Accessed, never disclosed: Silent access to protected health information by medical artificial intelligence agents

Summary

Researchers embedded canary identifiers in synthetic patient records and tracked tool invocations across five language models, four boundary levels, and seven attack frames for identifier-free clinical tasks. Three models invoked PHI tools unnecessarily, while Claude Opus 4.8 and GPT-5.5 did not. Stronger boundaries reduced this access, and a pre-execution gate given the task-necessity criterion nearly eliminated it.

Mitigation

A pre-execution gate given the task-necessity criterion, together with boundaries and access-log audits; the source states that output-only evaluation cannot verify minimum-necessary access and that these controls are required together.

Related items

• InfoChatGPT will now make you animated GIFsSame vendor · The Verge (AI)
• MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSame vendor · The Hacker News
• InfoForrester gave Endor Labs the highest score possible in seven criteria, including innovation, AI application flaws, AI SCA, and AI coding toolchain. | Endor LabsSame vendor · Endor Labs Blog
• InfoUber only fulfilled 4 rides from AI agents last quarterSame vendor · The Verge (AI)
• InfoSam Altman addresses RAM comments: People should ‘put as much as they want in their computers’Same vendor · The Verge (AI)