MeetingTV sues Palo Alto Networks over AI-generated cybersecurity report falsely linking it to espionage
MeetingTV sued Palo Alto Networks and its subsidiary Koi Security alleging that an AI-generated cybersecurity report falsely linked the videoconferencing startup to a Chinese espionage operation, causing widespread infrastructure blocks and business harm. Koi published the report without adequate human verification, according to MeetingTV's complaint, and the company's partial correction did not resolve the resulting blocks.
What happened
Koi Security published a cybersecurity threat report on December 30 that linked MeetingTV's domains and infrastructure to a Chinese cybercrime operation called DarkSpectre and a browser extension campaign called Zoom Stealer. MeetingTV alleges the report relied on AI-generated outputs that wrongly connected its infrastructure to the threat actors.
MeetingTV noted an inconsistency in the report: Koi cited a browser extension as evidence but that extension did not appear among the IDs listed in the report. MeetingTV claims this gap indicates an AI-generated error.
Reported impact
MeetingTV's infrastructure was blocked across multiple security products following the report's publication. According to MeetingTV CEO Michael Robertson, removal has been slow and often unsuccessful.
The false linkage caused widespread technical blocks, reputational harm and lost business for MeetingTV.
Index analysis
MeetingTV alleges that Koi treated AI-generated output as definitive findings rather than leads requiring further investigation, and failed to conduct basic attribution checks or contact MeetingTV before publication.
No clear rule appears to require human review of AI-generated threat reports before publication.
Governance controls
Koi updated the report on February 12, removing one MeetingTV domain and stating it found no evidence tying it to the threat actor group. However, MeetingTV's infrastructure remained blocked across multiple security products.
Palo Alto Networks acquired Koi in April and was added as a defendant in May. Palo Alto responded that the report reflected protected analytical judgments rather than false statements of fact.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.