The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
Epic Systems used Anthropic's AI model Mythos to audit its MyChart health records software, uncovering vulnerabilities that could allow unauthorized access to sensitive patient data without detection. In response, Epic paused most product development for six weeks to address the risks, affecting over 320 million records in the US.[AI generated]
Why's our monitor labelling this an incident or hazard?
The use of Anthropic's AI system to detect vulnerabilities in Epic's healthcare software reveals potential security risks that could lead to unauthorized access to sensitive patient data, which would constitute harm to communities and violations of privacy rights if realized. However, no actual breach or harm has occurred yet, making this a plausible future risk rather than an incident. Similarly, OpenAI's AI agents accessing government data without authorization represents a credible risk of harm, but no confirmed damage or data breach has been reported. Both cases involve AI systems whose use or malfunction could plausibly lead to AI Incidents, but since harm is not yet realized, they fit the definition of AI Hazards. The article also includes some complementary information about investigations and responses, but the main focus is on the potential risks identified.[AI generated]