I Tested 6 AI Tools to See If They Could Find Someone's Location From a Holiday Photo. The Results Were Concerning.

Introduction

Imagine going on holiday with your friends or family. You're sitting around a campfire, enjoying the evening, and someone takes a beautiful photograph.

You decide to share it on Instagram or Facebook.

There's no location tag. You haven't mentioned the name of the campsite, and your phone's GPS information isn't available in the photo.

Surely nobody can figure out exactly where you are, right?

Well, I decided to put that assumption to the test.

As someone who works in cybersecurity and open-source intelligence (OSINT), I'm particularly interested in how seemingly harmless information can be used to reveal things about us that we never intended to share.

And with artificial intelligence becoming increasingly accessible, I wanted to understand just how much information these tools could extract from a single photograph.

So I conducted a small experiment.

I tested six different AI tools using the same holiday photograph to see whether they could identify where it was taken, without relying on GPS coordinates or location metadata.

The results were interesting, but they also raised some serious questions about online privacy.

The Experiment: Can AI Find You From a Photograph?

For this investigation, I used a photograph showing a group of people sitting around a campfire at dusk.

At first glance, there was nothing particularly unusual about it.

A few friends, some camping chairs, tents in the background and a beautiful desert landscape.

It's the kind of photograph thousands of people share on social media every day.

But when I examined the image from an OSINT perspective, I started noticing details that could potentially reveal its location.

There were tall cacti in the background, particular types of vegetation, a metal fire ring, a concrete camping area and a wooden picnic table.

Individually, these details might not tell you much.

But when combined, they become valuable geographical clues.

I wanted to see whether AI could make those same connections.

I used six tools:

1. GeoSeer
2. Google Gemini
3. Microsoft Copilot
4. ChatGPT
5. Grok
6. Claude

I submitted the same photograph to each tool and asked it to identify where the image had been taken.

The important part of this experiment was that the tools had to work from the visual information in the photograph rather than embedded GPS metadata.

I then compared the responses to see how accurately each tool could narrow down the location.

What I Discovered

All six tools identified the correct geographical region. Three went a step further and named the same campground.

That was the part that caught my attention.

The tools weren't simply describing the photograph. They were connecting environmental features to real-world geographical locations.

Here's what happened.

1. GeoSeer: The Most Precise Result

GeoSeer produced the most specific answer of the six tools I tested.

It identified the location as Gilbert Ray Campground in Tucson Mountain Park, Arizona.

It also returned geographical coordinates:

32.2186° N, 111.1431° W

What interested me was how it reached that conclusion.

It recognised the tall saguaro cacti, which are strongly associated with the Sonoran Desert in the southwestern United States and northwestern Mexico.

It then considered the camping infrastructure visible in the photograph.

The metal fire ring, picnic table and developed camping area suggested an established campground rather than a random location in the desert.

By combining those clues, GeoSeer narrowed its prediction to a specific campsite.

For an investigator, this is a useful demonstration of how several seemingly ordinary clues can become much more revealing when analysed together.

2. Google Gemini: It Recognised the Environment

Next, I tested Google Gemini.

Gemini correctly recognised the saguaro cacti and associated them with the Sonoran Desert.

It suggested that the photograph was likely taken somewhere in Arizona, particularly around Tucson, Saguaro National Park or Organ Pipe Cactus National Monument.

It also considered northern Sonora in Mexico.

Although Gemini didn't identify the exact campsite, it successfully narrowed the possibilities from anywhere in the world to a relatively small geographical region.

Think about that for a moment.

A photograph without GPS information was enough for the tool to suggest where someone might be spending their holiday.

3. Microsoft Copilot: Accurate, but Cautious

Microsoft Copilot also recognised the large saguaro cacti and suggested southern Arizona, particularly the Tucson area.

However, what I appreciated about its response was that it acknowledged the limitations of the image.

It explained that the photograph alone wasn't enough to confidently identify the exact campsite or provide GPS coordinates.

This is an important distinction.

AI can make convincing predictions, but a convincing prediction isn't necessarily a verified fact.

As researchers, we need to remember that.

4. ChatGPT: Connecting the Environmental Clues

ChatGPT approached the photograph by breaking down the visible features.

It recognised the desert environment, saguaro cacti, camping equipment and organised campsite layout.

Based on those details, it suggested the Sonoran Desert and provided possible locations, including Saguaro National Park, campgrounds around Tucson and Organ Pipe Cactus National Monument.

It didn't identify the exact campground.

However, it demonstrated how AI can combine several visual observations to narrow down a location.

5. Grok: A Much More Specific Prediction

Grok produced one of the more interesting responses.

Like the other tools, it recognised the Sonoran Desert environment and suggested southern Arizona, particularly around Tucson.

But it went further.

Grok named Gilbert Ray Campground as its leading candidate.

It also used web sources to support its prediction.

This is where the investigation becomes particularly interesting from an OSINT perspective.

The combination of AI image analysis and publicly available information can make geolocation investigations considerably easier.

A person doesn't necessarily need years of experience studying satellite imagery or geographical features to begin narrowing down where a photograph was taken.

6. Claude: Another Match for Gilbert Ray Campground

Finally, I tested Claude.

Claude identified southern Arizona, most likely the Tucson area.

It examined the saguaro cacti, desert vegetation, palo verde and mesquite trees, along with the developed campground infrastructure.

It then listed potential locations.

And once again, Gilbert Ray Campground appeared at the top of the list.

That meant three of the six tools had independently returned the same campground name as their leading answer.

However, it's worth being precise here: GeoSeer returned a specific coordinate prediction, while Grok and Claude identified the campground as their top candidate.

Those are different levels of certainty.

The Results: 6 AI Tools, One Photograph

Six out of six tools identified the correct region.

Three out of six named the same campground.

Now, this was a small experiment using one photograph, not a large-scale scientific evaluation of AI geolocation accuracy.

The findings don't mean these tools will always identify someone's location correctly.

But they demonstrate something important: a photograph can reveal geographical information even when no GPS data is available.

How Did the AI Tools Work It Out?

This is where things get interesting.

Many people assume that when someone identifies the location of a photograph, they must have accessed hidden information stored inside the image.

That hidden information is often called EXIF metadata.

Depending on the device and settings, metadata can contain details such as when a photograph was taken, the camera used and potentially GPS coordinates.

But that wasn't what this experiment was testing.

I wanted to see what AI could determine using only the photograph itself.

And the answer came down to three things.

First, the vegetation.

The saguaro cacti were the biggest geographical clue.

These distinctive plants naturally grow in a relatively limited geographical area, particularly the Sonoran Desert.

Recognising them immediately reduces the number of possible locations.

Second, the infrastructure.

The photograph showed a developed camping environment.

There was a metal fire ring, a concrete pad and a wooden picnic table.

These features suggested an established campground rather than an isolated spot in the wilderness.

Third, geographical correlation.

Once the tools had identified the likely region and type of location, they could compare those clues with known places.

This is similar to the analytical process used in open-source intelligence investigations.

You begin with small pieces of information, identify patterns and gradually narrow down the possibilities.

The difference is that AI can assist with parts of that process in seconds.

Why This Matters for Cybersecurity

You might be wondering:

"Okay, so AI can identify a campsite. Why should I be worried?"

Because location information can become extremely useful in the wrong hands.

Let me give you an example.

Imagine you're on holiday in Cape Town, Durban or somewhere along the Garden Route.

You post a photograph from your hotel or holiday accommodation.

You haven't tagged the location.

But someone uses an AI tool to analyse the photograph and identifies the hotel or surrounding area.

A few hours later, you receive a WhatsApp message:

"Good afternoon. We're contacting you regarding your booking at [hotel name]. There appears to be an issue with your payment verification. Please follow this link to avoid cancellation."

Now, ask yourself something.

Would that message seem more convincing if it mentioned the actual hotel where you were staying?

For many people, it probably would.

And that's precisely where social engineering becomes dangerous.

Cybercriminals don't always need to compromise your device or steal your password first.

Sometimes, they only need enough information to make their message appear believable.

In this hypothetical scenario, the attacker uses information obtained from your social media photograph to create a more personalised phishing attempt.

The AI doesn't have to be perfect.

It only needs to provide enough useful information for the attacker to build a convincing story.

To be clear, my experiment tested AI-assisted photo geolocation. It did not involve sending phishing messages or demonstrating that an actual criminal had targeted someone using this method.

But the potential misuse is worth understanding.

There's Another Risk People Often Overlook

When you share photographs while travelling, you might also be telling people something else.

You're not at home.

Think about how much information we voluntarily share online.

We announce that we're leaving for holiday.

We upload photographs from airports.

We post pictures of hotel rooms, restaurants and tourist attractions.

Sometimes we even share exactly how long we'll be away.

Individually, these posts may appear harmless.

But collectively, they can reveal travel patterns, routines and periods when a property might be unoccupied.

This doesn't mean every person viewing your holiday photographs has malicious intentions.

It means we need to understand that information shared publicly can be collected, combined and interpreted in ways we didn't anticipate.

I Also Found That AI Has Limitations

During my testing, photographs without useful geographical backgrounds were much more difficult for the tools to analyse.

For example, a photograph taken indoors against a plain wall doesn't necessarily provide enough information to identify a location.

Without recognisable landmarks, distinctive vegetation, signs or other geographical clues, AI may struggle to narrow down the possibilities.

That doesn't make indoor photographs automatically safe.

Other clues, such as documents, reflections, visible addresses or distinctive interiors, can still reveal information.

But it reinforces the central finding of this experiment.

The background of a photograph can be just as revealing as the person standing in front of the camera.

What Can You Do to Protect Yourself?

I'm not suggesting that people should stop sharing holiday photographs.

Social media is part of how we document and share our lives.

But I do think we need to become more intentional about what we're revealing.

Here are a few precautions worth considering.

1. Consider posting after you've left.

You don't always need to share your location in real time.

Posting photographs after your holiday can reduce the opportunity for someone to use that information while you're still at the location.

2. Pay attention to your background.

Before uploading a photograph, look beyond the main subject.

Are there street signs, hotel names, identifiable landmarks, house numbers or other details that could reveal your location?

3. Review who can see your content.

Not every photograph needs to be public.

Use privacy settings and limited audiences where appropriate.

Remember, however, that private content can still be reshared or captured by someone who can view it.

4. Disable unnecessary location sharing.

Removing GPS metadata and turning off automatic location tagging remain sensible precautions.

But as this experiment demonstrates, they don't prevent someone from analysing visible geographical clues.

5. Be cautious when unexpected messages contain accurate personal details.

If someone contacts you claiming to represent your hotel, travel agency or booking platform, don't automatically trust them simply because they know where you're staying.

Verify the request using contact information obtained independently from the organisation's official website or your original booking confirmation.

My Final Thoughts

What stood out to me most about this investigation wasn't simply that AI could recognise the Sonoran Desert.

It was how quickly multiple tools could transform ordinary visual details into useful geographical intelligence.

A cactus.

A picnic table.

A fire ring.

A particular landscape.

Details most of us wouldn't think twice about.

Yet when analysed together, they helped six AI tools identify the correct region, with three naming the same campground.

And that raises a bigger question about how we think about privacy.

For years, we've been encouraged to remove location tags, disable GPS sharing and be careful about what personal information we publish online.

Those precautions still matter.

But the information we expose isn't limited to what we type, tag or deliberately disclose.

Sometimes, it's sitting quietly in the background of a photograph.

As AI-powered analysis becomes more accessible, understanding these risks is becoming increasingly important.

My biggest takeaway from this experiment is simple: you might not be sharing your location intentionally, but your photograph could be doing it for you.

The next time you're about to upload a holiday photograph, ask yourself one question:

If a stranger had access to this picture, how much could they work out about where I am?

Because sometimes, the most revealing part of your photograph isn't you.

It's everything behind you.