Epic pauses product development after AI finds MyChart flaws
An AI security model found silent-access flaws in the software behind 320 million patient records — and the company froze its roadmap. Meanwhile the data-center backlash just forced a first-party concession from Amazon, and the memory squeeze reached Nvidia's desktop.
Epic pauses most product development after an AI model finds MyChart flaws. The electronic-records giant ran Anthropic's frontier cybersecurity model, Mythos, against its roughly 100-million-line codebase under a restricted initiative called Project Glasswing, and the model surfaced a class of bugs Epic is calling "silent access": configurations that would let outsiders reach patient records without the intrusion ever showing up in the software's own logs. Epic CEO Judy Faulkner told Modern Healthcare that most product development is paused for about six weeks to remediate, with the security sprint running to mid-November; MyChart covers over 320 million patient records. This is the first large-scale case of the pattern the industry has been warning about in reverse — instead of an AI causing the breach, an AI found the breach, and the response was to stop shipping. The uncomfortable part for readers: Epic's CSO conceded to the New York Times that in some configurations the logs would have told administrators nothing, meaning the exposure could have persisted indefinitely without a model stress test. Epic says its long-term roadmap is unchanged, so treat the pause as a remediation crunch rather than a strategy shift — but for once a vendor moved before an incident, not after.
Amazon drops NDAs for data-center projects as moratoriums multiply. AWS CEO Matt Garman acknowledged in a blog post that Amazon no longer uses nondisclosure agreements with the county officials it works with, and that more than 100 data-center moratoriums are under consideration across the US — "the US could be writing its own losing ticket to [the AI] race, and the consequences would last generations," he wrote. The company also pledged $1 billion over five years for host communities, days after Rep. Jamie Raskin pressed Amazon, Google, Meta and Oracle over local officials being gagged by NDAs. It is a rare first-party admission of a backlash practice change — and a useful sanity check on the "AI buildout is unstoppable" narrative. The gap worth watching: Amazon didn't say whether the NDA pledge covers its contractors, and at least one local agreement was signed with a shell entity, not Amazon itself. We've tracked how far this has already gone — US data center bans top 500 as New York, Texas push back.
Nvidia's 64 GB DGX Spark costs $4,999 — $1,000 more than the 128 GB model at launch. Nvidia announced the smaller-memory version of its desktop AI machine at $4,999, available October 23 through Acer, ASUS, Dell, Gigabyte, HP and MSI. Same GB10 Grace Blackwell chip, same 273 GB/s of memory bandwidth, half the RAM and storage — and a higher price than the 128 GB unit sold for at launch, because the 128 GB model now lists at $6,950, up nearly 75 percent in a year of skyrocketing memory prices. The inversion is the real story: compute is getting cheaper per parameter while DRAM does the opposite, and it is now cheaper to buy a smaller model's worth of memory than a big one was last year. Expect the squeeze to show up in every desktop and workstation SKU that isn't subsidized by hyperscale buying power.
What to watch: whether other EHR vendors follow Epic into model-driven code audits, and whether Amazon's NDA pledge extends to contractors.
Has your own software been saved — or broken — by an AI security scan? Tell us in the comments.
