A photograph you took of your living room, posted to a tweet or shared with a stranger, may now be enough to identify your house. On October 12, 2026, 404 Media reported that a company called Graylark Technologies sells a tool that, given a single photo of an interior with no GPS or other metadata, returns a specific home, apartment, hotel, or short-term rental - the actual listing on Airbnb, Vrbo, or Zillow, with comparable interior photos and matching listing language. The company calls the tool Raven. It used to be called GeoSpy. The Los Angeles Police Department and the Miami-Dade Sheriff’s Office have already purchased access. The moment a photo is shared, the address it was taken in is now a query someone can run.
The Demos
Graylark built Raven on “millions of images from around the” world, per the same 404 Media report. The first version, GeoSpy 1.0, was trained on what the company described as “distinct geographical markers like architecture and soil.” CEO Daniel Heinen told 404 Media the new capability surfaced by surprise: “GeoSpy 1.0 couldn’t do that.” “That was kind of an ‘Oh shit’ moment for us,” Heinen said. “As we trained GeoSpy 2.0, we were just kind of red teaming and testing it out.” When the team fed GeoSpy 2.0 a bathroom selfie, the model pinned it to San Francisco. From there, Heinen said, “we’re investing heavily in interior geolocation across U.S. hotels, short-term rentals, houses, and apartments” in 2026.
The LinkedIn demonstrations 404 Media reviewed were not synthetic. In one, an X photo of a washer and dryer in someone’s kitchen returned an Airbnb listing titled “Renovated! Walk Uptown/located in 2 Hot Spots!” in Charlotte, NC. In another, a bathroom photo returned a Vrbo listing in Montecito, CA, titled “Montecito Miramar Beach House on the Sand.” In a third, an interior room returned “other interior photos of the property” that matched images from a Zillow listing. A separate demo matched a video of people vandalizing a Flock camera to a specific hotel. Flock is one of several neighborhood-level surveillance networks, alongside Amazon Ring’s camera grid, that have already been turned against residents in less publicized ways (Ring’s leaked Search Party email made that explicit). None of the inputs contained GPS coordinates or EXIF metadata. As 404 Media noted, Raven “appears to be able to quickly find the specific home” from a single photo, “without using location data or other metadata attached to the image.” The interface text reads: “City-specific property AI to determine an address.” The Miami-Dade Sheriff’s Office has, per 404 Media, “access to a custom model specifically trained for Miami-Dade County.”
Who Has Bought It, and The People Involved
The two publicly named buyers are the LAPD and the Miami-Dade Sheriff’s Office (MDSO). On the record, the Miami-Dade response was modest. From MDSO’s Public Affairs Office, Joseph R. Peguero Rivera told 404 Media: “To date, use of GeoSpy has been limited and largely exploratory. While it has been reviewed in a small number of cases, it has not resulted in any significant investigative breakthroughs or arrests. No case outcomes were driven solely or primarily by information generated by the tool.” No LAPD statement was published in the piece.
The history of access is also shorter than the names suggest. In January 2025, 404 Media first wrote about GeoSpy, and at the time it was “available to essentially anyone.” Some users in the company’s Discord asked for help stalking women. Graylark restricted access to “only government agencies and enterprise users” one day after 404 Media reached out. That restriction stayed. Heinen told 404 Media that Alexandr Wang, now head of AI at Meta, “was an angel investor in Graylark.” Wang did not respond to a request for comment. Heinen framed the product around a narrower use case: “For investigators working trafficking and exploitation cases, that connection can turn an unidentified room into a location lead they can verify and pursue.”
What The Listing Sites Say
Airbnb, Zillow, and Vrbo all reject the practice in their own terms. Airbnb told 404 Media: “Protecting our community’s privacy is important to us - that’s why location metadata is excluded from listing photos, hosts are given the option to show only an approximate location of their listing, and a home’s address is shared with a guest only after a reservation is confirmed. We also have technical safeguards in place to try to limit automated data collection from our site.” Airbnb added that it “has no relationship with Graylark, that its terms of service prohibit scraping, and that the company is reviewing this case.” Zillow said “scraping data is against its terms of use, and when necessary it pursues legal avenues.” Vrbo “did not respond to multiple requests for comment.”
In a companion piece the same day, 404 Media noted that the same Raven pipeline also turns Airbnb, Zillow, and other short-term-rental listings into a passive surveillance dataset: pull a photo of a room, get a likely match, and the rental listing acts as the address. The story did not state whether any warrants were involved.
What This Means
The shift is that the threat model for an ordinary interior shot has changed shape. Posting a photo of your kitchen in a tweet, sharing it on a chat group, sending it to a co-author, or letting a stranger photograph a room at an open house is enough to expose your address to anyone who can run the photo through Raven. Federal judges have now ruled that warrantless searches of mass-surveillance infrastructure like Flock’s license-plate-reader network can violate the Fourth Amendment, and Congress has begun moving on bills aimed at Flock. There is no comparable record on a property AI tool that returns a specific address from a single interior photo. The closest legal anchor on the product side is Graylark’s own terms, the listing platforms’ terms-of-service prohibitions on scraping, and the company’s stated reliance on warrantless review in a “small number of cases.”
For a reader, the practical defenses are limited. EXIF stripping, screenshotting, and avoiding GPS metadata do nothing - Raven does not use them. Posting only heavily modified or staged interior shots, or keeping a recognizable interior off social media entirely, are the only moves the tool itself suggests.
The bigger issue is structural. The data Raven matches against is the public listing data Airbnb, Vrbo, and Zillow already host. The AI is not creating a new dataset; it is matching one photo against the millions already there, and it is sold to police with no public warrant or logging requirement. The same pattern - AI linking what looks anonymous to what is not - has already shown up in deanonymization research against pseudonymous online accounts. Heinen’s stated use case is “trafficking and exploitation.” Miami-Dade’s stated record is “no significant investigative breakthroughs or arrests” from the tool. Those two facts sit in the same paragraph.
The Bottom Line
A single interior photo, no metadata required, is now enough to identify a specific home to law enforcement. The companies selling the tool, the platforms whose data the tool matches against, and the police departments buying access are all on the public record. The legal and warrant framework around the tool is not.