Loading story…
Kinney Drugs customers in Vermont and New York reported widespread problems after the pharmacy chain introduced an AI prescription refill assistant called Burt in May 2026. Patients said the system submitted inaccurate refill requests, failed to find accounts, ordered incorrect dosages, delayed prescriptions, and sometimes did not alert them when medications were ready for pickup. Some customers said the assistant was difficult to understand and pushed them into using the automated system even when they wanted other options, prompting some to transfer prescriptions or avoid phone refills altogether.
The rollout also raised concerns about how protected health information is handled. Kinney Drugs said the AI tool was built by Texas-based Synerio, and company terms reportedly warn that the system may be inaccurate or misleading while treating the provision of a phone number as consent to interact with it unless customers later opt out. Privacy experts and attorneys said the arrangement highlights gaps in oversight as healthcare providers adopt AI tools that may share sensitive patient data with third-party vendors, leaving some rural customers with few practical alternatives despite safety and privacy worries.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Kinney Drugs implemented an AI prescription refill assistant called Burt for pharmacy customer interactions and refill requests. The tool was built by Synerio and introduced as part of the chain's efficiency efforts.
After Burt's deployment, customers in Vermont and New York reported inaccurate refill requests, delays, account lookup failures, incorrect dosages, and missed pickup notifications. The rollout also triggered concerns about consent and protected health information being shared with third-party AI tools, and some customers said they transferred prescriptions elsewhere or stopped using phone refills.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
boingboing.net
Open sourcevtdigger.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AI-driven healthcare tools are expanding rapidly, but legal and security protections for patient data often lag behind their clinical ambitions. Reporting highlighted that consumer-facing medical chatbots and AI health offerings from **OpenAI**, **Anthropic**, and **Google** may fall outside **HIPAA** obligations in many common use cases, meaning sensitive health information shared with these services may not receive the same statutory protections as data handled by regulated healthcare providers; experts warned that terms-of-service promises are not equivalent to regulated safeguards and that non-HIPAA consumer health data can be sold or shared with third parties, including data brokers. Separately, an investigation summarized from Reuters described patient-safety concerns tied to “AI-enhanced” medical devices, citing lawsuits and FDA adverse-event reporting that allege AI-related changes contributed to serious surgical injuries. One example involved an AI-updated sinus surgery navigation system where reported malfunctions increased sharply after an AI “enhancement,” though the reporting noted FDA incident data is incomplete and does not by itself prove causation; the same coverage also pointed to a higher recall rate for FDA-authorized medical AI devices versus baseline and described FDA capacity constraints in reviewing AI-enabled devices due to staffing losses in relevant technical teams.
Jun 29, 2026
The deployment of AI-powered chatbots in healthcare is raising significant concerns among governance analysts and security experts. With the recent launch of ChatGPT Health by OpenAI, users can now connect medical records and wellness apps to receive personalized health guidance, a service reportedly used by over 230 million people weekly. Google has also entered the space through a partnership with health data platform b.well, indicating a trend toward broader adoption of AI-driven health advice. Experts warn that while some AI errors are obvious, others—such as plausible but potentially dangerous recommendations—may go undetected, especially for vulnerable populations. The lack of regulatory oversight and the inherent limitations of large language models, which generate authoritative-sounding responses without true understanding or uncertainty calibration, amplify these risks. Security professionals highlight the concept of "verification asymmetry," where users may be unable to distinguish between accurate and harmful advice generated by AI chatbots. This asymmetry, combined with the probabilistic nature of AI models, means that failures can be subtle and difficult to detect, potentially leading to adverse health outcomes. The rapid integration of AI into healthcare underscores the urgent need for robust governance, transparency, and safety mechanisms to mitigate risks associated with automated medical guidance and the handling of sensitive health data.
Jun 29, 2026
Security researchers reported that AI assistants with web-browsing/URL-fetch features can be repurposed as **stealthy command-and-control (C2) relays**, allowing attackers to proxy commands and exfiltrate data through legitimate-looking enterprise traffic. Check Point’s proof-of-concept, dubbed **“AI as a C2 proxy,”** demonstrated abuse paths against **Microsoft Copilot** and **xAI Grok**, including scenarios that do not require an API key or even a registered account, complicating common mitigations such as key revocation or account suspension. Separately, organizations are responding to broader **AI data security and privacy** concerns by restricting AI tooling: the **European Parliament** reportedly disabled built-in AI features on lawmakers’ work devices due to uncertainty over what data is uploaded to AI vendors’ cloud services and the risk of sensitive correspondence exposure. In healthcare, ECRI Institute researchers flagged **AI chatbots** as a leading 2026 health-tech hazard, citing safety, security, and privacy risks from unvalidated clinical use, alongside ongoing concerns about IT outages and legacy medical device cybersecurity—reinforcing that AI adoption is increasingly being treated as a governance and risk-management issue, not just a productivity upgrade.
Jun 29, 2026