Courtesy of Pexels - AN Nhol. Classic concentration of food poisoning risk.
TL;DR
Consolidation of workflows into a single platform inherently concentrates risk.
Enterprise healthcare IT is shifting to treating AI orchestration platforms with the same level of zero-trust security reserved for core banking networks.
Intro
I spoke recently to a founder of an AI company that processes MRI imaging. The GTM plan is to use an AI imaging orchestration platform provider like Aidoc.
Makes total sense in terms of market access.
And problematic in terms of cybersecurity and risk management.
Orchestration platforms are particular interesting to attackers - since a single vulnerability opens multiple attacker entry points to all the platform clients.
AI orchestration platforms
Like free access to the safe-deposit box room in a bank.
Nov 4, 2026, FDA posted a Class II recall on 560 IntelePACS software platforms.
IntelePACS is a cloud-based and enterprise Picture Archiving and Communication System (PACS) developed by Intelerad Medical Systems (part of GE HealthCare).
IntelePACS is an open platform orchestration engine. It allows hospitals to ingest, launch, and view the outputs of third-party AI algorithms.
The cybersecurity vulnerability allows an attacker to take over an administrator session, modify or delete image and study data, or lock legitimate users out.
A separate software defect could unintentionally delete images through an external archive integration. accessdata.fda.gov
There are other Class II recalls on file for IntelePACS, such as a prior 2025 bug involving data loss
The hospital enterprise network is a battlefield
On a battlefield - you need to survive if you want to execute your mission.
Platforms that make medical imaging available in a hospital can become an attacker entry point to alter or remove the clinical evidence used by the AI device.
If you’re an AI imaging founder, selling PACS integration as a feature (basically everyone) - you now have to think about the vulnerabilities in your platform provider.
FDA is not recalling your product.
It’s recalling the product you need to provide service to your customers.
What I really loved was the FDA language in the recall:
Pending corrections by Intelerad, you can continue to use your system by continuing to follow your organization's standard cybersecurity and access control practices until the corrective update is implemented.
How does FDA know that standard cybersecurity and access control in a hospital mitigate the vulnerability?
They don’t and cannot.
They have no way of knowing if the hospital actually implemented the controls or if the controls are misconfigured or if the client system that is exploited by the platform vulnerability mitigates the attack.
Intelerad describes IntelePACS as supporting simplified image routing and retrieval, remote reading and “limitless integrations” with archives, worklists and other software. Its product page explicitly includes third-party AI programs. Intelerad
The idea is to help radiologists make better decisions for patients.
The flip side is that it increases the threat surface to hospitals and patients.
An integration that reads an image has limited rights. An integration that creates derived images, writes annotations, changes workflow status, updates reports or manages studies has much more.
The access permissions enable an AI decision support device to work but it doesn’t protect the AI device from attacks via the orchestration platform.
Since the recall notice does not disclose the exploit mechanism, preconditions or root causes - AI device vendors connecting to to platform need to be robust enough to survive on the battlefield of the hospital network.
And not assume that standard cybersecurity and access controls protect them.
The attack scenarios
There are several plausible attack scenarios for orchestration platforms.
Right answer wrong patient. An attacker modifies a study before an AI model processes it. The model produces a technically correct result for the wrong patient.
Context deletion. An attacker deletes the prior study used for longitudinal comparison. The clinician sees apparent progression or improvement without the missing context.
Loss of connectivity. A workflow component loses access to PACS. The AI product continues processing what remains in its queue while the clinical team assumes it has seen the complete study population. Which it hasn’t.
Loss of evidence. The AI result is correct, but the source image or derived evidence was deleted by an attacker. Now the company cannot reconstruct what the model saw when a complaint arrives.
The “Single Point of Failure” (API Hijacking). Orchestration systems rely heavily on APIs to send data back and forth between disparate clinical systems. If an attacker exploits an insecure API endpoint or steals an orchestration token, they can perform a Man-in-the-Middle (MitM) attack. Instead of just stealing data from one vendor, they can sniff data passing through the central hub from all connected AI tools.
Supply Chain Poisoning (Third-Party Container Flaws). A platform orchestrates third-party AI algorithms alongside its own. These tools are often delivered as containerized applications (like Docker containers). If a third-party AI vendor uses an outdated, vulnerable open-source library inside their container, and the orchestrator doesn’t heavily sandbox that container, an exploit could allow an attacker to escape the container and compromise the platform.
Data Ingestion Exploits (Pixel & Metadata Payloads). Because an AI orchestrator must actively unpack and parse incoming pixel data and metadata to determine which AI model to run, it is vulnerable to maliciously crafted DICOM files. A hacker who has already gained low-level access to a hospital network could send a corrupt image file with an embedded buffer-overflow exploit. When the orchestration platform attempts to scan the file to route it, the exploit triggers, giving the attacker administrative execution rights on the server.
Who owns platform vulnerabilities?
Your problem, hospital problem or platform provider problem?
An AI medtech company could look at this as a set of hospital IT risks.
What was once called - OPM - ‘other peoples money’.
OPM is a convenient and wrong attitude to take.
If your safety and efficacy claims depend on receiving the correct study from PACS and returning a result to the proper patient workflow, PACS integrity is part of your product’s risk boundary.
It’s nasty - you do not own the PACS but you own assumptions about the PACS.
FDA reinforced this point in its updated medical-device cybersecurity FAQ on November 5.
A Vulnerability Exploitability eXchange statement, or VEX, is not a substitute for a vulnerability assessment. FDA says the manufacturer must assess the vulnerability in the context of the system, including how it may combine with other vulnerabilities.
FDA is equally blunt about off-the-shelf software: the device manufacture is responsible for its security and safe performance. FDA
Traditionally FDA and RA/QA teams look for documentation including cybersecurity testing documentation.
In the case of an orchestration platform - an SBOM entry saying “PACS supplied by hospital” is documentation.
But documentation is not a security countermeasure.
You could disconnect the AI device - but then it would be useless without the platform connectivity.
So what are effective countermeasures when an AI device connects to an orchestration platform?
Here are a few ideas:
Constrain authority. Use a dedicated service identity rather than shared administrative credentials. Separate read access from write access. If the product only needs to create a result, do not give it permission to alter the source study. Make deletion a different privilege entirely.
Provide traceability. Record the identifiers, versions and cryptographic hashes of the source objects used for inference. Reconcile patient, study and series identifiers before returning the result. Keep an immutable evidence trail outside the system that can modify the clinical record.
Test ugly edge cases. What happens when PACS returns an incomplete series? When the source image changes after inference? When the archive is unavailable? When the AI result cannot be written back? When credentials are revoked halfway through a transaction?
Ask hard questions. Did the UAT test the ugly edge cases?
For a medtech company - I suggest we stop treating hospital integration as plumbing owned by an integration team.
For hospitals - I suggest we stop assuming that the AI device you installed can survive on the battlefield of your network.
For both vendor and hospital - I suggest we consider access controls as only part of defense in depth that includes detecting and limiting lateral movement inside the local network after an attacker hijacks an administrative session.
As in the case the IntelePACS orchestration platform.
Worth reading
FDA, Class 2 Device Recall: Intelerad IntelePACS software, posted November 4, 2026. accessdata.fda.gov
FDA, Cybersecurity Resources for Medical Device Manufacturers: Guidance, Resources, and FAQs, updated November 5, 2026. FDA
Intelerad, IntelePACS product and integration documentation. Intelerad