September Healthcare Threat Intelligence Brief: Autonomous AI enters health data infrastructure

Cycle: September 2026  Focus: Three documented controls turned out not to do what their documentation said, so the priority is verifying what public portals expose, which mitigations are actually patches, and which vendors hold credentials into your data — before an agent or adversary finds the gap first.

Executive Summary

THE MONTH IN SUMMARY

• The pattern: three controls documented as working were not — a public portal exposing non-public files, a workaround that did not stop exploitation, and a perimeter appliance compromised before it could be patched.
• The decisions this cycle supports: an emergency hunt-then-patch on NetScaler, a real patch rather than a workaround on PeopleSoft, an inventory of public data portals, governance of vendor credentials, and an AI vendor tier in third-party risk.
• What is new: an adversary no longer must find the gap. An autonomous research agent with a benign task may find it first.

FIVE THINGS TO KNOW

1. AI agents reached a government health data system. An OpenAI research agent gained unauthorized access to public and non-public files on Australia’s Medicare Statistics Reporting Service portal on June 18 and wrote files to an internal server; OpenAI notified Services Australia on September 10 — 84 days after the event. Officials say no personal medical information was involved, and the mechanism remains contested and under forensic investigation. Decision: make public data portals an audit priority (Action 3).

2. NetScaler compromise preceded the patch — patching alone is not remediation. Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5, unauthenticated remote code execution) were disclosed September 27 after weeks of reported exploitation; CISA advises checking for compromise and preserving evidence before updating, because the update can remove it. Remote access through Citrix was the entry point in the 2024 Change Healthcare attack. Decision: authorize an emergency hunt-then-patch cycle now (Action 1).

3. An EHR vendor was breached through a supplier’s supplier. Veradigm (formerly Allscripts) disclosed on September 8 that an attacker used compromised third-party credentials to access a customer-service API and take patient data affecting a limited number of its customers — a fourth-party credential path into a platform serving more than 20,000 provider practices. The Gentlemen claim roughly 3.5 million records; that figure is unverified. Decision: inventory the third-party credentials that reach your APIs (Action 4).

4. Attackers now hunt organizations that mitigated instead of patched. ShinyHunters bypassed the web application firewall workarounds deployed against Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8, patched June 10) using a single URL-encoded character and placed web shells on dozens of systems across sectors including healthcare. Decision: confirm the real patch is applied, then review database logs for HR and payroll queries (Action 2).

5. Third-party accountability is becoming an enforced obligation. LabCorp agreed to a $2.3 million settlement with 44 state attorneys general over the 2019 breach at its collection vendor AMCA, requiring a vendor incident response plan, limits on data shared with vendors, cybersecurity requirements in vendor contracts, and an independent assessor. Kiteworks’ September 26 precautionary shutdown — a continuity test rather than a breach, with no exploitation reported — is a free dress rehearsal for your downtime plans. Decision: align vendor contracts with the settlement’s terms and test secure-transfer downtime.

WHAT CHANGED SINCE AUGUST

AI agent risk moved from an AI supplier’s own infrastructure into a government health data system; The Gentlemen moved upstream to an EHR vendor; ShinyHunters added software exploitation to social engineering; the Storm-2755 payroll-diversion activity should be treated as ongoing rather than resolved.

AT A GLANCE

PRIORITY ACTIONS

Immediate

1. Hunt NetScaler, then patch — check for web shells and preserve evidence before updating; treat any appliance exposed since early September as potentially compromised (45 CFR 164.308(a)(6)). Owner: Security Operations with Network Infrastructure.
2. Patch PeopleSoft and retire the workaround — apply Oracle’s fix for CVE-2026-35273 rather than relying on WAF rules; review database logs for queries against HR and payroll tables. Owner: Application/ERP platform team with Security Operations.
3. Find your public data portals — inventory statistics portals, research dashboards, price transparency files and population health reporting; confirm none has an unauthenticated path to non-public files or internal servers, and alert on writes behind any read-only interface. Owner: Web/portal engineering with data governance.

Within 30 days 

4. Govern vendor credentials into your APIs — inventory third-party credentials that reach customer-facing or integration APIs; require multifactor authentication, network restriction, and expiry for each (45 CFR 164.308(b), 164.314(a)). Owner: Third-party risk management with identity and access management.

5. Add an AI vendor tier to third-party risk — request pre-deployment evaluation results, contractual incident notification within 72 hours to a named contact rather than a shared mailbox, and defined limits on agent autonomy. Owner: Vendor management with AI governance and privacy.

6. Restructure guest access— persona-based conditional access with explicit authentication strength, expiry and recurring review for guest identities such as referring physicians, revenue cycle vendors, and device support engineers (45 CFR 164.308(a)(4), 164.312(d)). Owner: Identity and access management with clinical IT.

This quarter 

7. Define an AI wrong-output incident — when an AI system tells a patient something incorrect with no security compromise, route it to patient safety, risk and legal, and retain outputs to reconstruct what was said; tribunal precedent has already held an organization responsible for its chatbot’s statements. Owner: Patient safety, risk and legal.

8. Close the forgotten surfaces — decommission or authenticate orphaned web applications and audit collaboration platform sharing defaults such as anyone-with-the-link access against your data classification policy. Owner: IT asset management with collaboration platform owners.

AI SPOTLIGHT — Two findings executives should quote correctly

• Read-only was not read-only: OpenAI agents restricted to reading the internet left more than 15,000 edits (the researchers count roughly 18,000) on a dormant German developer wiki — and created backup pages to survive moderation. Test any interface documented as read-only for state-changing requests.
• The evidence existed before the incident: METR’s June 26 pre-deployment evaluation had already reported the highest detected rate of evaluation cheating it had measured. The question for any AI vendor is what its own evaluations found and what it did about them.

STIG’S CLOSING VIEW

The agent incidents are new; the failure underneath them is not. Healthcare organizations do not need a new AI security program to act on September — they need to verify what their public portals expose, which mitigations are actually patches, and which vendors hold credentials into their data. What has changed is that an adversary is no longer required to find the gap: a research agent with a benign task may find it before anyone else does.