Key Takeaways
- Epic Systems discovered security flaws in certain MyChart configurations that could allow unauthorized viewing of patient records without leaving an audit‑trail trace.
- The flaws were uncovered using Anthropic’s unreleased Claude Mythos AI model as part of the Project Glasswing defensive‑security program.
- Epic temporarily redirected engineers from new‑product work to patch the issues, estimating a six‑week remediation effort while affirming that its broader AI and interoperability roadmap remains on schedule.
- Although Mythos did not determine whether the flaws could be used to alter records silently, Epic’s chief security officer judged the risk high enough to act immediately.
- Across the Glasswing consortium, thousands of high‑ or critical‑severity vulnerabilities were found in the first month, but patching speed—not discovery speed—has become the bottleneck for defenders.
- Industries such as banking are already accelerating patch cycles (from weeks to days) in response to the volume of AI‑identified flaws, giving organizations a six‑to‑12‑month window to remediate before rival AI tools catch up.
Epic Uncovers Hidden MyChart Vulnerabilities with AI Assistance
Epic Systems identified configuration weaknesses in its MyChart patient‑portal that could let an intruder view confidential health records without the access being logged in an audit trail. Stirling Martin, Epic’s chief security officer, told The New York Times that the company “found them by testing its software with Anthropic’s Claude Mythos.” Martin added that the goal was to see “how attackers might use open‑source artificial intelligence agents to reach confidential records.” The discovery underscores how modern AI can surface issues that years of manual review missed.
Engineers Re‑Allocated to Address the Flaws
In response to the findings, Epic pulled engineers off new‑product work to focus on remediation. Judy Faulkner, Epic’s founder and CEO, told Modern Healthcare that the work would “likely take about six weeks.” Despite the diversion, Faulkner reassured stakeholders that Epic’s AI and interoperability initiatives remained on track, a point later echoed by Fierce Healthcare reporting that the company said its strategic plans were unchanged.
Mythos Did Not Test for Silent Record Alteration
While Mythos proved effective at spotting the viewing‑only flaw, it did not determine whether the same weaknesses could be exploited to alter patient data without detection. Martin noted that “the risk was high enough to fix,” even absent certainty about silent modification. MyChart supports more than 320 million patient records across U.S. hospitals and physicians’ offices, and Epic emphasizes that providers, not Epic, retain control of that data.
Project Glasswing: Early Access to Unreleased AI for Defense
Epic’s testing was conducted under Anthropic’s Project Glasswing, a program that grants selected organizations early access to the unreleased Claude Mythos model for defensive security work. Martin confirmed Epic’s participation at the company’s August user‑group meeting, telling health‑system IT teams to expect a “higher‑than‑usual number of urgent security fixes.” Fierce Healthcare reported that Martin urged teams to prepare for an accelerated patch cadence.
Anthropic Launches Glasswing with Industry Heavyweights
Anthropic officially launched Glasswing on April 7, recruiting partners such as Amazon Web Services, Apple, Cisco, CrowdStrike, Google, JPMorgan Chase, and Microsoft. The initiative has already yielded striking results: Mythos uncovered a 27‑year‑old vulnerability in the OpenBSD operating system and a 16‑year‑old flaw in FFmpeg video software that had survived five million automated test runs without detection. These findings illustrate the model’s ability to resurrect long‑standing bugs that conventional tools overlook.
Healthcare Breach Costs Underscore Stakes
The discovery comes amid a backdrop of severe financial impact from health‑care data breaches. IBM’s 2026 Cost of a Data Breach Report found that healthcare breaches cost an average of $6.64 million, the highest of any industry for the thirteenth consecutive year. Moreover, a 2024 ransomware attack on Change Healthcare—a UnitedHealth unit—exposed health data on more than 192 million people, according to TechCrunch. Such figures heighten the urgency for vendors like Epic to shore up defenses before attackers can exploit newly identified gaps.
Patching Becomes the Bottleneck in AI‑Driven Discovery
Despite Mythos’ rapid vulnerability detection, the pace of remediation lags behind. In Glasswing’s first month, roughly 50 partners uncovered more than 10,000 high‑ or critical‑severity flaws. Cloudflare alone reported 2,000 bugs, of which 400 were high or critical. Of the 530 high‑ or critical‑severity issues Anthropic disclosed to open‑source maintainers, only 75 had been patched at the time of reporting, with an average fix time of about two weeks. Anthropic concluded that “security progress is now limited by how fast defenders can verify, disclose and patch flaws, not how fast they find them.”
Banks Adapt to Faster Patch Cycles
Financial institutions are feeling the same pressure. Mythos has identified several hundred to thousands of low‑ to moderate‑ranked vulnerabilities in banks’ technology stacks, prompting many to shift from week‑long to day‑long patch windows. PYMNTS reported that Anthropic CEO Dario Amodei warned organizations they have six to 12 months to remediate flaws before other AI models reach Mythos’ capability level, after which the advantage of early detection would diminish.
Few Companies Halt Development for Security—Except Epic
Historically, most firms prioritize feature releases over security fixes, but Epic’s decision to pause new‑product work for roughly six weeks marks a notable exception. As Martin explained, each Epic fix will ultimately land on the hospital IT teams that operate MyChart—the same groups he advised to brace for “more urgent security updates.” This shift places a direct operational burden on frontline health‑system administrators, who must balance ongoing clinical demands with the need to apply rapid patches.
Looking Ahead: The Race Between AI Finds and Human Fixes
The episode illustrates a emerging dynamic: AI can now surface vulnerabilities at a scale and speed that outpaces traditional remediation pipelines. While Epic’s proactive six‑week pause demonstrates a commitment to patient‑data safety, the broader industry must accelerate verification, disclosure, and patching processes to keep up. As AI models like Mythos become more widely available, the window for defenders to act will shrink, making rapid, coordinated response not just a best practice but a necessity for protecting sensitive health information.
https://www.pymnts.com/news/artificial-intelligence/2026/epics-ai-security-test-exposes-untraceable-patient-data-access/