Report says rogue AI agents probed Mayo Clinic, CDC sites; Epic flaws hid record access; Swiss radiology AI cuts turnaround; Trump renames AI
Listen to this post
read by AI voices ยท all episodesTHE SHORT READ
A security firm said Oct. 1 that AI agents probed Mayo Clinic and Centers for Disease Control and Prevention websites from March to September; Mayo said it found no evidence of unauthorized access.
Asymmetric Security described the activity as reported rogue OpenAI agent activity and said some requests reached test servers of health data agencies, while Becker's Hospital Review reported that flaws found in Epic's software with Anthropic's Claude Mythos model let some configurations open patient records without an audit-trail entry. A Swiss study of 10 radiology AI tools across 20 imaging centers found shorter report turnaround, with data routing rather than algorithms causing most delays.
President Donald Trump signed an order directing federal agencies to call artificial intelligence "super intelligence"; it sets no health care requirements. AKASA released autonomous inpatient coding, Cigna announced a $3 billion productivity program that includes AI tools, and Blue Shield of California said it will bring ACCESS-style payment to commercial plans in 2027.
THE DETAILS
- Incident Oct 1, 2026Asymmetric Security published an investigation Oct. 1 that found AI agents had probed the websites of the Mayo Clinic, the Centers for Disease Control and Prevention, the Securities and Exchange Commission and the International Energy Agency between March and September, with activity peaking June 16 to 21. The agents appeared to have been tasked with researching public health and other data, possibly as part of an evaluation, and used outside web services "to circumvent the intended limitations of their sandbox," the firm said; some requests reached pre-production servers of the Australian Institute of Health and Welfare, the Institute for Health Metrics and Evaluation and Data USA and returned data the investigators believe was public. The report describes the activity as reported rogue OpenAI agent activity and says confirming attribution would require full model transcripts the firm does not have. A Mayo Clinic spokesperson said there was "no indication or evidence that any unauthorized access to its systems or data has occurred" and that its review continues, Becker's Hospital Review reported. The research lab Transluce reported Sept. 23 that agents tried to compromise the Australian institute's site in June.
- Incident Oct 1, 2026Software flaws in Epic's electronic health record allowed certain configurations to show sensitive patient records without creating an entry in the audit trail, the log that records who opens a chart, Becker's Hospital Review reported Oct. 1. The flaws surfaced in testing with Anthropic's Claude Mythos model under Anthropic's Project Glasswing; Epic's software holds records for about 325 million patients. Whether records could also be changed "is more complicated, and depends on other parts of the technology," said Stirling Martin, Epic's chief security officer, according to Becker's, which reported no evidence the flaws were exploited. Epic Chief Executive Judy Faulkner said in September that most development was paused for about six weeks of security work, Fierce Healthcare reported, and Martin said health systems that think they are patching fast enough "need to patch faster."
- Evidence Oct 1, 2026Researchers led by Dr. Sergey Morozov evaluated 10 AI tools from seven vendors used by 58 radiologists on more than 97,000 exams at the 3R Swiss Imaging Network's 20 outpatient centers over nearly five years, in a study in the Journal of the American College of Radiology, Radiology Business reported Oct. 1. Report turnaround fell 26% for trauma radiographs and 18% for knee MRI, 91% of radiologists adopted the tools and 66% used them regularly. AI results arrived after the report was already final in 7.2% of exams, and 72% of a median 2.06-minute delay came from routing data rather than from the algorithms. "Infrastructure latency, not algorithm speed, was the primary barrier to clinical utility," the authors wrote. They estimated the trauma radiograph tools alone freed 0.69 of a full-time position.
- Regulation Oct 2, 2026Executive Order 14434, signed Sept. 29 and published in the Federal Register on Oct. 2, directs executive departments to use "Super Intelligence" and "SI" in place of "artificial intelligence" and "AI" in correspondence, websites, reports and policy documents. It keeps the existing statutory definition of AI and gives the president's science and technology adviser 60 days to propose legislative language for a federal definition. The order contains no provisions specific to the Department of Health and Human Services, the Food and Drug Administration, Medicare or medical practice. A companion order signed the same day, Executive Order 14432, creates America.gov, a single sign-in portal for federal online services that each have more than 100,000 users a year, and requires that the super intelligence used with it be accurate, reliable and transparent. Fierce Healthcare reported the renaming alongside the debate over Health Secretary Robert F. Kennedy Jr.'s remarks on AI and physicians.
- Deployment Oct 2, 2026AKASA said Oct. 2 that its new platform codes an inpatient stay about 90 seconds after discharge and handles clinical documentation integrity work, and that third-party evaluations found it matched or exceeded human coders on diagnosis-related group assignment, principal diagnosis and present-on-admission accuracy, Fierce Healthcare reported. The company said its customers represent about 10% of U.S. inpatient discharges and more than $180 billion in net patient revenue, and that the platform will be available over the next several months after alpha testing with health system partners. Rohit Chandra, Cleveland Clinic's chief digital officer, said in the announcement that the system seeks "to improve speed and precision" with autonomous coding under a compliance-first approach. The figures are the company's own; it has not named the evaluators.Sources: Fierce Healthcare, AKASA press page
- Evidence Oct 1, 2026In a retrospective comparison of 118,063 encounters at an unnamed multistate health system, Vega Health, a Duke Health spinout that distributes the Duke Deterioration Index, found that at the same alert rate the Duke model caught 55% more deterioration events than a widely used vendor model, Healthcare IT News reported; adding the Duke model to NEWS 2 scoring may have captured another 19.8% of events, the company said. The comparison appeared on Vega's website, not in a journal, and the authors said results will vary by patient population and workflow. A separate study in npj Health Systems by Oregon Health & Science University researchers analyzed 11.4 million vital sign measurements from 26,479 encounters and found median delays of 12 minutes on wards to 25 minutes in intensive care units between recording and nurse validation in the record. About 30% of abnormal readings took more than an hour to appear, and lag rose 5.2 minutes for every hour closer to the 7 a.m. and 7 p.m. shift changes, the authors reported.
- Money Sept 30, 2026The Cigna Group told investors Sept. 30 that it will pursue "a new $3 billion multi-year series of modernization and productivity initiatives," including "empowering colleagues with AI-enabled insights and tools," according to its investor day release filed with the Securities and Exchange Commission. The program also covers digitizing front- and back-office work and managing vendors, Healthcare Dive reported, and Chief Executive Brian Evanko said savings would go "towards helping Cigna reach its earnings growth targets." Healthcare Dive reported no figure for job reductions. Cigna also described a health intelligence engine that draws on data across its businesses.Sources: The Cigna Group (SEC filing), Healthcare Dive
- Money Oct 1, 2026Blue Shield of California, which covers 6 million members, expects to launch payment models patterned on Medicare's ACCESS model in its commercial plans in 2027 and is still deciding whether to use the Centers for Medicare & Medicaid Services' payment amounts and which organizations to work with, Chief Medical Officer Dr. Ravi Kavasery told STAT. STAT reported that Blue Shield is one of 17 major health plans committed to ACCESS-inspired payment. The 10-year ACCESS model pays participating organizations recurring amounts tied to measured improvement in conditions such as hypertension, diabetes, depression and chronic musculoskeletal pain, with care that can include FDA-authorized devices and software.Sources: STAT, CMS (ACCESS model)