Why Epic Joined Anthropic’s Project Glasswing
Table of Contents
Epic used its Users Group Meeting executive address this week to confirm publicly for the first time that it’s participating in Project Glasswing, Anthropic’s effort to test its most capable, and still unreleased, AI model against critical software before that capability spreads to attackers, marking a notable Epic Project Glasswing Mythos disclosure from one of healthcare’s largest technology vendors.
What Project Glasswing Actually Is Behind This Epic Project Glasswing Mythos Disclosure
Anthropic launched Project Glasswing in April after deciding not to publicly release Claude Mythos, an AI model capable of autonomously finding and exploiting decades-old cybersecurity vulnerabilities. The program initially included about 50 partners, mostly major tech and cybersecurity firms, before expanding in June to roughly 150 more organizations spanning industries including healthcare. Anthropic has not disclosed the identities of most participants, citing security concerns, though it has said organizations are free to share their own involvement.
How Epic’s Disclosure Came About
Epic’s revelation came during a security-focused portion of its Aug. 18 keynote, which also touched on new AI tools, smaller-organization product tiers and rural health expansions. Epic Chief Security Officer Stirling Martin told UGM attendees in Verona, Wis., that the AI arms race in cybersecurity accelerated this year as tools such as Anthropic’s Claude Code grew capable of reasoning across large codebases and surfacing security flaws that had gone undetected for years.
What Martin Revealed About This Epic Project Glasswing Mythos Participation
“In April, Anthropic announced a program called Glasswing and Mythos, an AI model so capable that they’ve limited access to a small number of critical providers,” Martin said. “We’ve not talked publicly about it before. I’m happy to share that we’ve been a participant in Glasswing and heavy users of Mythos.”
What Epic Found When Pointing Mythos at Its Own Code
Epic has since pointed the models at its own codebase, which spans several hundred million lines, and said the AI surfaced issues its own expert developers had missed. “In each successive model, the AI gets better and better at finding potential vulnerabilities, and at stringing unrelated issues together into a novel attack path,” Martin said. “These are not obvious issues, but the nuanced interplay between unrelated parts of the software.”
What This Means for Epic Customers Within This Epic Project Glasswing Mythos Update
That means Epic customers should brace for more frequent, and less predictable, security updates, Martin said. “Your teams should continue to expect to see a higher than usual number of urgent security fixes from us as we do,” he said. “We’re moving fast because speed is the whole game now, and these tools have given us a head start.”
A Challenge to Epic’s Own Vendor Ecosystem
Martin also put the burden back on health systems’ other software vendors, telling the audience of IT executives that the same forces are pushing patch volumes up across the industry. “So here’s a question worth asking,” he said. “If one of your vendors isn’t shipping more updates than they used to, why not? In this new world, the status quo is not a good sign.” He added: “The old goal of patching within 30 days, that’s no longer good enough.”
How AI Has Spread Beyond Security Within Epic’s Operations
Seth Howard, Epic’s executive vice president of research and development, referenced his company’s work with Anthropic later in the session, telling attendees AI has become embedded across the company’s own operations, not just its cybersecurity work. “This morning, you heard about how we use Mythos and other models to improve security,” Howard said, adding that Epic’s own engineers now lean on AI coding tools, including Anthropic’s Claude Code and OpenAI’s Codex, to build product faster.
Why Health System CIOs Have Pushed for Glasswing Access
Health system CIOs have been pushing to be included in Project Glasswing, arguing that healthcare’s mix of legacy systems, long patching cycles and thin margins makes it especially exposed to AI-accelerated attacks.
How Health System Leaders Reacted to This Epic Project Glasswing Mythos Disclosure
Speaking with Becker’s on the sidelines of UGM, Sha Edathumparampil, chief digital and information officer of Coral Gables, Fla.-based Baptist Health South Florida, said Epic’s AI roadmap overall impressed him, but singled out the security update as one of three things that stood out from this year’s conference. “The third piece I’m excited about is all the focus on cybersecurity,” he said. He pointed to Epic’s improved patching frequency and said the company has begun giving hospitals that host their own Epic systems specific guidance to help them accelerate their own patching schedules.
Why This Disclosure Is Unusually Specific
Epic’s disclosure is a rare instance of a health IT vendor or healthcare-focused company confirming its own participation in Glasswing, a level of specificity Anthropic itself has largely avoided providing on participants’ behalf.
What This Epic Project Glasswing Mythos Disclosure Means Going Forward
With Epic now publicly confirming both its Glasswing participation and the resulting shift toward more frequent security patching, health systems running Epic’s EHR should prepare their own IT and security teams for a higher cadence of urgent updates than they may have previously budgeted for. Given Martin’s explicit challenge to other software vendors about their own patch frequency, this disclosure may prompt health system CIOs to ask similar questions of their broader vendor ecosystems beyond Epic alone.
What to Watch Going Forward
As more organizations within Project Glasswing’s expanded 150-member healthcare cohort potentially follow Epic’s lead in disclosing their participation, industry observers will likely watch whether this kind of AI-driven vulnerability discovery becomes a standard practice health IT vendors reference publicly. Given health system CIOs’ continued push for their own direct access to tools like Mythos, this Epic Project Glasswing Mythos disclosure may accelerate broader conversations about how healthcare organizations, not just their EHR vendors, can benefit from similarly advanced AI-driven security testing as the industry’s cybersecurity arms race continues intensifying.
For more healthcare industry updates, insights and news, visit DistilINFO. Click here to subscribe to stay informed.
