Healthcare Innovation recently wrote about how the Coalition for Health AI (CHAI) is launching a Health AI Cybersecurity Work Group. During an Aug. 20 kick-off meeting of the group, Rob Bair, head of Cyber and National Security Policy for Anthropic, gave an eye-opening presentation about the threat posed by frontier models and the ramifications for agentic AI. 

Bair, who was formerly director of cybersecurity and operations policy for the National Security Council at the White House, spoke about what the trajectory of AI-enabled cyber attacks mean for healthcare providers, including ransomware economics and resilience.

Bair noted that over the past 18 months, Anthropic’s threat intel team has published three case studies that he says tell a pretty compelling story. He described the work of three actors, each one more autonomous than the last. Case 1 was a solo criminal actor who couldn't code without AI, but who built functioning ransomware to sell. The second case, a financially motivated actor, used AI as a coding agent. The third case, which Anthropic published publicly, was a state-sponsored group using the model as an autonomous intrusion agent, doing a majority of the tactical work with no human in the loop. 

In the final case, the model analyzed what was stolen from the victim organizations, wrote the ransom note with the dollar figure calculated from the victims’ financial records. This is where the AI became a reasoning agent, not just a tool builder. In this case, 17 organizations were attacked in 30 days, spanning a defense contractor, government agencies, emergency services, a church, and a healthcare provider whose patient records were taken.

In each succeeding case, the human did less and the AI did more, Bair said, and the tempo became physically impossible for a human team to keep up with or match. “We can't move at human speed against these new AI cyber-capable models,” he said. 

“The open question we have as a company is what Case 4 looks like. The capability exists today for a Case 4 — a campaign where the role of a human compresses just to target selection and payment collection.”

In June, Anthropic released Fable 5 publicly and Mythos 5 to gated groups. “The important thing to understand here is they are the same model. The difference is the perimeter that we put around those models,” he explained. 

Bair explained that Fable sits behind classifiers that detect requests touching offensive cyber, biology, chemistry, model distillation, and then if those are detected, it hands those sessions to a less capable model, Opus 4.8. Mythos 5, on the other hand, has those cyber safeguards lifted for vetted cyber defenders and infrastructure operators. “The reason this matters for you is the offensive capability exists widely,” he added. “It is being deliberately withheld from general access to give defenders a head start.”

Anthropic is giving defenders a head start because comparable models from other labs, including open weight models, will arrive without the wall of classifiers that Bair talked about. “We're probably somewhere between four to eight months ahead of open weight models now in cyber capabilities, and we've already seen publicly Chinese actors going after Taiwanese state entities using agentic models,” Bair said. “This window is real, and the window that we gave defenders is real, but it's not permanent. It's about to erode very, very quickly.”

Bair noted that healthcare has the longest breach life cycle of any sector — about 279 days from intrusion to containment. Nearly every hospital runs connected devices with known exploited vulnerabilities that can't be patched on a normal cadence because they have to remain up and running. The model is now able to go after vulnerabilities that have not been found. “Our Mythos class model found a 27-year-old flaw in an operating system known mainly for its security, and autonomously wrote a working exploit from a 17-year-old bug. What does that mean? Your imaging fleet, infusion pumps, lab analyzers, legacy interface engines are the kind of code that this class of model is very good at going after.”

The idea of security through obscurity is gone, Bair added, when a model can read the firmware and reason about it. 

Vendor concentration is becoming a force multiplier, he stressed. “One compromised billing or EHR vendor equals hundreds of providers, so that supply chain attack vector is even more real and more important than it was just 18 months ago. That's what we saw with Change Healthcare, and that's the kind of target an autonomous agent is going to find very efficiently and be able to exploit very efficiently.”

Agents within a health system’s walls

Bair also spoke about agents inside health systems’ own environments. “As security professionals, we're still trying to get a grasp on what releasing 1,000, or 10,000, or 100,000 agents inside our environment means for security,” he said. 


One concern is external attacker agents. “In Case 2 that I mentioned earlier, the model exfiltrated the records, analyzed them, identified sensitive subsets, and then drafted the extortion in a single loop,” Bair said. “The time between theft and leverage collapsed from weeks to hours when that agent was working on that case. 

Inside agents include clinical documentation agents, prior auth agents, revenue cycle agents. "They're holding credentials to your systems, the data warehouse, the payer portal,” Bair said. “These agents have broad read and write access and long-running sessions. They're the most capable insider that you're ever deploying, and it does whatever it's told. We don't know how to handle carbon-based life forms today, let alone handle silicon-based life forms inside our enterprises. Agents read fax referrals, scan records, portal messages, vendor e-mails. Instructions hidden in that content can redirect the agent. The attacker never has to touch your network. They touch a document your agent will read, and it directs them to do something that they are not supposed to do.”

Another area he spoke about is tool chains. Agents wired to many tools through protocols like MCP can compose actions nobody approved as a path. Read from here, summarize, send there. Case 3 used the commoditization of MCP servers and tools to direct their agents to do malicious things against other organizations,. They use those agentic tools to do the data exfil on the way out, Bair said. 

What does this mean for security? Bair suggested five things you should fund and the first is agent identity. “Every agent has to get its own identity scoped to the actions that the agent needs, not some borrowed service account with domain-wide read. Least privilege applied to what the agent can do, not only to what it can see. The same things we've been struggling with for humans in our networks, we need to do for our agents.”

Second is egress control, he said. What leaves the agent's boundary, which destinations, the tool calls it's able to do. “Most agent data loss is an agent doing a permitted read followed by some unmonitored send, so we have to get that under control,” he said. 

Third, logging every tool call, and having every input, every output retained and replayable. “This is the audit log of the future, and it's a replay button that allows you to see what your agents have done and how you can separate a hallucinated claim of a breach from a real breach inside of your organization,” he said.  

“Fourth, we have to keep humans in the loop. For irreversible actions, bulk exports, external sends, medication orders, or changes, we’ve got to put the control inside of the loop at the same speed of the agent,” Bair said. “Periodic review is not going to be able to keep up with this. 

Fifth, your EHR, billing, and device vendors are deploying agents into your data. “You've got to ask them the same five questions. Under HIPAA, the business associate is yours to govern. Under the proposed security role update, documenting that governance, it must become explicit in these organizations with your vendors,” he added. 

Today, the median time from first access to encryption in a ransomware case is about four to five days. That window is where we need to build in the detection logic, he said. “Autonomous agents are collapsing it.” 

Reconnaissance, escalation, staging that took crews maybe days to hours to do is now done in minutes. Bair mentioned four things to take away here: health systems need immutable offline backups, reachable only through credentials an attacker can't hold. Two, they need a rehearsed plan to rebuild infrastructure. You need downtime procedures that clinicians have actually practiced: paper orders, manual medical reconciliation and diversion criteria. “All of those things should be rehearsed, because ransomware isn't something that we're expecting on a daily basis. And finally, think about blast radius, he said. “Segmentation is as important as it ever was. You need identity-based access, so an agent that gets in cannot reach everything. The basics that we learned about in security are 10 times more important in an agentic world.”