 30, powered by Nano Banana 2, and pulled it on Friday July 31.
• Researchers documented fabricated scenes at real coordinates including a burning Kharg Island, a flooded US Capitol, a damaged US base in Bahrain, and a cratered Gaza hospital. Van Ess on the harmful-topics filter: "Nothing was refused."
• The SynthID watermark worked as designed and did not help, because detection requires a deliberate upload to Gemini or the SynthID Detector. Google's rollback statement blames shared screenshots.
• Grounding generation in real satellite and 3D data is what made the output dangerous: it removes the geolocation mismatch that OSINT verification relies on.
• The general rule for builders: a generator attached to an authoritative dataset exports that dataset's credibility, while provenance metadata stays behind in a layer nobody checks.
• Google has committed to stronger guardrails with no timeline, and the model itself is unaffected.

Sources: Google Blog, NPR, TechCrunch, Federation of American Scientists, Digital Digging, Google DeepMind SynthID