Epic Systems Uses AI to Patch Flaws Threatening 325 Million Patient Records

Q: Epic used Anthropic’s AI to hunt a hidden flaw in records for 325 million patients—but what exactly did the system find?

Epic has not publicly described the flaw in technical detail. What it has said is that Anthropic’s Claude Mythos helped uncover an “unusual” weakness that could have given attackers hidden access to patient records, including by probing whether open-source AI tools could be abused to reach confidential data. The company’s public statements point to an AI-assisted red-team exercise, not a known breach. Judy Faulkner said the issue was serious enough that Epic engineers spent about six weeks focused mainly on security repairs, slowing some product work while they closed the gaps. Epic and Anthropic have framed the effort as part of Project Glasswing, which uses advanced models for defensive security research and vulnerability discovery. What is known, then, is the class of problem rather than the exact bug: a stealthy access path in Epic’s records environment that raised concern about unauthorized entry into a system holding data on roughly 325 million patients. Epic has not said whether it involved authentication, permissions, interfaces, integrations, or some other attack path, and there is no indication in the reporting that patient data was actually compromised. So the direct answer is that the AI found a serious but undisclosed security vulnerability capable of enabling concealed access to health records. Epic has shared the existence and significance of the flaw, but not the technical specifics of what Claude Mythos identified.

3 articles · Updated · The New York Times · Sep 30

Epic Systems said it is deploying AI tools to find and fix security weaknesses that could let hackers gain undetectable access to patient health data.
Anthropic’s Claude Mythos is being used to stress-test Epic’s software and probe how attackers might use open-source AI agents to unlock confidential records.
The urgency pushed Epic to slow development on some product lines while engineers spent six weeks focused largely on closing the gaps, CEO Judy Faulkner said.
The threat is especially significant because Epic is the largest U.S. medical-records vendor, serving thousands of hospitals and doctors’ offices and holding records for 325 million patients worldwide.