Epic Systems, the company behind the MyChart patient portal, has set aside most of its product development to fix security flaws that turned up during a deployment of Anthropic's Mythos model, TechCrunch reported Friday. Founder and CEO Judy Faulkner has said the pause will likely run about six weeks.

What Happened

Faulkner told the trade publication Modern Healthcare in September that work on new features would largely stop while the company concentrated on what she called safeguarding its products. The vulnerabilities were identified during a deployment of Mythos, which TechCrunch described as Anthropic's frontier cybersecurity model.

Epic has not publicly described the bugs. Its chief security officer, Stirling Martin, gave The New York Times the most detailed account so far: certain customer configurations of MyChart could allow people outside a health system to reach patient records without the intrusion being recorded in the software's logs.

RelatedBank of America Added 1,000 Contractors to Fix Flaws Found by Anthropic's Mythos

Martin also told the Times that the AI model did not indicate whether the flaw could be used to change records without detection. Epic nonetheless judged the risk serious enough to fix. Martin did not respond to TechCrunch's request for comment.

Epic stresses that it does not have access to the medical data itself. That data sits with the hospitals, clinics and doctors' offices that license Epic's software and run their own installations.

Why It Matters

MyChart handles more than 320 million patient records across U.S. hospitals and medical practices, which makes it one of the largest stores of patient data that people reach through a web portal. A flaw that leaves no trace in logs is especially troubling for defenders, because it undercuts the audit trails hospitals depend on to detect misuse and to decide whether a breach must be reported.

TechCrunch noted that it is unusual for a software company to halt development to fix security problems. Vendors more commonly patch individual bugs while feature work continues. Martin's description points to customer configurations, which suggests the work touches how the product is set up across many sites, not only Epic's own code.

The episode also shows how AI tools that can find vulnerabilities at speed are changing vendor workloads. The Primary Wire has previously covered Mythos, the cyber-capable model Anthropic has kept under restricted access, including Anthropic research measuring how well other models match it at writing exploits. Epic's response is one of the clearest public examples so far of a large vendor reorganizing its engineering schedule around what such a model found.

Context

Health care has been a heavy target for attackers in 2026. TechCrunch listed recent incidents at CareCloud, where records of 3.7 million patients were stolen, as well as data thefts involving McKesson and the U.K.-based hospital software provider Craneware. The 2024 ransomware attack on Change Healthcare, a UnitedHealth Group unit, remains the largest health data breach on record in the U.S., affecting roughly 190 million people.

Because MyChart deployments differ from one provider to the next, fixes may require action by customers as well as by Epic. Health systems typically decide when to take vendor updates and how to configure patient-facing features.

What to Watch

The first signal will be whether Epic or its hospital customers publish advisories describing the affected configurations once the pause ends, and whether any provider concludes that records were accessed. Regulators and state attorneys general could take an interest if the logging gap means past access cannot be ruled out.

Other health IT vendors may face pressure to run similar AI-assisted audits of their own code. Epic's timeline also bears watching: a freeze that stretches well beyond six weeks would suggest the remediation is broader than the company has so far indicated.