Epic MyChart security jumped to the top of healthcare IT briefings this week. On October 2, 2026, TechCrunch reported that Epic paused most product development while it remediates flaws that could expose patient data.

I'm Nitin Kumar, Lead Project Coordinator at Debugged Pro. I support software and IT agencies in India and the USA. This brief sticks to TechCrunch, Fierce Healthcare, and Epic's clarifying statement, then turns those facts into delivery actions.

Primary reporting comes from TechCrunch's Epic security report and Fierce Healthcare's Project Glasswing coverage. Use them when clients ask for sources, not rumor threads.

Epic Systems CEO Judy Faulkner related to Epic MyChart security coverage — Epic CEO Judy Faulkner. Image credit: Michael Nagle / Bloomberg / Getty Images via TechCrunch.

What TechCrunch reported on Epic MyChart security

Zack Whittaker wrote that Epic, the company behind the widely used MyChart patient portal, paused most of its product development to protect its software and systems from cyberattacks.

Founder and CEO Judy Faulkner told Modern Healthcare that the pause would likely last six weeks while work continues on safeguarding products. The trigger was a deployment of Anthropic's frontier cybersecurity model Mythos, which unearthed security flaws that could allow access to patients' data.

Epic has not disclosed the full nature of the bugs. TechCrunch cites The New York Times interview with Epic chief security officer Stirling Martin. Martin said some customer configurations of MyChart could allow outsiders to access patient records without recording any intrusion in the software's logs.

Martin also said the AI model did not say whether the bug could be exploited to alter patient records without detection. He still argued the risk was enough to remediate. That distinction matters for client decks: this is a serious configuration and logging concern, not a confirmed public breach narrative.

Scope: Most product development paused for safeguarding work.
Duration signal: About six weeks, per Faulkner's Modern Healthcare remarks.
Trigger: Anthropic Mythos findings on Epic software.
MyChart detail: Some configs may allow record access with no log trail.
Breach status: No attack or breach has been announced in these reports.

How large is the Epic MyChart footprint

TechCrunch notes that MyChart maintains over 320 million patient records across hospitals and doctor offices in the United States. Epic says it does not hold customers' medical data itself. Providers do. A bug unknown to Epic could still affect many MyChart deployments if the same weak pattern exists across sites.

That scale is why India and USA agency teams supporting hospital integrations cannot treat this as a niche vendor note. Portal apps, FHIR bridges, scheduling widgets, and billing connectors often sit next to MyChart. A security freeze at Epic changes release calendars for everyone nearby.

Epic Systems campus building used in Epic MyChart security agency briefing — Epic Systems campus imagery commonly used in healthcare IT coverage. Image credit: Fierce Healthcare / Quartz asset library.

Project Glasswing and Claude Mythos context

Fierce Healthcare reports that Epic is participating in Project Glasswing and using AI tools to stay ahead of cybersecurity threats. Project Glasswing is Anthropic's initiative that puts advanced models, including the unreleased Claude Mythos model, in the hands of partners that defend critical digital infrastructure.

At Epic's August 2026 Users Group Meeting, Stirling Martin said Epic pointed these models at its own code. He described a codebase of several hundred million lines. He also said newer models are better at finding potential vulnerabilities and stringing unrelated issues into a novel attack path.

Martin warned health system IT teams to expect a "higher-than-usual number of urgent security fixes" from Epic. He framed speed as the core challenge now that AI tools give defenders a head start. Agencies should translate that into capacity planning, not panic.

How this ties to other AI cyber stories

Google's Fairwind-first rollout of Gemini 4 Argon follows a similar defender-first pattern. Our note on AI agents probing government systems covers why clients already ask about agent-driven vuln hunting. For sandbox and runtime controls, keep the NVIDIA agent safety agency guide nearby.

Epic's clarifying statement on the roadmap

After Modern Healthcare's coverage, Epic pushed back on the idea that its roadmap was abandoned. In a statement carried by IB Madison and Fierce Healthcare, a spokesperson said the development roadmap had not changed since the August 2026 Users Group Meeting.

The same statement said Epic continues rapid progress in expanded AI capabilities, Agent Factory, EpicOps, and interoperability work meant to speed prior authorization. Faulkner had already said product development would continue at a slower pace during the security push.

For agencies, hold both messages at once. Security work is consuming attention and may slow some projects. Epic still wants customers to hear that major roadmap themes remain. Do not invent a canceled AI roadmap when the company says Agent Factory and related work continue.

Judy Faulkner speaking, referenced in Epic MyChart security clarifying statement coverage — Judy Faulkner, founder and CEO of Epic Systems. Image credit: IB Madison.

Why agencies should care beyond Epic shops

Many Debugged Pro clients never touch Epic's core. They still build patient apps, RCM tools, staffing portals, and analytics that authenticate against hospital identity systems. When Epic issues urgent fixes, those neighbors feel the freeze through change boards, QA holds, and delayed UAT windows.

USA hospital clients: Expect more emergency CAB tickets and weekend patch windows.
India delivery pods: Keep a shared patch calendar so offshore sprints do not collide with freezes.
Integration vendors: Re-test MyChart-adjacent SSO, deep links, and audit logging after each urgent fix.
Sales teams: Stop promising net-new Epic module go-lives during the six-week safeguarding window unless the client confirms capacity.

Healthcare breach context clients already know

TechCrunch places the Epic work against a harsh year for health data. It recalls the 2024 Change Healthcare ransomware case, where attackers stole health data on more than 192 million people. It also notes 2026 incidents involving CareCloud, McKesson patient data rows, Craneware, and a DentaQuest breach listed by HHS as affecting 15 million people.

You do not need those figures to scare a client. You need them to explain why a vendor that finds AI-detected flaws and pauses feature work is acting in line with industry pressure, not inventing drama.

Epic MyChart security checklist for agency delivery

Use this list in the next standup. Put owners and dates next to each item.

Map exposure. List clients on Epic, MyChart, or Epic-adjacent APIs and portals.
Confirm freeze rules. Ask each client which environments accept only security patches right now.
Review logging claims. If a SOW assumes every portal access is audited, revisit that language after Martin's NYT comments.
Staff urgent fixes. Reserve India and USA hours for higher-than-usual Epic security updates.
Protect go-live dates. Move optional feature work out of the safeguarding window when the client lacks CAB bandwidth.
Align sales and delivery. One brief for both coasts so no one overpromises Agent Factory timelines.
Keep sources handy. Link TechCrunch and Fierce Healthcare in the client email, not anonymous screenshots.
Watch for patient-facing notices. Portal maintenance messages can trigger support spikes; prep helpdesk scripts.

India and USA moves for this week

For USA-facing clinical IT and compliance leads

Ask Epic or the hospital IT owner which MyChart configurations are under review.
Update risk registers with AI-assisted vuln discovery as an active control, not a future idea.
Check BAAs and incident clauses so patch delays and portal downtime are covered in plain language.
Brief executives that no public breach was reported in these articles, while still treating the logging gap as urgent.

For India delivery and captive centers

Freeze nonessential Epic customization until the client clears the security window.
Add regression suites for portal login, proxy access, and audit-log presence after each urgent fix.
Document time zones for emergency CAB calls so on-call coverage is real, not aspirational.
Train leads to explain Project Glasswing and Mythos without claiming Epic was hacked.

If you need help turning this into a scoped plan, start with Debugged Pro software development consulting. More AI and security briefs sit on the Debugged Pro blog.

How to brief clients without overclaiming

Clients will ask if MyChart is safe and if Epic AI projects are dead. Keep the brief dated and calm.

What launched in the news: TechCrunch coverage on October 2, 2026 of Epic's development pause and MyChart-related flaws.
What found the issues: Anthropic Mythos under Project Glasswing, per Epic's own remarks and reporting.
What Epic says continues: AI capabilities, Agent Factory, EpicOps, and interoperability work.
What we will not claim: A confirmed mass breach, or a permanent halt to Epic's roadmap.
What we will do next: Patch calendars, logging reviews, and honest go-live date resets.

Topic	What sources say	Agency action
Pause	Most development paused ~six weeks for safeguarding	Move optional Epic work; keep security capacity
MyChart	Some configs may allow access with no log entry	Revisit audit assumptions in designs and SOWs
Glasswing	Epic uses Anthropic Mythos-class tools on its code	Expect more urgent vendor patches industry-wide
Roadmap	Spokesperson says UGM roadmap unchanged; AI work continues	Do not announce canceled Epic AI programs
Scale	MyChart covers 320M+ US patient records	Prioritize hospital clients in the first wave of reviews

Key Takeaways

Epic MyChart security is in the news because Epic paused most development after Mythos found flaws that could expose patient data.
TechCrunch reports some MyChart configurations may allow outsider access without a log trail, citing Epic's CSO in The New York Times.
Faulkner described about six weeks of safeguarding work; Epic later said its August 2026 roadmap still stands.
Project Glasswing and Claude Mythos are the AI defense tools Epic cites for finding hard-to-spot issue chains.
MyChart supports over 320 million US patient records, so India and USA agencies near hospital stacks should plan for urgent fixes.
Brief clients with sourced facts, protect go-live dates, and review logging claims before the next CAB meeting.

FAQ: Epic MyChart security for agency teams

What is the Epic MyChart security issue about?
TechCrunch reported on October 2, 2026 that Epic paused most product development after Anthropic's Mythos cybersecurity model found flaws that could allow access to patient data. Epic's chief security officer told The New York Times that some customer MyChart configurations could let outsiders access records without an intrusion entry in the software's logs. Epic has not said a breach occurred.

Did Epic stop its product roadmap?
CEO Judy Faulkner told Modern Healthcare that most technology development was paused for about six weeks of safeguarding work, with product development continuing at a slower pace. An Epic spokesperson later told outlets including Fierce Healthcare and IB Madison that the development roadmap had not changed since the August 2026 Users Group Meeting, and that work continues on AI, Agent Factory, EpicOps, and interoperability.

What is Project Glasswing in this story?
Project Glasswing is Anthropic's AI cybersecurity initiative. Partner organizations use advanced models, including the unreleased Claude Mythos model, to find software vulnerabilities and strengthen defenses. Epic said it is participating and has pointed these models at its own large codebase.

How many patient records does MyChart cover?
According to TechCrunch, Epic's MyChart software is used to maintain over 320 million patient records across hospitals and doctor offices in the United States. Epic says it does not have access to customers' medical data; that responsibility sits with healthcare providers.

What should India and USA agency teams do this week?
Confirm which clients run Epic or MyChart-adjacent integrations, ask for patch and change windows, do not promise new Epic feature dates during the security push, review logging and portal configuration assumptions in SOWs, and brief India and USA pods with the same sourced facts from TechCrunch and Fierce Healthcare.

About the Author

Nitin Kumar is Lead Project Coordinator at Debugged Pro. He helps software and IT agencies plan practical AI delivery and risk controls for clients in India and the USA.