Epic's AI Security Test Showed Patient Data Could Be Accessed Without Leaving a Trace
Security tests revealed configuration vulnerabilities in the MyChart software, which houses millions of patient records in the U.S.
Epic Systems discovered security vulnerabilities using Anthropic's AI model that could allow patient records to be accessed without leaving an audit trail in the MyChart software.
Security Vulnerability in MyChart Software
Reviews conducted by Epic Systems determined that certain MyChart configurations contained flaws allowing patient records to be viewed without leaving any audit trail.
Testing Process with Claude Mythos Model
According to statements by Chief Security Officer Stirling Martin, these vulnerabilities were discovered during tests conducted using Anthropic's unreleased Claude Mythos artificial intelligence model.
Epic included this model in the testing process to see how attackers could use open-source AI agents to access confidential data.
Emergency Work by Engineers
To close the security vulnerabilities, engineers were pulled away from normal product development processes and worked intensively for about six weeks to resolve these flaws.
Project Glasswing Program
Epic Systems is among the participants in Anthropic's Project Glasswing initiative, which provides selected organizations with access to the unreleased Mythos model for defensive security research.