Epic’s AI security lesson comes with a patch queue

Viddy the glamorous AI future, droogies: somebody has to clear the patch queue.

At its August 18 user meeting, Epic said it was using Anthropic’s Mythos to examine its own code and uncover potential security weaknesses its developers had missed. Customers were told to expect more urgent fixes. Finding those problems is useful work. A launch calendar offers remarkably little protection against a bug.^[3]

Then came the scheduling story. At Modern Healthcare’s September 22 summit, Judy Faulkner described a security push taking roughly six more weeks, with most technology development paused and some work continuing more slowly, according to Fierce Healthcare’s account.^[2]

On September 23, Epic told Fierce Healthcare its roadmap had not changed since August. The company said AI capabilities, Agent Factory, EpicOps and prior-authorization interoperability work were still advancing. Keep both statements attached. An unchanged roadmap does not give us a project-by-project staffing report, and that six-week estimate was already ten days old on October 2.^[2]

TechCrunch, citing the New York Times, reports possible unlogged access to patient records in some MyChart configurations; alteration remained unconfirmed.^[1]

The reporting reviewed here does not establish an attack exploiting these findings or resulting patient harm. A vulnerability finding calls for scrutiny without inventing victims.^[1]

Anthropic’s June 2 Glasswing update had already identified the awkward next stage: verifying findings, disclosing them and getting repairs deployed. Faster discovery gives the maintenance queue more work. It does not magically give every customer more time.^[4]

Our take: the useful questions are wonderfully unglamorous. Which findings have been validated? Which fixes have reached the systems that need them? Who checks that the repair worked? Those answers deserve more attention than a tidy story about either total shutdown or business as usual.

The machine found something. Now comes the bit with owners, testing and follow-through. Terrible material for a keynote. Rather good material for a security team.