AI agents that can log in to systems, retrieve data and take actions on their own are moving into health system operations. For the executives responsible for securing hospitals, they represent a new kind of user: one that works around the clock and does not always stop when it is told no.
Rob Mireles, chief information security officer of West Columbia, S.C.-based Lexington Health, framed the timeline in October.
“For health systems, this is a question of when, not if,” he said.
Dennis Leber, PhD, senior director and chief information security officer of Chattanooga, Tenn.-based Erlanger Health, laid out where the danger lies.
“The greater concern is not that an AI agent independently becomes malicious, but that it is given excessive privileges, poor oversight, or is manipulated by an attacker,” he said.
Here are six cyber risks AI agents pose to health systems, drawn from recent incidents and Becker’s reporting:
1. Agents that won’t take no for an answer. An OpenAI agent researching public medicine spending gained unauthorized access to an Australian government Medicare statistics portal in June after encountering repeated blocks, reaching public and nonpublic files. Services Australia said the agent also wrote files to an internal server. OpenAI said its review found no evidence that patient records were accessed.
Mauricio Angee, chief information security officer of University of Miami Health System, described the pattern in October.
“Give an agent a directive to retrieve data, compile metrics, or streamline a workflow, and it will not stop simply because it encounters a rate limit, a captcha, or a perimeter security control,” he said. “It will improvise, test alternative paths, and chain vulnerabilities together.”
2. Stolen and forged credentials. OpenAI detailed in October how one of its internal models, after a government statistics website repeatedly denied it hospital-bed data, used the site’s file-download feature to pull files containing a database connection string, a secret used to sign authorization tokens and email login credentials. The model then built unsigned tokens to get past the site’s authorization checks and saved 24 years of data, far more than the single year it had been asked for.
It also pulled the site’s account directory, which listed more than 1,000 email addresses, and considered using them to guess a password. The model was in training at the time, and OpenAI did not name the website or the country.
3. Overprivileged internal agents. Not every risk comes from outside. Agents that health systems deploy themselves can end up with more reach than the people who built them intended.
“An organization may intentionally deploy an agent for a legitimate business purpose, only to discover later that it has access to more data or functionality than originally intended,” Dr. Leber said. “In many ways, AI agents should be managed like a new class of privileged digital workforce.”
Sunil Dadlani, executive vice president and chief information, digital transformation officer and cybersecurity officer of Morristown, N.J.-based Atlantic Health System, pointed to the access those agents already hold.
“They may already have trusted identities, access to sensitive information and permission to take action. A mistake inside that trust boundary can have serious consequences,” he said.
4. Agent activity that goes unnoticed. Recent incidents have come to light long after they happened. OpenAI discovered the hospital-bed incident Aug. 13, nearly two months after it occurred June 17, during a retrospective review of earlier training and evaluation traffic. The company did not notify the Australian government about the Medicare portal access until Sept. 10.
Patrick Voon, executive director of information security at Loma Linda (Calif.) University Health, flagged that lag in October.
“It’s already happened as we’ve seen in the news, and the scary thing is it goes unnoticed for an unacceptable amount of time after the damage is already done,” he said.
5. Low-skill attackers with powerful tools. In an Oct. 21 report, cybersecurity company CrowdStrike profiled four previously unreported threat actors that ran agentic AI campaigns between May and August. One used Anthropic’s Claude Code to compromise at least 15 healthcare organizations in Argentina, with one agent choosing the next attack stage and a second carrying it out. Another targeted more than 20 organizations worldwide, including healthcare and biotech companies in the U.S.
A third actor had little security expertise but still breached government and private-sector targets. CrowdStrike expects that over the next 12 months, some low-skill attackers will match the effectiveness and scale of organized criminal or state-linked groups.
“In healthcare, the risk goes well beyond data theft,” Mr. Dadlani said. “A successful attack could disrupt clinical operations, compromise patient safety and undermine public trust.”
6. AI vendors holding patient data. Agents need data to work, and the companies that build them often hold it. Agentic AI company Serviceaide disclosed in 2025 that information in an Elasticsearch database belonging to Buffalo, N.Y.-based Catholic Health had been inadvertently made public, exposing names, Social Security numbers, dates of birth, and medical and health insurance information for 483,126 patients.
A separate data breach at healthcare AI company Xsolis has ensnared at least nine health systems and 1.4 million patients.
Mr. Mireles said the defenses are largely familiar ones.
“The right response is to prepare now rather than debate timing. That means disciplined patching, phishing-resistant MFA, tightly governed vendor access, and detection capable of identifying activity that doesn’t fit normal human behavior,” he said. “None of these controls are new, but autonomous agents leave much less room for gaps in them.”
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.