A cybersecurity lawsuit in California is turning a false positive into a much bigger question for the security industry: what happens when AI-assisted threat intelligence flags a real company as suspicious, and the rest of the ecosystem treats that signal as fact?

MeetingTV, a small webinar platform founded by entrepreneur Michael Robertson, has sued Koi Security and Palo Alto Networks after a December 2025 Koi report linked the company’s domain to infrastructure allegedly tied to a Chinese hacking campaign. MeetingTV says the claim was wrong, spread through enterprise security systems, and caused lasting damage as vendors blocked or warned against its service.

The dispute centers on a Koi Security investigation called “DarkSpectre,” published December 30, 2025. The report described a large operation involving browser extensions, domains, and other indicators of compromise. Meetingtv[.]us appeared in that list, placing the startup’s core domain alongside infrastructure Koi associated with malicious activity.

Koi later reversed course. In a February 12 update, the company said it had revalidated the domain and found “no evidence that this domain is connected,” according to Koi Security. The domain was removed from the report. But MeetingTV argues the correction came too late.

By then, the indicator had already traveled through the security supply chain. MeetingTV says enterprise security tools continued to block or flag its infrastructure, making it harder to reach customers and repair its reputation. Axios reported that scans reviewed in early June showed some vendors had reduced the severity of their labels, but the cleanup remained uneven.

The case now sits at the intersection of AI, cybersecurity research, and legal accountability. MeetingTV filed its initial complaint on March 18 and followed with an amended complaint on May 13 that added Palo Alto Networks as a defendant after the security giant closed its acquisition of Koi on April 14. Koi has moved to dismiss the original complaint and has argued that its reporting is protected speech.

MeetingTV sees it differently. The company says the report functioned as a public warning label that caused real business harm, regardless of whether Koi accused MeetingTV itself of being a threat actor. The startup has also asked for early discovery to preserve and examine evidence about how Koi reached its conclusions and how those conclusions spread.

The AI angle is what makes the case especially timely. Koi’s DarkSpectre report described the use of its Wings engine, which relies on static analysis and agentic AI to examine browser extensions and surface suspicious indicators quickly. That kind of automation is becoming central to modern threat intelligence, where analysts must process huge volumes of code, infrastructure, behavior, and telemetry.

But speed cuts both ways. A single indicator of compromise can be published in minutes, ingested into feeds, copied into blocklists, and enforced across enterprise products before the affected company even knows what happened. Removing that label can take months.

Eljan Mahammadli, head of AI provenance at Polygraf AI, said the most important issue is not whether a model definitively produced the disputed finding, but whether the research process can be audited after the fact.

“What stands out to me here isn't the hallucination accusation, because the filings don't actually prove a model wrote that finding, and that uncertainty is the whole problem. When threat intelligence ships without a record of how each conclusion was reached, nobody can audit it afterward, not the researchers and definitely not the company on the receiving end.

A bad attribution takes seconds to publish and spreads across hundreds of blocklists almost immediately, but reversing it takes months, if it happens at all. That asymmetry is what the industry should be worried about, whether or not AI touched the report. If we're going to let models do attribution work, the output has to carry its own evidence chain, so a finding can be contested on the record instead of in court.”

The lawsuit also lands at an awkward moment for Palo Alto Networks, which bought Koi to expand its agentic endpoint security capabilities. MeetingTV’s claims now raise a pointed question for the broader market: how should security companies validate AI-assisted conclusions before those conclusions become machine-readable warnings that customers act on automatically?

Gidi Cohen, CEO and co-founder of Bonfy.AI, said the case should force security teams to rethink how AI-generated or AI-enriched intelligence is governed.

“The MeetingTV lawsuit should be a wake-up call: when threat intelligence is generated or enriched by AI, the stakes are no longer just about technical accuracy—they’re about business continuity and reputational harm for real companies caught in the blast radius.

This case highlights three responsibilities that security leaders and researchers can’t ignore:

First, AI-assisted analysis does not change the obligation to validate findings with human judgment, especially when those findings can lead to long-term blocking of a legitimate service. “Protected speech” in research doesn’t absolve us from doing the hard work of verification.

Second, the industry needs a clearer accountability model for distributed threat intelligence. Once a label is published, it is replicated across hundreds of feeds and controls, yet there is still no standard process—or SLA—for correcting mistakes and propagating those fixes downstream.

Third, we have to treat false positives in AI-era threat intel as real incidents, not minor collateral damage. For a SaaS business, being silently tagged as malicious can have the same practical impact as a sustained DDoS or a major outage, and our governance models should reflect that.

Regardless of the legal outcome, the lesson is straightforward: if we use AI in security research, we must pair it with rigorous review, transparent methodology, and fast, industry-wide remediation when we get it wrong. Without that, AI doesn’t just help us find threats—it risks becoming one.”

The legal question is still unresolved. Koi is expected to respond to the amended complaint, and MeetingTV is pressing for early discovery that could expose how the original indicator was generated, reviewed, published, and corrected.

For cybersecurity vendors, the case is a warning about the hidden fragility of automated intelligence pipelines. AI can help researchers move faster against real campaigns, but when it gets attribution wrong, the blast radius can be immediate and difficult to reverse. In an industry built around rapid detection, MeetingTV’s lawsuit asks whether there is enough infrastructure for rapid correction.