Koi Security's AI-Assisted Threat Report Allegedly Led to Blocking of MeetingTV Domains

MeetingTV alleged that Koi Security's AI-assisted Wings platform wrongly linked its domain to China-linked malicious infrastructure in a December 2025 threat report. Security vendors and network providers then reportedly blocked MeetingTV's services. Koi reportedly later removed the domain reference after stating that further validation found no supporting connection.

Risk classification

• Primary risk domain: 3 Misinformation
• Primary risk subdomain: 3.1 False or misleading information

The Wings AI system generated a false threat intelligence report containing hallucinated facts that linked MeetingTV to cybercriminals, leading to material business harm.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The AI system failed to perform reliably by hallucinating a non-existent browser extension and making erroneous correlations.
• 5.1 Overreliance and unsafe use: Koi Security exhibited unsupervised reliance on the AI platform's outputs, publishing them as facts without adequate human verification.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The Wings AI system hallucinated a connection during post-deployment threat analysis, which was unintentionally published as fact by Koi Security.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The Wings platform generated threat intelligence reports, which constitutes AI-generated content. Under the EU AI Act, systems generating content have transparency obligations to ensure users are aware the content is AI-generated.

AI system and alleged parties

• AI system: Wings analytical platform
• AI purpose: Threat Detection; Technical Text Generation
• Behaviour type: Assistant
• Alleged developer: Koi Security, Cybersecurity firms
• Alleged deployer: Koi Security, Cybersecurity firms
• Alleged harmed parties: MeetingTV, Epistemic integrity, Companies

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Minor
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Epistemic

Reported: Yes, the report explicitly describes epistemic harm where an AI-driven threat intelligence report falsely accused MeetingTV of criminal conduct based on hallucinated findings.

Directly caused: The Wings platform generated erroneous correlations and a fabricated technical 'pivot' (the 'Twitter X Video Downloader' extension), which was published as fact, misleading security vendors globally.

Indirectly caused: Security companies and service providers globally blocked MeetingTV's domains based on this false information, and other LLMs began repeating the false claim that MeetingTV works with Chinese cybercriminals.

Inferred additional harm: The false accusation is permanently ingested into other LLMs and search indexes, causing long-term reputational damage that is extremely difficult to correct.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Prioritizing Speed Over Safety: Management published the report quickly without thorough human review.
• Lack of Accountability: No clear framework existed to manage risks of AI-driven false positives.

Technology

• LLM Hallucination: The Wings platform hallucinated a non-existent browser extension.
• Erroneous Correlation: The AI platform generated false connections to Chinese cybercriminals.

Data Inputs

• Unverified Threat Data: The analytical platform processed unverified technical indicators.

Human Factors

• Overreliance on AI: Researchers trusted AI-generated intelligence without manual verification.
• Lack of Contact with Subject: Koi failed to contact MeetingTV to verify details before publication.

Process and Methods

• Inadequate Verification Process: No robust process existed to double-check AI-generated threat reports.
• Flawed Redress Process: The mechanism for correcting false positives and unblocking is inefficient.

Regulatory Environment

• Absence of AI Regulations: No industry regulations govern the use of AI in threat intelligence.

Information quality

• Classification confidence: Medium
• Reason for confidence: While the lawsuit strongly alleges that the false threat report was the direct result of unsupervised reliance on the 'Wings' AI platform, the reports note that there is no direct public evidence yet proving the AI generated the erroneous findings, and it remains possible that human researchers made the error. However, the circumstantial evidence and the startup's claims point heavily to AI hallucination.
• Ambiguities identified: Whether the false correlations and the non-existent 'Twitter X Video Downloader' extension were generated by the Wings AI platform or by human researchers at Koi Security.
• Alternative interpretations: The erroneous threat report could have been the result of human error, poor manual research, or a non-AI software bug rather than an LLM hallucination.
• Missing information: Direct evidence or technical logs from Koi Security confirming whether the 'Wings' AI platform was used to generate the specific false findings and the extent of human review before publication.

An AI-driven threat intelligence platform hallucinated findings that falsely linked a videoconferencing startup to Chinese cybercriminals, leading to global domain blocking. This incident highlights the national security risks of unsupervised reliance on AI for threat intelligence, which can cause severe, unintended economic disruption to private enterprises.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Alleged perpetrator: Koi Security

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic concern regarding AI-generated threat intelligence reliability rather than an active, imminent national security crisis.
• Autonomy: Human-supervised. The Wings platform generated the report autonomously, but human analysts at Koi Security ultimately published it, demonstrating a failure in human-supervised workflows.
• Novelty: Evolved capability. Represents an evolved threat where LLM hallucinations in automated analytical platforms generate highly convincing but false threat intelligence, leading to real-world infrastructure blocking.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or human safety was threatened or compromised.
• Information security: Minor. While the AI-generated report falsely alleged a Chinese corporate espionage link, it represents a commercial threat intelligence error rather than state-sponsored information warfare.
• Sovereignty: Negligible. No impact on state authority, electoral systems, or core government operations was observed.
• Economic security: Minor. Severe commercial harm was caused to a single private startup, but there is no broader threat to national economic stability or strategic industries.
• Societal stability: Negligible. No threat to social cohesion, civil liberties, or population-scale safety was identified in this incident.