MeetingTV Files Lawsuit After Being Falsely Linked to Chinese Espionage Operation
Video conferencing company MeetingTV has filed a lawsuit against Koi Security and its parent company Palo Alto Networks, alleging that an AI-generated cybersecurity threat report published by Koi Security falsely linked MeetingTV’s infrastructure to a Chinese cyber espionage operation. The case raises significant legal questions about accountability for AI-generated findings in the cybersecurity intelligence space.
The disputed report, titled “DarkSpectre: Unmasking the Threat Actor Behind 8.8 Million Infected Browsers,” was originally published on December 30, 2025, months before Palo Alto Networks completed its acquisition of Koi Security in April 2026. According to MeetingTV, the report falsely accused the company of participating in criminal activities, including serving as public-facing infrastructure for a Chinese cybercriminal organization conducting large-scale malware operations and corporate espionage.
AI Hallucination Allegations at the Core of the Dispute
MeetingTV alleges that the erroneous conclusions in the report resulted from AI-generated analysis published without adequate human verification. The lawsuit specifically points to Koi Security’s proprietary analytical platform, known as Wings, which uses artificial intelligence to identify relationships between cybersecurity events. The complaint claims that the AI generated incorrect correlations linking MeetingTV to a threat actor identified as DarkSpectre, and that these connections were not supported by verifiable technical evidence.
The lawsuit characterizes this as reckless publication of AI-generated findings without sufficient independent validation. If these allegations are proven in court, the case could establish an important legal precedent regarding liability for AI-assisted cybersecurity reporting.
The Browser Extension That May Not Exist
One of the most striking claims in the lawsuit concerns a browser extension that Koi Security identified as the critical technical link connecting MeetingTV’s Zoomcorder service to the alleged cyber campaign. According to MeetingTV, Koi Security repeatedly cited a browser extension called “Twitter X Video Downloader” as the foundational element connecting multiple threat actors. MeetingTV disputes the existence of this extension altogether and states that it repeatedly requested supporting evidence from Koi Security but never received documentation demonstrating the software actually existed.
If such a foundational element cannot be independently verified, MeetingTV argues that the broader investigative conclusions become unreliable. This allegation highlights one of the central risks of AI-assisted investigations: incorrect assumptions early in the analytical process can propagate through an entire assessment, producing conclusions that appear well-supported but rest on fabricated premises.
Businesses Consequences and Ongoing Blocking
MeetingTV states that publication of the report produced immediate and severe operational consequences. Multiple cybersecurity vendors and internet service providers classified the company’s infrastructure as malware and command-and-control infrastructure, directly blocking customers from accessing MeetingTV’s services. Founder and CEO Michael Robertson said the company only became aware of the report after trying to determine why various security providers were blocking access. Koi Security did not contact MeetingTV before publication to verify its findings, nor did it communicate with the company afterward, according to the lawsuit.
Robertson further claims that some providers, including Verizon and Palo Alto Networks, continue blocking MeetingTV services, prolonging the company’s operational challenges. Although Koi Security later updated its report to state there was no evidence connecting MeetingTV’s domain to malicious infrastructure, MeetingTV contends this correction came too late, as the original unverified findings had already been widely disseminated across threat intelligence platforms.
Broader Implications for AI in Cybersecurity
The case underscores a growing tension in the cybersecurity industry. Threat intelligence teams increasingly rely on AI and large language models to process millions of malware samples, massive telemetry datasets, and infrastructure relationships. AI significantly accelerates correlation and pattern recognition, but these systems remain probabilistic rather than deterministic. Large language models generate responses by predicting likely outputs based on learned patterns rather than independently verifying factual accuracy.
Cybersecurity experts generally view AI as an analytical assistant rather than a replacement for experienced investigators. Human analysts remain responsible for validating evidence, confirming technical indicators, reviewing conclusions, eliminating false positives, and ensuring appropriate attribution before publication. The MeetingTV lawsuit illustrates what can happen when these safeguards are bypassed.
Palo Alto Networks has acknowledged the lawsuit but stated that the disputed report was published before its acquisition of Koi Security was finalized. The company said it believes Koi’s cybersecurity research reflects its commitment to identifying cyber threats and expects the matter to be resolved through the legal process.
Source: CTech / Calcalist | 1950 AI
