AI Medical Device Threats: How Attackers Target Connected Care and How Hospitals Respond

According to a 2026 World Economic Forum report, 87% of respondents identified AI-related vulnerabilities as the fastest-growing cyber risks they faced in 2025. Connected device security for hospitals must consider the two different directions from which these threats come. First, an attacker can use AI to exploit connected devices, increasing the volume and velocity of attacks. Second, vulnerabilities in a connected device’s AI can introduce new attack paths.

For hospitals, medical device security requires an approach that sees, prioritizes, and contains every connected device so healthcare delivery organizations (HDOs) can mitigate risk as malicious actors increasingly use artificial intelligence in their attacks.

In this guide, HDOs will learn about the different threats related to Internet of Medical Things (IoMT) and connected medical devices, why hospitals face this risk more than other sectors, and how to build a layered defense that ensures continued uptime.

What AI Medical Device Threats Are

AI medical device threats are attacks that either use artificial intelligence (AI) against connected medical devices or target the AI built into those devices. Although both threats incorporate AI, one means that attackers use AI to deploy attacks while the other means attackers exploit the AI during an attack.

Threat actors use AI to accelerate attack techniques, including vulnerability discovery, phishing, and malware development. These attacks often target Internet of Medical Things (IoMT) devices that lack AI capabilities. Instead, attackers use AI to identify vulnerable, often unpatched or end-of-life devices, like older infusion pumps. Once they identify a vulnerability and gain initial unauthorized access, they move throughout the networks to find and exfiltrate sensitive data or to interrupt critical services.

When threat actors target AI in devices and software, they often attack models, training data, or inputs that connected medical technologies use. For example, a hospital might introduce AI capabilities into existing imaging workflows without replacing the MRI machine or CT scanner. This means that organizations need to monitor legacy medical device cybersecurity and AI-specific cybersecurity risks that exist in different parts of the same imaging workflows.

Attacks on the AI itself become more relevant as manufacturers incorporate AI into clinical technologies. According to the Food and Drug Administration (FDA)’s Artificial Intelligence-Enabled Medical Devices page, the agency has authorized over 1,600 AI-enabled medical devices for marketing in the United States as of September 2026, meaning that healthcare organizations are expanding their attack surface in multiple ways and need to mitigate these new risks.

How Attackers Use AI Against Connected Medical Devices

When malicious actors use AI to accelerate their activities, an attack’s impact can be greater than the healthcare organization previously expected. Further, healthcare providers with compromised systems need to worry about an incident’s impact on clinical operations.

Automated Reconnaissance and Vulnerability Discovery

When malicious actors use AI-assisted reconnaissance, they can identify potential weaknesses in connected systems more rapidly. With AI, they can analyze software, document network-connected devices, and identify publicly disclosed vulnerabilities faster.

Traditionally, threat actors needed to manually research technologies, review vulnerability disclosures, and develop exploits. Now, generative AI can help automate some of this work by analyzing code, identifying suspicious logic, and assisting with exploit development. For example, in May 2026, the Google Threat Intelligence Group (GTIG) AI Threat Tracker identified, for the first time, a threat actor using a zero-day exploit that GTIG believes was developed with AI. Although this attack targeted a system administration tool instead of a medical device, it demonstrates how attackers are poised to use AI against their victims.

For healthcare organizations, these faster tactics mean that malicious actors can extend their tactics and techniques to networks, including medical devices and their firmware, supporting infrastructure, remote access systems, and software services. Even more challenging, many healthcare organizations have a clinical engineering team managing device configurations and a security team managing vulnerabilities across the broader IT and IoMT environments. When information remains siloed, attackers can exploit vulnerabilities neither team fully understands.

Faster Exploitation of Devices That Cannot Be Patched Quickly

When threat actors use AI to build exploits, they increase the pressure on healthcare vulnerability management teams, who often need extended maintenance windows or manufacturer approvals before updating medical devices. For example, according to Verizon’s 2026 Data Breach Investigations Report, 31% of breaches now start with software vulnerabilities, ahead of stolen passwords as the top way attackers gain initial access to systems and networks.

While this finding applies to all industries, it highlights the important role that exploitable vulnerabilities play in the modern-day threat landscape. Meanwhile, healthcare organizations face a unique patching issue. Medical device manufacturers must evaluate and validate software updates to ensure that they do not compromise device safety or effectiveness. Often, healthcare organizations depend on manufacturers to test, approve, and distribute patches before applying them. However, when manufacturers delay updates or discontinue support for older devices, healthcare organizations may have to manage known vulnerabilities without an available patch.

AI-Generated Phishing Aimed at Clinical and Biomed Staff

Threat actors use generative AI to create more realistic and persuasive phishing messages, imitating legitimate workplace communications and targeting specific responsibilities within healthcare organizations. For example, attackers can now send IT, networking, or clinical engineering teams messages that specifically reference equipment maintenance, service contracts, scheduled inspections, or manufacturer support requests. By using details about the organization’s network-connected devices, the messages appear relevant.

For example, an attacker might impersonate a device support representative, asking a technician to open a remote access session. Another message might claim that a security update requires immediate authentication through a provided website. These are plausible requests for the victims and possible attack scenarios.

As healthcare organizations work to mitigate these risks, they should consider providing specific training to address these new phishing threats. Even if a vendor representative or other third party sounds legitimate, people working with these devices daily must verify identities and requests.

AI-Assisted Malware and Ransomware That Disrupt Care

Threat actors are beginning to incorporate AI into malware so that the programs can generate commands, modify code, and automate decisions during execution. Although only a few specific examples exist at present, researchers at GTIG have identified experimental malware that uses an AI model to rewrite its code as a way to evade detection. Further, researchers at ESET have also identified a proof-of-concept ransomware that uses AI to generate malicious scripts and determine whether to copy, encrypt, or exfiltrate files. While these may be emerging rather than widespread use cases, they highlight the way attackers are looking to make adaptable malware that is more difficult to detect.

Healthcare delivery organizations face concerns around how all malware and ransomware attacks affect their interconnected clinical infrastructure. Medical devices often depend on supporting systems for communication, data exchange, and centralized management. An imaging scanner might remain operational while a compromised image archive prevents clinicians from retrieving diagnostic studies. Similarly, patient monitoring systems may lose connectivity to central monitoring stations when network services become unavailable.

Network and device disruptions can impact patient care by forcing clinicians to use manual workflows, delay procedures, or transfer patients to unaffected facilities. Even when a malware or ransomware attack does not directly compromise a device’s clinical function, the incident can still create patient safety concerns.

How Attackers Target the AI Inside Medical Devices

Attacks against medical AI differ from attacks against conventional medical device software. Rather than exploiting only operating systems or network services, attackers may manipulate the information AI models learn from, process, or return to clinicians.

Attack	What the Attacker Changes	Clinical Example
Data poisoning	Training data or model updates	Corrupted medical information influences a clinical decision
Evasion	Inputs processed by an existing model	Manipulated diagnostic images cause incorrect classifications
Model theft and privacy attacks	Access to model outputs, parameters, or sensitive information	Repeated queries reveal information about a model or its training data
Prompt injection and chatbot misuse	Instructions or content processed by generative AI	Malicious text in a retrieved online document redirects an AI assistant

Data Poisoning During Training

Data poisoning occurs when an attacker deliberately introduces misleading or malicious information into the data that trains or updates an AI model. Attackers do not necessarily have to compromise the device running the model. The manipulation may occur earlier, while a manufacturer or software developer collects, processes, or prepares training data.

For medical AI, corrupted data could influence how a model interprets symptoms, classifies medical images, or generates clinical recommendations. For example, in a study published in January 2025, Medical large language models are vulnerable to data-poisoning attacks, researchers simulated a data-poisoning attack by training models on locally hosted, deliberately corrupted copies of The Pile, a widely used LLM training dataset. By targeting a single common concept, the researchers replaced only 0.001% of training tokens with misinformation and produced an LLM significantly more likely to generate medically harmful text. The poisoned and clean models also performed similarly on general and medical LLM benchmarks, meaning the benchmarks failed to identify the poisoned model. The researchers describe the work as extending earlier data-poisoning research to the high-risk medical domain, with an attack that could potentially be carried out for under $1,000.

Hospitals purchasing AI-enabled medical devices should ask manufacturers how they validate their training datasets, protect model updates, and detect unexpected changes in model behavior.

Evasion Attacks That Fool a Model at the Point of Care

Evasion attacks arise from threat actors intentionally creating or changing input samples to trick models into incorrect classifications. When working with predictive AI, these attacks pose risks to output reliability and integrity. For example, a diagnostic system like AI-enabled radiology software may use a machine learning model to analyze CT images and flag potential abnormalities. If an attacker manipulates the input image, the model could overlook a finding or misclassify the image.

In March 2025, the National Institute of Standards and Technology (NIST) published AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, which outlines the following types of evasion attacks:

• White-box evasion attacks: The attacker has full knowledge of the model, including its architecture and parameters, and uses that knowledge to craft inputs that cause a specific misclassification.
• Black-box evasion attacks: The attacker knows nothing about the model architecture or training data but can interact with it by submitting queries and observing its predictions to help craft the malicious content.

Model Theft and Privacy Attacks

Model theft occurs when attackers attempt to reproduce or extract an AI model by accessing its underlying files, parameters, or outputs. Meanwhile, privacy attacks attempt to recover sensitive information associated with the model, including data used during training.

When attackers attempt to extract information about a model, they may submit queries and analyze the outputs to learn about its architecture, parameters, or behavior. Rather than reproducing the original model exactly, attackers may create a model that performs similar functions. As NIST AI 100-2 E2025 explains, model extraction can also be a step toward other attacks because understanding how a model works can help attackers identify additional ways to compromise it.

Privacy attacks have a different objective. Instead of stealing the model, attackers attempt to recover information about the data used to train it. For example, data reconstruction attacks may exploit information revealed by a model to infer sensitive details about individual training records. In healthcare, a successful attack against a model trained on patient data could expose confidential medical information.

Prompt Injection and Chatbot Misuse in Clinical Settings

Prompt injection attacks manipulate generative AI systems by placing malicious instructions within the information that the systems process. For example, an attacker could insert instructions into a document that a clinical AI assistant retrieves. If the assistant treats that content as an authorized command, the AI might produce misleading responses or perform unintended actions.

Ultimately, the consequences depend on what the assistant can access and which systems it connects to. For example, in an article published in February 2025, Prompt injection attacks on vision language models in oncology, researchers embedded malicious instructions into oncology images in three ways to see if they could trick the models into ignoring cancer lesions. According to the researchers, attackers could carry out these attacks without access to the model architecture by placing the instructions in data before it reaches the hospital’s systems.

These systems often operate outside the regulatory boundaries that apply to FDA-authorized medical devices. Hospitals therefore need to distinguish regulated medical AI from general-purpose generative AI tools used in clinical workflows.

Why AI Medical Device Threats Hit Hospitals Harder

In hospitals, AI medical device threats pose a dual risk. Attacks can have data breach consequences if threat actors move across the networks to high-value databases and applications. More importantly, removing, restarting, or updating vulnerable equipment can affect patient health.

Many healthcare organizations keep medical devices in service long after manufacturers stop supporting the original software. As a result, clinical engineering teams manage equipment with known cybersecurity vulnerabilities and limited update options, increasing the importance of network segmentation and other compensating controls.

Unlike traditional IT endpoints, many medical devices are unable to support installed security agents or routine vulnerability scanning. Since active scanning can interfere with a device’s performance, the healthcare delivery organization risks disrupting scheduled procedures or critical patient monitoring.

Further, many healthcare organizations split control across multiple departments. Clinical engineering manages medical device functionality and configuration. Cybersecurity teams monitor threats and respond to incidents. IT maintains network connectivity. Facilities personnel oversee operational technology (OT), including building automation systems. While these responsibilities overlap, the data remains siloed, so no one has all the information they need.

Building an effective healthcare IoT security program requires visibility across medical devices, connected infrastructure, and supporting enterprise systems so that teams understand how equipment communicates and which services clinical workflows need.

How to Defend Against AI Medical Device Threats

Hospitals can defend against AI medical device threats by combining complete device visibility, vulnerability prioritization, and governance for medical AI. These controls should reflect how clinical equipment operates and which systems must remain available during security incidents.

See Every Device, Including the Ones Running AI

An organization can only secure what it knows it has. To defend all connected medical devices, it needs a continuously updated and accurate asset inventory. Traditional asset inventories often fail to identify equipment that cannot support endpoint agents, like Internet of Things (IoT), OT, IoMT, and IT devices, including legacy medical equipment.

An agentless discovery tool that collects asset information using passive network monitoring enables healthcare organizations to identify connected assets without installing software on devices or initiating potentially disruptive scans. These solutions can identify an IP address, device manufacturer, equipment function, software version, communication pattern, network location, clinical dependencies, and AI functions, including where their data and model updates flow.

Prioritize by Real Exploitability and Contain What Cannot Be Patched

Hospitals need to prioritize vulnerabilities so that they can effectively reduce risk. A critical vulnerability affecting an isolated device may present a less immediate exposure than a moderately rated vulnerability in an IoMT device with access to the public internet. When assessing a vulnerability’s potential impact, healthcare organizations need to consider exploitability, network exposure, and clinical consequences.

Effective exposure management connects device vulnerabilities to their operating environments so that security teams can identify realistic attack paths and determine where a control will have the greatest impact.

For devices that cannot be patched, healthcare organizations can implement compensating controls that reduce an attacker’s ability to exploit a known vulnerability. Network segmentation can limit unnecessary communication between devices and unrelated systems. Access restrictions can reduce exposure through remote management services. Virtual patching blocks known exploitation techniques.

Before enforcing any proposed restrictions, hospitals should simulate how a change impacts devices. After pushing the compensating control live, organizations should continuously monitor for unexpected changes.

Govern AI Tools and Hold Manufacturers to Account

Before procuring new AI-enabled devices, healthcare organizations should establish security requirements and ensure they can maintain oversight throughout the device’s operational lifecycle. While manufacturers control model development, training data, and software updates, healthcare organizations need the right documentation to show they understand how dependencies affect their clinical operations and cybersecurity posture.

Procurement review should look at how manufacturers identify vulnerabilities, communicate security changes, and protect model update integrity. Internal governance should also cover generative AI tools used outside regulated medical devices, especially when they can access patient data or clinical workflows. An AI governance committee should bring clinical leadership, clinical engineering, cybersecurity, privacy, and compliance teams together to evaluate proposed deployments.

When managing security, organizations should implement continuous monitoring to identify unusual device communications, unexpected data transfers, and changes in network behavior. The security team’s incident response playbooks must identify a responsible party who can authorize containment actions when clinical equipment is involved.

Teams can use the following questions during procurement and periodic security reviews:

• Does the manufacturer provide a software bill of materials, document its model update process, and maintain coordinated vulnerability disclosure policies?
• Are AI agents and chatbots restricted to approved data sources, authorized actions, and appropriate human review?
• Can cybersecurity and clinical engineering teams detect unusual device behavior and coordinate containment without disrupting essential care?

Frequently Asked Questions About AI Medical Device Threats

These answers cover the questions healthcare security and clinical engineering teams most often raise about AI medical device threats.

What Are AI Medical Device Threats?

AI medical device threats are cybersecurity attacks involving either AI-assisted techniques against connected medical devices or attempts to compromise the artificial intelligence operating within medical technologies. The first category includes AI-assisted reconnaissance, vulnerability discovery, phishing, and malware development. The second includes data poisoning, evasion, model theft, and prompt injection. Hospitals must address both categories because traditional device vulnerabilities and weaknesses in medical AI can affect clinical operations, sensitive patient information, and patient safety.

Which Medical Devices Have Been Hacked?

Several medical device categories have been the subject of publicly disclosed cybersecurity vulnerabilities, including patient monitors, infusion pumps, and connected cardiac technologies. However, identifying a vulnerability does not establish that attackers have successfully exploited it.

In a 2025 FDA safety communication on patient monitor vulnerabilities, the agency warned about weaknesses that could allow unauthorized control or patient data exfiltration. The FDA stated that it was unaware of related cybersecurity incidents, injuries, or deaths. Hospitals should distinguish demonstrated vulnerabilities from confirmed attacks when evaluating device exposure.

What Is Cybersecurity in Medical Devices?

Cybersecurity in medical devices involves protecting connected healthcare technologies against unauthorized access, software exploitation, manipulation, and disruption. It includes identifying devices, monitoring communications, managing vulnerabilities, restricting unnecessary access, and protecting sensitive information.

Unlike conventional enterprise cybersecurity, medical device security must account for equipment that cannot be readily updated or disconnected. Effective programs involve clinical engineering, cybersecurity, and manufacturers throughout a device’s operational life cycle. The primary objective is to reduce exploitable weaknesses while preserving safe and reliable clinical functions.

How Do Attackers Use AI to Target Hospital Devices?

Attackers use artificial intelligence to accelerate vulnerability research, develop malicious code, and create convincing social engineering messages. These techniques can help identify weaknesses in hospital networks, supporting software, and connected devices.

AI medical device threats also include attempts to exploit stolen credentials or poorly secured remote access systems. Attackers do not need an AI-enabled device to benefit from AI-assisted techniques. A conventional medical device running vulnerable software can become a target when attackers identify a reachable weakness.

Can AI-Enabled Medical Devices Be Hacked?

AI-enabled medical devices can be compromised through traditional cybersecurity vulnerabilities or attacks involving their AI models and data. These attack paths are different but may affect the same clinical technology.

A device might contain an exploitable operating system vulnerability while also depending on a model susceptible to manipulated inputs. The potential consequences depend on the device’s function, architecture, and available protections. Hospitals should evaluate both conventional cybersecurity controls and manufacturer safeguards for model integrity, data processing, and software updates.

What Is Data Poisoning in Medical AI?

Data poisoning in medical AI occurs when an attacker deliberately corrupts training data to influence how an AI model behaves after deployment. The malicious information may cause a model to produce inaccurate classifications, recommendations, or responses.

These AI medical device threats are particularly concerning because traditional performance evaluations may not detect the manipulation. Research published in Nature Medicine in 2025, Medical large language models are vulnerable to data-poisoning attacks, demonstrated that poisoned medical language models could perform normally on established benchmarks while generating more harmful information.

How Does the FDA Approach Cybersecurity for AI-Enabled Medical Devices?

The FDA evaluates applicable cybersecurity concerns for AI-enabled medical devices through its existing medical device regulatory framework. Requirements depend on the device’s intended use, software functions, and whether it meets the statutory definition of a cyber device.

The FDA’s February 2026 guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, addresses cybersecurity design, documentation, and Section 524B requirements. Section 524B establishes cybersecurity obligations for covered devices, including vulnerability management processes and software bill of materials requirements. FDA authorization does not eliminate the need for ongoing hospital oversight.

How Many Healthcare Data Breaches Involve Hacking?

Hacking and other IT incidents account for more than 80% of large healthcare data breaches, according to HIPAA Journal’s analysis of federal breach reporting data.

The publication’s Healthcare Data Breach Statistics page reports 772 large healthcare breaches for 2025. These figures cover incidents affecting regulated healthcare entities and are not limited to medical devices. They also do not demonstrate how many incidents involved artificial intelligence. AI medical device threats represent a distinct concern within the broader healthcare cybersecurity environment.

How Should Hospitals Govern AI Agents and Chatbots on Their Networks?

Hospitals should govern AI agents and chatbots through approved-use policies, restricted access, data protection requirements, and clinical oversight.

The 2026 Microsoft report, Digital Defense Report 2026, found that 88% of enterprises were experimenting with AI agents. This figure reflects enterprises broadly, not healthcare organizations specifically.

Hospitals should assess what information agents can access, which actions they can perform, and whether their outputs require clinical verification. Governance should also address prompt injection, patient data privacy, and ongoing monitoring of AI activity.

How Do You Protect Medical Devices From AI-Driven Attacks?

Hospitals protect medical devices from AI-driven attacks by combining asset discovery, vulnerability prioritization, access restrictions, and network segmentation with governance for AI-enabled technologies.

Addressing AI medical device threats requires visibility into both conventional device vulnerabilities and AI-specific dependencies. Clinical engineering and cybersecurity teams should identify which weaknesses attackers can exploit and determine which devices cannot be updated safely. Compensating controls can reduce exposure when software updates are unavailable, while manufacturer oversight helps protect model updates and sensitive information. These measures should support continuous monitoring without disrupting essential patient care.

Stay Ahead of AI Medical Device Threats

AI medical device threats change how quickly attackers can identify weaknesses and expand which technologies hospitals must protect. However, effective defense still depends on understanding the device environment, prioritizing exploitable vulnerabilities, and containing equipment that cannot be updated. As AI-related vulnerabilities become a growing cybersecurity concern, hospitals need visibility across connected systems to make informed security decisions without compromising clinical availability.

See how Asimily helps healthcare organizations coordinate medical device security through agentless discovery, AI-driven vulnerability prioritization, and Segmentation Orchestration. These capabilities support exposure reduction across IoT, OT, IoMT, and IT devices while helping teams maintain clinical operations. Asimily also earned recognition in the 2026 Best in KLAS Healthcare IoT Security ranking. To learn how these capabilities can support your hospital’s cybersecurity program, request a demo.