AI Model Uncovers Hidden Security Flaws in Epic's Patient Portal That Eluded Human Reviewers for Years

A cutting-edge artificial intelligence model has exposed critical security vulnerabilities in Epic Systems' widely-used MyChart patient portal that conventional security reviews failed to detect for years, prompting the healthcare software giant to pause new product development for approximately six weeks to address the flaws.

The vulnerabilities were discovered by Anthropic's unreleased Mythos AI model through Project Glasswing, a defensive security program that has identified more than 10,000 high- or critical-severity vulnerabilities across approximately 50 partner organizations in its first month alone. The flaws in MyChart, which supports more than 320 million patient records across U.S. hospitals and doctors' offices, allowed untraceable access to patient data—a discovery that Epic founder and CEO Judy Faulkner confirmed to Modern Healthcare required moving engineers off new product work to remediate.

A New Paradigm in Healthcare Cybersecurity

The discovery represents a fundamental shift in how healthcare organizations must approach security. Mythos demonstrated capabilities that far exceed traditional automated testing, finding a 27-year-old flaw in OpenBSD operating system and a 16-year-old flaw in FFmpeg video software that automated testing had encountered 5 million times without detection.

Seth Martin, Epic's security lead, confirmed the company's participation in Project Glasswing at an August user group meeting and warned health system IT teams to expect a "higher-than-usual number of urgent security fixes." While Mythos did not determine whether the flaws could be used to alter records without detection, the risk was deemed high enough to warrant immediate fixes.

The urgency extends beyond Epic. Anthropic CEO Dario Amodei stated that organizations have just 6-12 months to fix vulnerabilities before other AI models match Mythos capabilities—potentially including those in the hands of malicious actors.

The Patching Bottleneck

Project Glasswing's findings reveal that security progress is now bottlenecked not by discovery speed, but by verification, disclosure, and patching capacity. Of 530 high- or critical-severity bugs disclosed to open-source maintainers through the program, only 75 had been patched at the time of reporting, with an average fix time of approximately two weeks.

Cloudflare found 2,000 bugs through Glasswing, with 400 classified as high or critical severity. The banking sector has responded more rapidly, with banks now patching flaws in days instead of weeks using Mythos, though they still found several hundred to thousands of low- to moderate-ranked vulnerabilities.

Stakes for Healthcare

The implications are particularly acute for healthcare, where breaches cost an average of $6.64 million—the highest of any industry for the 13th consecutive year, according to IBM's 2026 Cost of a Data Breach Report. The 2024 Change Healthcare ransomware attack, which exposed health data on more than 192 million people, underscores the real-world consequences of security failures.

Project Glasswing, launched on April 7, includes partners such as Amazon Web Services, Apple, Cisco, CrowdStrike, Google, JPMorgan Chase, and Microsoft. The program's rapid identification of thousands of critical vulnerabilities suggests that healthcare organizations relying on conventional security testing may be operating with a false sense of security.

For Epic's customers, the incident means adapting to a new operational reality: rapid patch deployment cycles that may strain IT resources already managing complex EHR environments. The discovery that years of security reviews missed critical flaws raises broader questions about vulnerability assessment protocols across all healthcare IT systems.

Sources

1. Epic's AI Security Test Exposes Untraceable Patient Data Access — PYMNTS.com