Palo Alto Networks and Koi Security sued over alleged AI error in cyber threat report MeetingTV claims a flawed intelligence classification led to global blocking of its services. A cybersecurity report intended to map Chinese-linked espionage activity has escalated into a legal dispute spanning Silicon Valley and Israel, after a U.S. startup alleged it was wrongly identified as part of a hostile network due to an artificial intelligence error. In March, U.S. media company MeetingTV filed a lawsuit in federal court in Southern California against cyber firm Koi Security, and its four Israeli founders, Amit Assaraf, Idan Dardikman, Tuval Admoni, and Gal Hachamov. Cybersecurity giant Palo Alto Networks, which acquired Koi in April for hundreds of millions of dollars, was added as a defendant in May 2026. At the center of the lawsuit is the claim that a flawed artificial intelligence system at the cybersecurity company caused the complete destruction of legitimate business activity due to what is known as “AI hallucination.” According to the complaint, at the end of December 2025, Koi Security published a threat intelligence report titled “DarkSpectre: Unmasking the Threat Actor Behind 8.8 Million Infected Browsers,” which examined espionage and cyber infrastructure linked to an attack group allegedly operating under Chinese state direction. As part of the report, Koi added the domain of MeetingTV to its IOC (Indicators of Compromise) list, effectively marking the company as part of a Chinese-linked espionage infrastructure. MeetingTV claims the classification was fundamentally incorrect and did not stem from traditional forensic investigation, but rather from an erroneous output generated by Koi’s proprietary AI system, “Wings.” The plaintiff alleges that Koi negligently published the findings without sufficient human oversight or verification. The consequences, according to the lawsuit, were immediate and severe. Once the report circulated in the cybersecurity community, security vendors, enterprise