Epic Systems used AI to find security flaws that could expose patient records

Epic Systems, a major vendor of electronic health records software, turned AI on its own systems and found a set of security flaws that could threaten patient privacy.

According to qz.com, Epic's engineers used an AI tool developed by Anthropic to scan its systems, and the tool's analysis pointed to a number of exploitable defects.

The core risk is unauthorized and hard-to-detect access. The report says that if the flaws were exploited, an attacker could read patient records without raising obvious alarms, potentially affecting millions of records.

Epic is one of the primary suppliers of electronic health record software, used by a large number of hospitals and health systems to store and manage patient data, which makes the security of its systems directly relevant to clinical data and privacy.

Methodologically, the scan is a form of proactive defense: using AI to find and locate problems before attackers do, after which teams carry out the fixes. That remediation work is said to be under way.

The episode also highlights the double-edged nature of AI in security. The same class of tools that helps defenders find vulnerabilities faster could be used to look for ways in, which is why more vendors emphasize permission controls and auditing when deploying such capabilities.

What to watch next is when the full set of patches lands and how many care providers need to upgrade alongside it. For vendors handling sensitive medical records, the case is likely to become a reference point for AI-assisted security practice.