AI-powered testing is uncovering security weaknesses in healthcare technology, from EHR configurations that could permit undetected record access to hospital websites that could expose patient information.
Epic and Google-owned cybersecurity company Wiz illustrates how AI is being used to search for vulnerabilities across both healthcare software and hospitals’ public-facing systems.
Epic is patching security flaws identified after testing its software with Anthropic’s Claude Mythos AI model, The New York Times reported Sept. 30.
Certain software configurations could allow someone to view sensitive patient records without that access appearing in a digital audit trail, Epic Chief Security Officer Stirling Martin told the newspaper. The testing did not determine whether an attacker could also alter records.
Epic has also said the models surfaced potential vulnerabilities its developers had previously missed. The company participates in Anthropic’s Project Glasswing, which gives partner organizations restricted access to advanced AI capabilities to identify software vulnerabilities.
The findings extend beyond EHR software. Wiz’s Scan for Good initiative combines an AI-powered penetration-testing tool with a Google DeepMind model to examine public-facing websites, APIs and applications.
At an unnamed public hospital, missing access controls exposed staff contact information and allowed anyone online to control the hospital’s mobile alert channel, Wiz said in a Sept. 24 blog post.
At an unnamed private hospital, an unsecured upload feature on an appointment-booking website could allow an attacker to take control of a hospital server and expose patient identifiers, clinical records and consent signatures. Wiz said it worked with both hospitals to fix the flaws before publishing its findings.
Google subsequently reported another healthcare software finding, saying its Gemini 4 Argon model uncovered a critical vulnerability in software used by hospitals worldwide. Earlier frontier models had missed the risk, according to a Sept. 30 company blog post.
Google did not identify the software or vendor, specify which data was at risk or say whether the vulnerability had been patched. It also did not establish whether the finding was related to either hospital case previously disclosed by Wiz.
The discoveries also bring pressure to implement fixes. Mr. Martin told the Times that health systems should prepare for a faster pace of patching.
“Ultimately they need to get ready to patch, patch, patch,” he said.
