Epic pauses most product work after AI finds MyChart security flaws

Epic founder and CEO Judy Faulkner told Modern Healthcare that the pause would likely last about six weeks while the company works on "safeguarding" its products, according to TechCrunch.

She spoke about it on a panel about how CEOs are leading their teams through AI, according to health tech writer Brendan Keeler, citing Modern Healthcare. Keeler says she described the pause as covering hundreds of projects, and called the decision a "shame."

It's rare for a company to pause development to fix security bugs, TechCrunch notes. But the rise of AI tools that can quickly find and exploit vulnerabilities has raised concerns that attackers could have an easier time stealing data.

Epic hasn't disclosed the nature of the bugs. But its chief security officer, Stirling Martin, gave The New York Times an outline, according to TechCrunch:

• The risk: some customer configurations of MyChart could let outsiders access patient records.
• No trace: that access might not show up in the software's logs.
• What's unknown: the AI model didn't say whether the bug could be used to alter patient records without detection.

Martin told the Times the risk was enough to fix the issues, even without knowing whether records could be altered. He did not respond to TechCrunch's request for comment.

The flaws were found when Epic deployed Mythos, Anthropic's frontier cybersecurity model, on its software, TechCrunch reports.

The New York Times, which first reported the details, said Epic is using Mythos to stress-test its software and to probe how attackers might use open-source AI agents to unlock confidential records. The Times described Epic as the largest US medical records vendor, serving thousands of hospitals and doctor's offices, with records for 325 million patients worldwide.

MyChart is the software millions of Americans use to view lab results, message their doctors and manage prescriptions, as Cryptonomist describes it.

By the numbers: MyChart is used to maintain more than 320 million patient records across hospitals and doctor's offices in the US, according to TechCrunch.

Epic says it doesn't have access to customers' medical data. That responsibility belongs to the healthcare providers, like hospitals and clinics, that run its software.

The catch: a single bug in Epic's software could still matter across many providers at once. TechCrunch notes that a flaw unknown to Epic could let hackers compromise multiple affected MyChart systems across the US and take the data stored in them.

In real life If you log in to see test results or message your doctor, there's a good chance you use MyChart. The flaws are in the software your hospital runs, which is why Epic, not patients, is the one fixing them.

There are two messages coming out of Epic, as Keeler points out.

Keeler, who writes the Health API Guy newsletter, notes that Epic has long been a famously private company. It has invested more in lobbying and marketing in recent years and has even opened its Users Group Meeting to the press, he writes, which is part of why Faulkner's candid comments drew so much attention.

Faulkner sounded cautious about what comes after the pause. "You worry that after a month and a half of working almost primarily on safeguarding the software, that new things will be created by those who are trying to bust the software, and it will be in a never-ending cycle," she said, according to Modern Healthcare as quoted by Keeler.

She added that she expects "a different pace" going forward, with a constant need "to look at the next attack and figure out what to do to prevent anything from being hurt."

Epic's spokesperson struck a calmer note. "Our development roadmap hasn't changed since we presented it at our August 2026 Users Group Meeting," the spokesperson told Becker's Hospital Review, as quoted by Keeler.

The big picture: healthcare has become one of the most targeted industries for hackers, who bet that providers will pay to keep stolen medical data from being published, TechCrunch reports.

• Change Healthcare: a 2024 ransomware attack on the UnitedHealth-owned company, which handles payments and billing for most Americans, exposed health data on more than 192 million people. The company paid the hackers twice not to publish the data.
• 2026 breaches: this year has seen breaches at electronic health records firm CareCloud, pharmaceutical distributor McKesson and UK health tech company Craneware, whose software is used across North America.
• Largest this year: the Department of Health and Human Services lists a breach at dental insurer DentaQuest, affecting 15 million people, as the largest healthcare data breach of 2026 so far.

Why it matters: this is one of the clearest examples yet of AI changing the security calendar for a major software company.

The same kind of AI that can help defenders find flaws faster can, in principle, help attackers find them too. That's the worry TechCrunch describes, and the "never-ending cycle" Faulkner says she fears.

Keeler frames the reaction to Epic's pause in three ways. Startups question how slow a company has to be to freeze development for six weeks. Customers ask what it means for the roadmap they were promised. And security chiefs see a vendor putting security first, which deserves some credit.

For more on Anthropic and its models, see our Anthropic topic page.

What's next: Faulkner's estimate is about six weeks of security-focused work. Epic hasn't published a more detailed public timeline, and it hasn't said when or whether it will describe the specific bugs, Cryptonomist notes.

A few things to watch:

• The end of the pause: whether Epic returns to its normal release schedule after six weeks, or, as Faulkner suggested, settles into a slower pace with more time spent on security.
• The roadmap: Epic's spokesperson says the plan shown at its August Users Group Meeting still stands, so customers will be watching whether promised features arrive on time.
• Disclosure: Epic hasn't described the bugs publicly, and the risk Martin described depends on how each customer has configured MyChart.

• No sign of a breach: the reports describe flaws found by AI and being fixed, not data that was stolen.
• Your provider holds your data: Epic says hospitals and clinics, not Epic, are responsible for patient records, so any notices would come from them.
• Stay alert: be careful with unexpected emails or texts about your MyChart account, and log in through your provider's usual app or website.
• Expect more of this: as AI makes finding bugs faster, more companies may pause to fix them.