This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
MeetingTV is suing Koi Security and Palo Alto Networks, alleging that an AI-driven threat intelligence report falsely linked its videoconferencing infrastructure to a Chinese cybercriminal operation. The startup claims the AI platform 'Wings' hallucinated findings, resulting in global domain blocking by security vendors that has severely impacted its business operations. Despite Koi later removing some references, MeetingTV reports that its services remain blacklisted across multiple platforms.
MeetingTV alleged that Koi Security's AI-assisted Wings platform wrongly linked its domain to China-linked malicious infrastructure in a December 2025 threat report. Security vendors and network providers then reportedly blocked MeetingTV's services. Koi reportedly later removed the domain reference after stating that further validation found no supporting connection.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that inadvertently generate or spread incorrect or deceptive information, which can lead to inaccurate beliefs in users and undermine their autonomy. Humans that make decisions based on false beliefs can experience physical, emotional or material harms
Also classified as
Koi Security exhibited unsupervised reliance on the AI platform's outputs, publishing them as facts without adequate human verification.
The AI system failed to perform reliably by hallucinating a non-existent browser extension and making erroneous correlations.
The Wings AI system generated a false threat intelligence report containing hallucinated facts that linked MeetingTV to cybercriminals, leading to material business harm.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The Wings AI system hallucinated a connection during post-deployment threat analysis, which was unintentionally published as fact by Koi Security.
Added categories peak at 2: Minor (Epistemic Harm, Direct)
An AI-driven threat intelligence platform hallucinated findings that falsely linked a videoconferencing startup to Chinese cybercriminals, leading to global domain blocking. This incident highlights the national security risks of unsupervised reliance on AI for threat intelligence, which can cause severe, unintended economic disruption to private enterprises.
The Wings platform is described as an analytical platform used by researchers to analyze software and generate threat intelligence. This fits the Assistant profile as it is designed to augment human threat-intelligence capabilities but requires human validation and oversight, which was reportedly bypassed in this incident.
Limited Risk: The Wings platform generated threat intelligence reports, which constitutes AI-generated content. Under the EU AI Act, systems generating content have transparency obligations to ensure users are aware the content is AI-generated.
The Wings platform's primary function is threat intelligence and analyzing software/digital tools to identify security threats.
While the lawsuit strongly alleges that the false threat report was the direct result of unsupervised reliance on the 'Wings' AI platform, the reports note that there is no direct public evidence yet proving the AI generated the erroneous findings, and it remains possible that human researchers made the error. However, the circumstantial evidence and the startup's claims point heavily to AI hallucination.
The erroneous threat report could have been the result of human error, poor manual research, or a non-AI software bug rather than an LLM hallucination.
Direct evidence or technical logs from Koi Security confirming whether the 'Wings' AI platform was used to generate the specific false findings and the extent of human review before publication.
Technology
LLM Hallucination
The Wings platform hallucinated a non-existent browser extension.
Erroneous Correlation
The AI platform generated false connections to Chinese cybercriminals.
Data Inputs
Unverified Threat Data
The analytical platform processed unverified technical indicators.
Human Factors
Overreliance on AI
Researchers trusted AI-generated intelligence without manual verification.
Lack of Contact with Subject
Koi failed to contact MeetingTV to verify details before publication.
Process and Methods
Inadequate Verification Process
No robust process existed to double-check AI-generated threat reports.
Flawed Redress Process
The mechanism for correcting false positives and unblocking is inefficient.
Management
Prioritizing Speed Over Safety
Management published the report quickly without thorough human review.
Lack of Accountability
No clear framework existed to manage risks of AI-driven false positives.
Regulatory Environment
Absence of AI Regulations
No industry regulations govern the use of AI in threat intelligence.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
