Epic Pauses Development After AI Finds MyChart Security Flaws

Summary

As of October 2, 2026, Epic has paused most product development for a likely six weeks while securing MyChart after Anthropic’s frontier cybersecurity model Mythos uncovered undisclosed flaws. Founder and CEO Judy Faulkner described the effort as safeguarding. Chief security officer Stirling Martin said some customer configurations could let outsiders access records without generating intrusion logs. Mythos did not determine whether attackers could alter records undetected, but Martin said the risk warranted remediation.

MyChart supports over 320 million patient records at U.S. hospitals and doctors’ offices. Epic says providers, not Epic, control customer medical data, but an unknown flaw could compromise multiple affected systems nationwide. The rare development pause reflects concern that AI can accelerate vulnerability discovery and exploitation amid escalating healthcare extortion. A 2024 ransomware attack on Change Healthcare, UnitedHealth’s payments and billing business serving most Americans, exposed data on more than 192 million people and led to two payments to hackers. In 2026, thieves stole CareCloud medical records, millions of patient-data rows from pharmaceutical distributor McKesson, and an unspecified amount from U.K.-based Craneware, whose software operates across North America. The Department of Health and Human Services lists DentaQuest’s 15 million-person breach as 2026’s largest healthcare incident so far.