Epic Pauses Product Development to Address Security Vulnerabilities in MyChart
Medical records software provider Epic has temporarily halted product development for six weeks while addressing security vulnerabilities discovered using Anthropic’s AI cybersecurity model Mythos. The bugs could allow unauthorized access to patient data without being logged, raising concerns about potential breaches across the U.S., where MyChart maintains over 320 million medical records. Epic's chief security officer noted that some customer configurations of its software may be at risk but did not confirm if attackers could alter records undetected. The company emphasized it does not store patient data directly, as this is managed by healthcare providers using Epic’s systems. However, a vulnerability unknown to the firm could still compromise multiple installations. The move highlights growing concerns over AI's role in identifying and exploiting security flaws quickly, increasing risks for sensitive health data. Recent high-profile breaches at companies like Change Healthcare have shown how valuable medical records are on the black market, with ransomware attacks leading to large-scale data thefts affecting tens of millions.
Topics: AI in security testing cybersecurity healthcare data protection software development pause