Epic halts most product development after Anthropic AI flags MyChart security flaws, company says
Epic paused most product development after Anthropic’s cybersecurity model Mythos found security flaws that could allow outsiders to access MyChart patient records. The pause will likely last six weeks while Epic works to safeguard its products, Epic's founder Judy Faulkner told Modern Healthcare.
AI-assisted synthesis · Based on 4 independent reports from 5 outlets · Full text read from 1 of 4 reportsHow it's made
What happened
Key facts
- Judy Faulkner told Modern Healthcare the pause would likely last six weeks while work continues on safeguarding the company’s products (per TechCrunch).
- Epic’s MyChart software is used to maintain over 320 million patient records across hospitals and doctor’s offices in the United States (per TechCrunch, dealroom.co).
- Epic said it does not have access to customers’ medical data and that healthcare providers retain responsibility for that data (per TechCrunch).
- Epic has not disclosed the technical nature of the bugs identified after the Mythos deployment (per TechCrunch).
The brief
Epic Systems paused most product development after Anthropic’s cybersecurity model, Mythos, reportedly found security flaws in Epic’s MyChart software that could allow outsiders to access patient records.
Epic’s founder and chief executive, Judy Faulkner, told Modern Healthcare the company expects the pause to last about six weeks while engineers "safeguard" products and remediate the issues Anthropic’s model surfaced.
Epic’s chief security officer, Stirling Martin, told The New York Times that certain customer configurations of MyChart might let outsiders view patient records without leaving entries in the application’s logs, though Martin did not say whether the model confirmed those flaws had been exploited.
Epic’s public statements, as summarized in TechCrunch, say the company itself does not hold customers’ medical data and that responsibility for patient records remains with healthcare providers. TechCrunch’s account also notes Epic has not revealed technical details about the vulnerabilities Anthropic’s model identified.
MyChart is described in the TechCrunch report as the system that holds over 320 million patient records across U.S. hospitals and doctor’s offices, a scale that Epic and outside reporting underline as the immediate reason for the company-wide development pause.
Epic framed the action as a protective measure while work continues; the reporting does not include independent verification that outsiders accessed or altered records, nor does it provide a technical description of the bugs Anthropic’s tool flagged.
Why it matters
- Patients whose records are held in MyChart — reported as over 320 million people — face the concrete risk of unauthorized access via software vulnerabilities if those bugs exist and are exploitable.
- Healthcare providers bear operational responsibility for patient data under Epic’s account, meaning providers must remediate configurations or controls that Epic says could allow access without log entries.
- Epic’s six-week development pause, per Judy Faulkner, affects the company’s product rollout schedule and shifts engineering resources to security remediation, a documented short-term operational cost.
- Anthropic’s Mythos model identified the flaws, creating a documented interest for Anthropic and for customers using AI security tools to validate software configurations and detections.
What to watch next
- Whether Epic completes the stated safeguarding work and lifts the development pause within the six-week timeframe Judy Faulkner described.
- Whether Epic or any healthcare provider publicly discloses technical details of the vulnerabilities Anthropic’s Mythos model flagged.
- Whether any healthcare provider reports confirmed unauthorized access or alteration of MyChart records linked to the flagged flaws.
How it's being covered
Coverage analysisShow details5 source articles · 5 unique outlets · 4 distinct reportsCoverage mix: Center Only4 Center Where the outlets are based: US/Canada 60% · Europe 40%
- Coverage is currently concentrated among Center-rated outlets (4 of 4 rated sources); comparatively few Left or Right-rated outlets have published on the event.
One source is from a wire service (AP, Reuters, AFP or Bloomberg), whose reporting other outlets often republish.
How outlets' accounts compare
How we got here
The legal and regulatory framework governing electronic patient records in the United States traces to the Health Insurance Portability and Accountability Act (HIPAA), enacted in 1996.
The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted February 17, 2009, strengthened breach notification requirements and incentives for electronic health record adoption.
Original sources
5 articles from 5 outletsEvery story links to the reporting it was built from. How we choose sources
Spotted a factual error, a broken link or a misleading summary? Tell us.