The Bandwidth: Decoding Health + AI

1) The months we were warned about may be here

Back in August, OpenAI, Anthropic, Microsoft, AWS and more than 100 other companies signed an open letter warning that organizations had only months to prepare for AI-enabled cyberattacks, with hospitals named among the likely targets. If you were paying attention this week, it feels like that moment has arrived. Researchers found a flaw in PHP, the code behind roughly 70% of the world's websites. The problem had been known for some time but went unaddressed because people thought hackers didn’t have the tools or know-how to exploit it. AI changed that calculus, and it became serious enough that governments took sites offline and Congress locked down file uploads while they patched. Separately, a security firm reported that a hacking group used AI agents built on Claude and Grok to automate break-ins at more than 400 Latin American banks and payment apps. And we learned this week that an OpenAI model hacked into a government site to get hospital-bed data.

Not every attack needs AI to land. Last week, hackers took over hundreds of supermarket refrigeration systems across France, cranking some up to 122 degrees Fahrenheit, spoiling food and sparking fires. Early reports didn’t make clear whether AI was used to facilitate the attack, but few of us would have put grocery store fridges on a list of likely targets, and that's the point: attackers can be more imaginative than the rest of us, and AI now lets them test every idea, rapidly.

2) Privacy pro tip

I was recently talking with a friend who, like me, has an AI chief of staff. It's connected to their work and personal email and calendars. So they were surprised when the bot sent a reminder about a prescription renewal. They never connected their health data to any of these tools directly. They didn't need to. The bot had read an email from their pharmacist. A pro tip for anyone thinking about connecting an agent to external apps: think hard about what information flows via those apps, because it's an easy way for the bot to pick up details you never explicitly gave it.

That matters more as agents multiply. I wrote about them two weeks ago, and this week Anthropic rolled out Claude Duet, an agent that runs on its own cloud computer, checks your connected apps every few hours, and messages you when something needs you (more on it below). It asks for your OK before sending messages or making payments. Those types of controls are important on the developer side, but another layer of protections might be needed by the organizations the bots are interacting with.

Banks are already living this. Axios reported this week that JPMorgan, Bank of America, Morgan Stanley and Citi are restricting outside AI agents after finding them logged into customer accounts with customers' own passwords, some calling support lines or taking actions no one asked for, and one executive admitted they struggle to tell a customer's agent from a rogue one. Swap "bank account" for "patient portal," and it's not hard to see health systems facing the same question soon.

If you want to go deeper, the Alliance for Health Policy hosted an AMA-sponsored briefing on health data privacy in the AI era on Capitol Hill this week. For anyone who missed it, the event page has a solid list of resources and experts on the topic, including yours truly.

3) Could Wall Street become another AI watchdog?

Anthropic is expected to go public before Thanksgiving, and OpenAI is heading the same way. Investors say the timing isn't optional: a draft prospectus seen by The Wall Street Journal puts Anthropic's computing commitments as high as $750 billion, more than private fundraising can cover. I'm not suggesting an IPO replaces state and federal rules. But a public company answers to a different crowd.

Private investors bring their own accountability (remember when OpenAI's board tried to oust Sam Altman?). And the private labs are sharing certain information. This week, OpenAI disclosed new cases of its own agents switching off their safety monitoring, with one model then telling a user it hadn't. But going public adds layers a private company doesn't face: federal securities rules that require disclosing material risks, stock exchange rules that require a mostly independent board, and shareholders who can vote with their feet every trading day.

Look at Bank of America earlier this month. The day after regulators fined it $1.2 billion for anti-money laundering lapses, the largest fine the Comptroller of the Currency has ever issued, its stock fell more than 8% before closing nearly 5% down. The fine was the regulator's verdict, and the stock drop was the market's. Once the labs are public, an incident like the agent break-ins in this week's news will get both. Whether that makes them more careful is the open question.

Anthropic sets aside 5% of its shares for a new public benefit fund — Anthropic, the company behind Claude, plans to put 5% of its stock (pending shareholder approval) into a new fund for the public good, adding 2% more each time the company's value climbs 50% past a set mark, on top of a separate $200 million pledge to study AI's effect on jobs.

Drugmakers keep piling into AI deals — Reuters' running list of drugmaker AI partnerships now spans dozens of deals since January 2025, including Lilly's up-to-$1 billion robotics lab with NVIDIA and Merck's $1 billion Google Cloud commitment, on industry hopes that AI can cut early drug development time and cost in half within three to five years.

AI could help medical device makers find their own product information, a software executive argues — Medical device companies keep details about their products spread across separate computer systems that don't talk to each other, and Chuck Serrin of Propel Software, which sells product-data software, argues AI assistants can now pull answers from all of them at once, as long as every answer is tracked and based on approved records.

Epic will let its AI assistants work inside other companies' apps — Epic's new Connectors will let its AI assistants for patients, clinicians, and billing staff look up information and take actions in outside apps, such as checking an ambulance's arrival time or placing a patient's meal order, with each health system approving every connection before it goes live; developer listings open in March 2027.

OpenAI buys a startup to build out its drug research business — OpenAI acquired Orchestra Bio, whose AI agents handle back-office work for drug companies such as tracking finances and fixing clinical trial scheduling, and is folding it into Rosalind, its life sciences model already used by Moderna and Novo Nordisk.

Zoom adds an AI note-taker for doctors to its calls and video visits — Zoom's updated Clinical Notes turns in-person, video, and phone visits into draft medical notes and suggested billing codes inside the Zoom tools clinicians already use, with notes sent to the health record through standard connections.

AI agents are speeding up clinical trial recruitment, but the evidence is still early — Companies including Hippocratic AI, ConcertAI, and Medable say their AI agents can call interested patients within minutes instead of days, find eligible patients who would otherwise be missed, and handle much of a trial's paperwork, and a Tufts analysis done with Medable estimated about $4.4 million in savings on a mid-stage trial, though independent, long-term proof is still lacking.

Anthropic previews Claude Duet, an AI agent that keeps working while you're away — Anthropic opened a waitlist for Claude Duet, an early-stage agent for US Pro and Max subscribers that takes on tasks by text message, works on its own cloud computer in the background, sends a morning briefing, and asks permission before sensitive steps like sending messages or making payments.

FDA clears an AI tool that predicts breast cancer recurrence from a standard MRI — A newly FDA-cleared tool from SimBioSys uses the breast MRI a patient already gets at diagnosis to estimate the odds that the most common type of early-stage breast cancer comes back, and in a look back at 2,129 women, 95.5% of those it rated low risk were cancer-free after five years, versus 89.6% of those rated high risk.

UCHealth says nurse buy-in, not the model, is the hard part of AI deployment — Nurse leader Brittany Cyriacks says UCHealth's biggest AI challenge two and a half years in has been getting nurses on board, which it tackles by teaching them how the tools work and involving them in design, and it is now trying to measure how time saved by AI note-taking gets put back into patient care.

Oncology is becoming AI's proving ground, a US Oncology executive says — Jackie Njoroge of US Oncology, a large network of cancer doctors, describes AI drafting visit notes, summarizing patient charts, booking treatments, and handling insurance approvals, and argues success depends on doctors trusting the tools and on treating AI as a change in how the organization works rather than new software.

Doctors are using AI more to choose treatments than to make diagnoses — A JAMA study of 38.8 million questions clinicians asked the AI tool OpenEvidence found that treatment decisions made up a third of doctors' questions, versus 14% for diagnosis, as monthly users grew from 355 in January 2024 to more than 700,000 by June 2026.

What it takes for a health system to be AI-literate — Leaders from Johns Hopkins, Baptist Memorial, and Centralus Health say AI literacy means knowing when not to use a tool, asking what data a model learned from, and taking stock of the AI already in use, as a Wolters Kluwer survey finds 74% of physicians use generative AI at least weekly.

Health system leaders say they still won't let AI act on its own — Technology chiefs at Mass General Brigham, Yale New Haven, CommonSpirit, UCHealth, and others tell Becker's they keep a clinician between AI and the patient, holding back tools that diagnose, order, or treat on their own until oversight and liability rules catch up.

Google's AI interviews patients before appointments to free up doctor time — In a Google study, patients chatted with its AMIE model before seeing their doctor, and physicians said the AI-gathered history and summary let them spend the visit working with patients instead of collecting information, with a nationwide randomized study planned next.

Israel's Sheba Medical Center aims to be a fully AI-run hospital by 2030 — In a conversation with Chip Kahn for AEI and KFF, Sheba's chief AI officer Eyal Zimlichman describes the hospital's push to run on AI by 2030 and argues doctors will need to become more humane to stay distinct from the machines.

Anthropic quietly pitches its own AI safety bill to lawmakers — A draft bill Anthropic has been shopping to Congress would let the government stop the release of an advanced AI system only if it posed an immediate risk of more than $1 billion in damage or more than 50 deaths or serious injuries, would have outside reviewers check the systems, and would override some state AI safety laws.

Hospices say AI-driven fraud hunts are sweeping up legitimate providers — Medicare's AI-powered fraud detection system, along with tools used by the FBI and HHS's watchdog office, is flagging hospices in fraud-heavy states like Arizona, California, Nevada, and Texas, and lawyers warn that honest providers are getting caught up too, facing 10-year bans from Medicare if their licenses are revoked.

Regulate how AI is built, not just how it's released, two policy veterans argue — Georgetown's Mark MacCarthy and former Gore domestic policy advisor David Beier argue that this summer's AI break-ins happened while companies were still testing their systems, so the rules should cover how AI is built, with the FTC able to penalize companies that skip safety steps.

CMS official admits much of Medicare's AI prior authorization test isn't working — CMS Deputy Administrator Kimberly Brandt said "a lot of things" about WISeR, the AI-assisted prior authorization pilot running in six states, aren't working, though she didn't say which, and CMS hasn't released data on delays or overturned denials.

States are writing their own rules for AI chatbots that act like doctors — Lawyers at Holland & Knight count 20 states that had passed AI laws touching health care by midyear and seven that now ban or restrict AI therapy chatbots, as Pennsylvania's medical board accuses a Character.AI chatbot that claimed to be a licensed psychiatrist of practicing medicine without a license and Utah lets AI refill some prescriptions under phased doctor review.

FDA expects draft generative AI device guidance within months — FDA digital health director Rick Abramson said the agency received more than 500 comments on its generative AI discussion paper, that the issue has the attention of the White House, and that draft guidance, including one on AI tools for mental health, should come "in a matter of months."

AMA, AHA, and US Chamber tell FDA how to regulate generative AI devices — In comments due Oct. 19, the AMA pushed for real-world testing and physician-set performance standards, the AHA asked that developers carry the burden of ongoing monitoring, and the US Chamber called for a lighter review path for lower-risk tools.

Digital health industry groups tell FDA that AI makers, not doctors, should answer for mistakes — Tech and telehealth trade groups, including the Connected Health Initiative, the American Telehealth Association, and the Consumer Technology Association, told FDA that the companies building AI devices should carry primary responsibility when those devices cause harm, and several urged the agency to partner with states on voluntary test programs to rein in the growing patchwork of state AI laws.

An OpenAI model broke into a government site to get hospital-bed data it had been refused — OpenAI disclosed that one of its AI systems, during training, hacked into an unnamed government statistics website after being turned away, grabbed 24 years of hospital-bed data when it was asked for one, and never mentioned the break-in, even though it had already found the number through an ordinary web search.

Healthcare had an alignment problem long before AI — Robert Wachter argues that patients, doctors, insurers, and hospitals have never fully shared the same goals, so AI tools will quietly build in someone's values and apply them at scale, and he calls for showing patients and doctors the tradeoffs side by side and disclosing AI companies' financial ties.

AI chatbots' youth safety policies fall short in practice, Penn researchers find — A Nature Mental Health policy brief from Penn's SAFELab compared the stated youth well-being policies of ChatGPT, Gemini, Copilot, Meta AI, and Character.AI with how the chatbots actually respond, found a gap, and calls for enforceable standards built around young people's developmental needs.

Criminal groups are already running AI-driven hacking operations, a security firm finds — Security firm NorForge found more than 20 exposed control panels for Cairn, an AI system that directs teams of AI agents to break into websites, with one group aiming at payment and pharmacy sites and an estimated success rate of about 10%.

Altman lays out three endgames for safe AI, including one he calls terrible — OpenAI CEO Sam Altman told staff the industry has floated three ways to build advanced AI safely: an international watchdog modeled on the global nuclear agency, which he appeared to favor; merging the major labs into one body; or letting a single company grow powerful enough to cut off everyone else's computing power, an option he called "terrible."

Bias in medical AI shows up across specialties, but there's no shared way to measure it — A review of 92 studies in Communications Health finds AI chatbots and medical AI tools sometimes give different advice depending on a patient's sex, race, insurance, or income, in one case sending an uninsured chest-pain patient to a community clinic instead of the ER, and researchers still don't agree on how to measure the problem.

A photo of your face may help predict cancer survival, Mass General Brigham researchers say — Writing in Lancet Digital Health, researchers describe an AI trained on 40 million face images that estimates a person's biological age from a photo, and found that the gap between a cancer patient's "face age" and actual age was linked to how long they survived.

Penn's AI spots hidden disease in CT scans ordered for something else — Penn Medicine's Percival, trained on about 400,000 CT scans, picked up signs of conditions such as pancreatic cancer, liver scarring, and kidney disease that a scan wasn't ordered to look for, according to a study in npj Digital Medicine, though the tool is still in preclinical testing.

The best AI agents still finish less than half of real clinical and office tasks — Stanford researchers report that on 100 realistic tasks inside a simulated health record, the top model finished 46% on its first try, and on prior authorization and appeals work the best agent finished 36%, often because it wrote down an action but never actually carried it out.

Anthropic's Jack Clark tells the IMF AI has started speeding up science on its own — In a lecture to the IMF, Clark pointed to drugs largely designed by AI that are already in clinical trials and warned that testing and approval could become the next bottleneck, with biology needing the strictest human oversight.

AI note-takers are quietly deciding what goes into your medical record — University of Michigan researchers argue that AI scribes now shape the records used for billing, research, and care decisions, and warn about made-up content, weaker performance with some accents, and accuracy that slips over time.

Leaning on AI instead of coworkers erodes trust on teams, survey finds — A survey of more than 1,000 US workers found that people who turn to AI instead of colleagues trust each other less and coordinate worse.

AI triage tools deprioritized patients with stigmatizing history — UT Southwestern researchers found that when emergency room records mentioned details like frequent visits or past psychiatric emergencies, three AI models were more likely to rank patients as lower priority even when they later got worse, in some cases downgrading nearly 10% of them.

Researchers band together to study how AI chatbots shape kids' development — A new AI Psychological Research Coalition, meeting at UNC Chapel Hill with experts from seven countries and the WHO, heard UNC's Mitch Prinstein report that more than half of 2,000-plus middle schoolers surveyed in one state already use chatbots, and that two to four kids per classroom say they'd rather talk to a chatbot than a classmate.

AI matched expert sonographers at dating pregnancies from quick ultrasound sweeps — In a JAMA Network Open study in Chicago and Nairobi, a Google AI model reading simple ultrasound sweeps done by non-specialists on a handheld probe estimated how far along a pregnancy was to within about four days, slightly better than expert sonographers, including in Nairobi where it had no local training data.

Researchers test an AI health coach built from three specialist agents — A Nature study describes a prototype that combines an AI data analyst, medical expert, and coach to give advice from smartwatch data, and a companion commentary notes its data analysis failed automated correctness checks more than a fifth of the time and says only randomized trials can show whether such tools improve health.

Microsoft says its AI beat generalist doctors on hard diagnoses, with caveats — In a Science study using complex New England Journal of Medicine cases, Microsoft's MAI-DxO, which has several AI agents question a patient, order tests and debate a diagnosis, got the answer right 83% of the time versus 36% for primary care doctors working alone, though specialists weren't part of the comparison and much of the gain came from the underlying AI model rather than Microsoft's system.

Hospitals and health plans are dropping tech vendors that don't pay off — About 55% of health plans and 46% of health systems now tie what they pay tech vendors to promised results, according to a Peterson Health Technology Institute survey, and executives at Baptist Health and Highmark say they will walk away from vendors that don't keep their technology current or show a return.

Healthcare AI needs shared infrastructure, not more point solutions, Ambience co-founder argues — Mike Ng of Ambience Healthcare argues hospitals keep buying one-off AI tools that don't talk to each other and instead need a shared foundation that pulls a patient's scattered records into one place, noting that at one academic medical center a single chart-prep tool used by about 10% of doctors already generated more activity in the electronic health record than every other person and program combined.

Companies give AI to single departments, but the wasted time sits between them, economists find — Economists from the University of Chicago, Yale, and the University of Washington surveyed workers at large US companies and found they spend 37% of their day on the work between departments, like pulling numbers out of different systems, reconciling them, and meeting to get everyone on the same page, which today's AI tools mostly miss because each one sits inside a single department's system.

Most workers feel both excited and anxious about AI, and leaders should say so out loud — In a survey of 500 professionals, Liz Fosslien, Mollie West Duffy and Kim Scott found nearly everyone described mixed feelings about AI at work, and they advise leaders to acknowledge that tension openly, give teams room to experiment and laugh at AI failures, and be specific about how time saved will be put back into their people.

👉 Nov. 5 — Cooley Healthtech Talks — Webinar series (virtual)

👉 Nov. 7–11 — AMIA 2026 Annual Symposium — Dallas, TX

👉 Nov. 10 — National Digital Health Policy Summit — Washington, DC

👉 Nov. 11–13 — AIMed26 — Orlando, FL

👉 Nov. 15–18 — HLTH USA 2026 — Las Vegas, NV

👉 Nov 17 — Building the foundation for clinical AI: Lessons from Stanford Medicine & The Hospital for Sick Children — Webinar (virtual)

👉 Nov. 19, 1 p.m. ET — Reimagining Payment Integrity with AI — Webinar (virtual)

👉 Dec. 1, 11:59 p.m. ET — Abstracts due: Generative AI in Health Care: Law and Regulation — Petrie-Flom Center, Harvard Law School

👉 Dec. 8–9 — Stanford AI+HEALTH 2026 — Virtual

👉 Dec. 11–12 — Cedars-Sinai AI in Medicine Symposium — Los Angeles, CA

👉 Dec. 16 — The Next Phase of AI Adoption: Governance, Ethics, and Accountability — Virtual

👉 Jan. 11–14 — J.P. Morgan Healthcare Conference — San Francisco, CA

👉 ~Jan. 31 — White House AI task force report due — Led by Director of National Intelligence Jay Clayton

👉 Feb. 18, 11:59 p.m. ET — Papers due: Applications of Artificial Intelligence in Healthcare — NBER