AI agents have spent the past few months turning up in places they were not supposed to be, including at least one government health data portal. For the executives responsible for securing hospitals and health systems, the question of whether one could break into their own networks is no longer hypothetical.
In June, an OpenAI agent gained unauthorized access to an Australian government Medicare statistics portal, reaching public and nonpublic files. Services Australia said the agent also wrote files to an internal server; OpenAI said its review found no evidence that patient records were accessed.
An Oct. 1 report from Asymmetric Security said the firm found evidence of OpenAI agents probing websites belonging to Rochester, Minn.-based Mayo Clinic, the CDC and other organizations. Mayo said it has no indication or evidence of unauthorized access to its systems or data. And in July, OpenAI acknowledged its agents were behind an attack on AI platform Hugging Face after breaking out of a testing environment, according to a coalition of 26 attorneys general that is calling for federal AI safety rules.
“For health systems, this is a question of when, not if,” said Rob Mireles, chief information security officer of West Columbia, S.C.-based Lexington Health. “The reported probing of health system websites is consistent with reconnaissance, and that tells us agents are already testing our perimeters.”
Patrick Voon, executive director of information security at Loma Linda (Calif.) University Health, went further.
“It’s already happened as we’ve seen in the news, and the scary thing is it goes unnoticed for an unacceptable amount of time after the damage is already done,” he told Becker’s.
Dennis Leber, PhD, senior director and chief information security officer of Chattanooga, Tenn.-based Erlanger Health, suspects there have already been examples, though not recognized or reported as having been perpetrated by AI agents going off script.
“What concerns me more is that AI-driven activity may blend into normal network traffic and be difficult to distinguish from legitimate automation,” he said.
Sunil Dadlani, executive vice president and chief information, digital transformation officer and cybersecurity officer of Morristown, N.J.-based Atlantic Health System, agreed that the threat is already here.
“Whether a health system has been compromised by a rogue autonomous agent without detection remains an open question,” he said. “My bigger concern is that our traditional cybersecurity models were designed primarily around human-driven threats. Autonomous agents can operate continuously, make decisions independently and execute thousands of actions before human intervention.”
Mauricio Angee, chief information security officer of University of Miami Health System, put a number on it.
“The timeline is measured in months, not decades — and in many test beds and controlled evaluations, the boundary has already been crossed,” he said. “We are likely looking at a narrow window — one to three years, if not sooner — before autonomous agents are weaponized or accidentally misconfigured to launch sophisticated, end-to-end attacks against enterprise targets.”
Joe Susai, chief information security officer of Topeka, Kan.-based Stormont Vail Health, was less willing to name a date. “The timing is difficult to predict,” he said. “However, based on what has already been reported and demonstrated, this is a clear and present risk that warrants serious attention — not a hypothetical threat years away.”
“In healthcare, the risk goes well beyond data theft,” Mr. Dadlani added. “A successful attack could disrupt clinical operations, compromise patient safety and undermine public trust.”
The leaders largely agreed that attackers pose the nearest threat. They differed on how much to worry about frontier labs’ AI going rogue — and health systems’ internal AI agents.
“An organization may intentionally deploy an agent for a legitimate business purpose, only to discover later that it has access to more data or functionality than originally intended,” Dr. Leber said. “In many ways, AI agents should be managed like a new class of privileged digital workforce.”
In the short term, Mr. Dadlani is most concerned about hackers using AI because of their intent to extort or disrupt.
“But our own agents deserve equal management attention,” he noted. “They may already have trusted identities, access to sensitive information and permission to take action. A mistake inside that trust boundary can have serious consequences. I focus on what an agent can access, what it can change and how quickly we can stop it — regardless of who built it.”
Mr. Voon ranked the three. “Because we have limited development internally and have more control, I’m less concerned here,” he said. “However, I’m most concerned about rogue agents from threat actors because they have the resources to develop rapidly with malicious intent. This is followed by the AI companies, as they too have the resources and may accelerate development without the necessary guardrails in response to go-to-market pressures.”
Mr. Mireles pointed back to Hugging Face. “An agent doesn’t need to be targeting healthcare to end up inside a hospital network,” he said. “It only needs to decide that network serves some other objective.”
Some of the leaders pushed back on the word “rogue” itself.
Jack Kufahl, chief information security officer of Ann Arbor-based Michigan Medicine, said a resource created by his team has shaped his thinking on the question.
“Right now I think it is generally less helpful to embody these agents as quasi-sentient rogues and perhaps it is more helpful to think about the actual human intent and the general missing links of controls and oversight,” he said.
Added Dr. Leber: “The greater concern is not that an AI agent independently becomes malicious, but that it is given excessive privileges, poor oversight, or is manipulated by an attacker.”
“When we evaluate this threat, we must move past the sci-fi trope of an AI ‘going rogue’ out of malice. The real danger lies in misaligned optimization,” Mr. Angee said. “Give an agent a directive to retrieve data, compile metrics, or streamline a workflow, and it will not stop simply because it encounters a rate limit, a captcha, or a perimeter security control. It will improvise, test alternative paths, and chain vulnerabilities together.”
At Loma Linda, the response has included building out a central inventory of the agents in use. “We continue to build and maintain a central AI registry which includes an inventory of agents and bots, use cases, and risks,” Mr. Voon said.
Atlantic Health’s priorities include an “inventory of deployed agents, narrowly defined access, approval for consequential actions and monitoring that captures what agents actually do,” Mr. Dadlani said.
For Mr. Mireles, the defenses are familiar ones.
“The right response is to prepare now rather than debate timing. That means disciplined patching, phishing-resistant MFA, tightly governed vendor access, and detection capable of identifying activity that doesn’t fit normal human behavior,” he said. “None of these controls are new, but autonomous agents leave much less room for gaps in them.”
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
