Mythos, Anthropic's cybersecurity AI, finds an invisible flaw in MyChart that Epic missed for years

By Zendoric · October 3, 2026.

Epic Systems, the electronic health records vendor (the software that centralizes a patient's medical file) that dominates the US hospital market, halted nearly all of its product development for about six weeks. The reason, as its founder and chief executive, Judy Faulkner, revealed at Modern Healthcare's Leadership Summit: its security testing with Mythos — Anthropic's frontier cybersecurity model, deployed through a program called Project Glasswing — found that certain configurations of MyChart, its patient portal, allowed an outsider to look up medical records without leaving a trace in the audit log, the record that should flag any unauthorized access.

Put another way: no one would have known that someone had been inside. No alert, no entry in the system, nothing a hospital security team could review after the fact.

Epic's software holds the records of more than 320 million patients at hospitals and practices across the United States, as cited by TechCrunch. For a company of that size to halt its product roadmap for a month and a half is not a routine adjustment: it is a sign that something in the foundations was not where it should be.

Stirling Martin, Epic's chief security officer (CSO), added a more unsettling detail to The New York Times: the testing with Mythos also raised the possibility that an attacker could not only read but alter medical records, although — and this matters — the model itself never confirmed that such tampering was actually feasible in practice. Martin was blunt about the pace the new reality demands: "ultimately they have to be prepared to patch, patch and patch. The moment they think they are patching fast enough, they have to patch even faster".

It is worth underscoring something Epic itself clarifies: the company does not store its customers' data. It is the hospitals and practices that run the software on their own infrastructure, which explains why the flaw lived in "certain customer configurations" and not in the core product everyone uses alike, and why it could go unnoticed despite years of conventional audits and the regulatory compliance required in the US by HIPAA, the federal law governing health data privacy. Epic maintains, as reported by Fierce Healthcare, that the rest of its artificial intelligence agenda — with tools such as Agent Factory and EpicOps — is proceeding despite the security pause.

None of this is happening in a vacuum. Epic had already warned of a phishing campaign (fraudulent emails designed to steal credentials) that uses AI tools to generate more convincing messages aimed at MyChart users, as published by Modern Healthcare. The same wave of model capability that sharpens attacks is the one that, in this case, uncovered the hole before — as far as is known — anyone with worse intentions found it. Epic has not said whether the flaw was exploited before it was discovered, and by the very nature of the problem, access that leaves no trace, there may never be a definitive answer.

At Zendoric we have long pointed to cybersecurity as the most reliable gauge of AI's real near-term risk, precisely because that is where capability and threat advance in step. Mythos is the model Anthropic has built specifically for that terrain. Epic's case is the proof of concept for what that capability is good for when it is aimed inward: finding, before anyone else, the hole that years of conventional auditing missed.

That should not be read as a happy ending. That a vendor of this scale carried a flaw of this nature undetected is, on its own, cause for concern for any patient whose records pass through MyChart; and the fact that the fragmentation of its customer base, each hospital with its own configuration, could stretch patching well beyond the six weeks announced is a sign that the operational problem is only beginning. The story of AI in cybersecurity this year is this: it helps attack better and helps defend better almost at the same time, and whoever has the technical and financial muscle to deploy it on defense first gains a real edge.

But the underlying trend is what really matters for anyone who will be using MyChart ten years from now: an AI capable of auditing critical systems at this scale and finding what not even the best-trained humans had seen is also the same kind of tool that can harden health infrastructure enough that the promise of more complete records, faster diagnoses and fewer clinical errors is not built on brittle foundations. The health care abundance we champion as a long-term horizon only arrives if the infrastructure that sustains it holds up to scrutiny. This episode is an uncomfortable reminder of how much plumbing work remains, and also a sign that, at last, someone is doing it at the speed the problem demands.