Koi Security's AI threat report allegedly falsely linked MeetingTV to Chinese espionage
MeetingTV sued Palo Alto Networks and Koi Security alleging that Koi's threat report, generated using its Wings AI platform, falsely linked the video conferencing startup to a Chinese espionage operation through hallucinated findings. The report led global security vendors to block MeetingTV's domains and services, and the company struggled to get them unblocked despite a partial retraction.
What happened
On December 30, Koi Security published a threat research blog post that linked MeetingTV, a video conferencing and webinar startup, to a Chinese corporate espionage operation called DarkSpectre. According to the lawsuit, Koi used its proprietary 'Wings' analytical platform to generate the report, which hallucinated findings falsely attributing MeetingTV's Zoomcorder product to criminal infrastructure.
As a result of the report, security companies and service providers globally blocked MeetingTV's domains and services, labeling them as malware and command-and-control infrastructure. MeetingTV's CEO Michael Robertson stated that Koi did not contact the company before publishing the report. Koi updated the report on February 12 and removed one MeetingTV domain, stating there was no evidence connecting the domain to malicious infrastructure.
Reported impact
MeetingTV reports that its domains remain blocked across multiple security products and services. CEO Michael Robertson stated that getting unblocked has been laborious and often impossible due to the hundreds of security lists in circulation and unclear vendor usage patterns.
Index analysis
The lawsuit raises questions about how companies use AI in threat intelligence and responsibility for the impact of security research. MeetingTV alleges the false attributions were the direct product of Koi's unsupervised reliance on the Wings platform, which generated erroneous correlations between MeetingTV's business and the alleged cybercriminal actor.
Governance controls
Palo Alto Networks, which acquired Koi in April, stated it believes Koi's research reflects its commitment to identifying threats and expects the dispute will be resolved through the legal process. The company declined to answer specific questions about Koi's use of AI or the findings in the report.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.