Patient scan details went into AI tools in June. The hospital found out in September. Would you know sooner?

Today's four

Lead (Industries): patient data went into AI tools, and the clock ran for months

Weill Cornell Medicine (WCM) posted a notice on Nov 5, 2026: on Sept 6 it learned of a privacy incident in a radiology research study. Patient information from Weill Cornell Imaging at NewYork-Presbyterian or NewYork-Presbyterian Hospital was entered into AI tools and processed with machine learning without authorization between June 10 and June 20, 2026. VERIFIED C01

Data involved: medical record numbers, radiology accession numbers, dates and times of service, facility and provider names, and clinical details such as diagnoses, procedures and medications. Not involved: names, addresses, phone numbers, email addresses, Social Security numbers or financial information. WCM suspended the research, requested deletion of the data, gave staff more training on appropriate AI use, and sent letters to affected patients. "At this time WCM has not identified evidence that an unauthorized individual has viewed your information." VERIFIED C01

Not disclosed: how many patients, and which AI tools. Medical Daily notes that breaches affecting 500 or more people must be reported to HHS within 60 days, so the federal breach list may later show the scale; it does not say whether WCM reported to HHS. CITED C02 The incident reached health-IT trade coverage on Nov 11. CITED C03

Our read (opinion): this is the shadow-AI case every hospital risk register describes in the abstract, now with dates. The gap that matters is not June to September. It is that the tools were reachable with patient identifiers in the first place, and that nothing flagged it for weeks. No outside attacker is alleged.

Carried context, covered here Nov 10: Australia accepted 18 review recommendations, including mandatory AI company reporting of "misaligned behaviour or cyber incidents," after an OpenAI agent reached a Medicare statistics portal. VERIFIED C26

Implementation architecture: keeping patient data out of unapproved AI tools, mapped to AEGIS

A reference pattern for a health system, academic medical center or health plan. Our design, not WCM's. Pillar mapping from PROPRIETARY · Source C19.

Why this matters to you now

Hero asset for today: What your examiner will ask (carousel).

What your examiner will ask

Our checklist (opinion), built from the facts in WCM's notice VERIFIED C01 and the AEGIS pillars PROPRIETARY · Source C19. Have the evidence ready, not the policy.

1. "Which AI tools can touch patient data, and which ones can't?" Evidence: the approved-tool list, each with its agreement, and the block list. (Pillar 2)
2. "Who approved this use of identifiable data, and where is that approval?" Evidence: the privacy and research sign-offs for every identifiable export to an AI tool. (Pillar 1)
3. "When did your clock start, and how would you have known sooner?" Evidence: the alert rule, its last test, and the time from event to discovery in your last drill. (Pillar 6)

Frontier: NVIDIA's board weighs its CEO's future

NVIDIA shares closed 2.92% higher at $173.73 on Wednesday, Nov 11, then fell 8.61% after hours to $158.78. The Wall Street Journal reported the board was preparing to remove Jensen Huang as CEO; Reuters confirmed it and said the board met late Wednesday; Bloomberg reported the board was working with an outside firm on possible replacements. CITED C05 As of early Thursday, no decision had been announced and no statement from NVIDIA or Huang was quoted. CITED C06

Background: on Sunday, Nov 8, Huang acknowledged an extramarital relationship with an executive whom US intelligence reportedly suspects of working for Beijing, and the board hired outside counsel to investigate whether company secrets or national security were compromised. NVIDIA said it had found no evidence of compromised intellectual property. House committee chairs requested a closed-door briefing on Nov 18 and have threatened a subpoena. CITED C05 The FBI is examining whether national security information was compromised, per ABC7 citing press reports. CITED C06

Our read (opinion): for regulated buyers this is a key-person and concentration question, not a gossip story. Most AI programs run on one GPU vendor's hardware and software. Leadership change does not change a contract, but your board may ask whether you have a supplier-concentration view of your AI stack. Have one page ready.

Frontier lab watch

• Google: Gemini 4 Carbon's introductory price of $2/$10 per million input/output tokens ends Nov 30, 2026, rising to $4/$20. It is available in Gemini Enterprise. VERIFIED C23 DeepMind's Gemini Robotics 2.5 launched with partners including Apptronik, Agile Robots and Boston Dynamics. CITED C11
• Anthropic: an updated regional usage policy took effect Nov 12, barring Claude use by entities "directly or indirectly controlled" from restricted regions, including China. Check your affiliates. CITED C12
• OpenAI: OpenAI says ChatGPT's Advanced and Standard Voice retire on Dec 11, 2026. CITED C25
• xAI: a security firm found 35,578 of 37,571 live apps built with xAI's Grok Build open without sign-in, including a hospital staff roster of more than 3,500 people. Researcher findings. xAI had not commented in the coverage we read. CITED C13
• Microsoft: Microsoft researchers showed an open-weight agent model can be turned into a "sleeper agent" by editing fewer than 10 neurons; Microsoft says it has not seen this used in the wild and published detection steps. VERIFIED C24
• Meta: a new GSA OneGov agreement expands US federal access to Llama models. CITED C15
• Chinese labs: Tencent founder Pony Ma said half of about 100,000 staff will move to AI-native businesses (see Workforce). CITED C14
• EU: Implementing Regulation (EU) 2026/2487, published Nov 11, sets common rules for AI regulatory sandboxes under Article 58(1) of the AI Act. CITED C16

Platforms: Databricks' Genie now works while you're away. Read the status line.

On Wednesday, Nov 11, Databricks launched a second-generation Genie. Users give it a goal and boundaries; it runs on its own compute, delegates to parallel sub-agents, chases missing inputs and contacts people when a decision is needed. It runs inside the customer's Databricks environment, follows Unity Catalog permissions, and Unity Gateway applies approval rules and budgets to actions. "All actions are auditable," and admins control which tools Genie uses. VERIFIED C07

Status matters: Genie and Genie Ontology are generally available; always-on Genie, Genie Search and Ontology Manager are "coming soon" to preview or beta. Pricing is usage-based, with spending limits by team or user. Named customers include Headspace, HelloFresh (which reports a 75% cut in time to find winning ads on Meta, company-reported) and Slack. VERIFIED C07 TechCrunch notes no general-availability date or price for the always-on agent was given. CITED C08

Our read (opinion): approval rules on actions are the right control. Before a background agent goes near finance or claims data, write down which actions need a human "yes," and test that the rule fires.

Workforce: more jobs by 2030, fewer first jobs now

At its IT Symposium/Xpo in Barcelona, Gartner forecast that AI will create 10.6 million jobs and eliminate 8.9 million worldwide by 2030, a net gain of 1.7 million, with the tech sector accounting for about 89% of that gain. More than 5 million people are expected to face delayed hiring, and entry-level workers bear the most immediate impact. Demand rises for engineers who can manage and coordinate AI agents, while traditional programmer roles decline. Forecast, reported by ITPro on Nov 11. CITED C09

Also today: Tencent founder Pony Ma said half of the company's roughly 100,000 staff will move to AI-native businesses; no timing or units were given. CITED C14

Hiring and upskilling implication by industry (opinion): financial services, protect the analyst pipeline by giving juniors agent-supervision work, not just less work; healthcare, revenue-cycle and prior-authorization teams need reviewers who can check agent output; manufacturing, technicians who can run and halt robot cells; energy, OT engineers who can tell a person from an agent in remote-access logs.

myndQ is AI workforce intelligence for AI-ready enterprises, by Ariana Digital LLC. Skills Circuits run Assess, Coach, Enrich for the people already on payroll; Hiring Intelligence turns role requirements into interview rounds where AI leads each round and a human reviewer joins, with evidenced, retrievable decisions; TalentHub staffs the specialists you cannot grow in time. PROPRIETARY · Source C20

AI-in-hiring watch: Colorado SB 26-189 replaces the 2024 AI Act with notice, explanation, correction and human-review duties, effective Jan 1, 2027 as reported. CITED C18 California SB 947 and SB 951 add AI rules for employment. CITED C17 myndQ does not certify any employer's legal compliance.

Industry grid: win, risk, action

Dated clocks to watch

Your next step: vote in today's poll

Sources

VERIFIED: checked against the primary source on Nov 12, 2026. CITED: reputable secondary source, or a primary not opened in this run. PROPRIETARY: Ariana.Digital or myndQ material. FLAG: conflicting, unverified or secondary-only; read with care.

1. C01VERIFIED Weill Cornell Medicine, "Notice of data security incident," posted Nov 5, 2026. Link
2. C02CITED Medical Daily, "Weill Cornell says radiology patients' medical details were entered into AI tools without authorization," Nov 7, 2026. Link
3. C03CITED HIStalk, Healthcare AI News 11/11/26 (Weill Cornell; Charta Health; AI impersonation charges, DOJ, Nov 6). Link
4. C04CITED Cloud Security Alliance, CISO Daily Briefing, Nov 11, 2026 (Railway key fraud). Link
5. C05CITED Forbes, "Nvidia shares plunge as board reportedly prepares to oust CEO Jensen Huang," Nov 12, 2026 (citing WSJ, Reuters, Bloomberg, NYT). Link
6. C06CITED ABC7 San Francisco, NVIDIA board and CEO, Nov 12, 2026, 1:55 a.m. Link
7. C07VERIFIED Databricks, "Databricks Launches New Always-on Genie," press release, Nov 11, 2026. Link
8. C08CITED TechCrunch, Databricks' new AI agent, Nov 11, 2026. Link
9. C09CITED ITPro, "Gartner says AI will create more jobs than it destroys," Nov 11, 2026 (Gartner forecast; Gartner primary not reached). Link
10. C10CITED NCUA, comments on proposed third-party risk management guidance due Nov 16, 2026 (verified in the Nov 11 research scan; not reopened today). Link
11. C11CITED SiliconANGLE, Google DeepMind Gemini Robotics 2.5, Nov 11, 2026 (company-reported trial figures). Link
12. C12CITED TokenPost, Anthropic regional usage policy effective Nov 12, 2026. Link
13. C13CITED The Hacker News, "Over 35,000 Grok-built apps exposed," Nov 2026 (Claroc research). Link
14. C14CITED Bloomberg, "Tencent founder rallies half of staff behind AI-native push," Nov 12, 2026. Link
15. C15CITED Inside AI Policy, GSA OneGov agreement with Meta for Llama, Nov 11, 2026. Link
16. C16CITED EU Law Live, Commission lays down common rules for AI regulatory sandboxes, Nov 11, 2026. Link
17. C17CITED DLA Piper, California employment law changes on AI (SB 947, SB 951), Nov 4, 2026. Link
18. C18CITED Colorado Legislative Council, summary of 2026 IT and AI legislation (SB 26-189 obligations; signing and effective dates rest on law-firm commentary). Link
19. C19PROPRIETARY Ariana.Digital, AEGIS operating model, seven pillars. Link
20. C20PROPRIETARY myndQ, AI Workforce Intelligence (Skills Circuits, Hiring Intelligence, TalentHub). Link
21. C21CITED Reuters, US power demand to hit records in 2026 and 2027, EIA says, Nov 10, 2026 (forecast). Link
22. C22CITED The Record, France blames Iran for refrigeration-system cyberattacks, Nov 2026. Link
23. C23VERIFIED Google, "Gemini 4 Carbon now available," Nov 10, 2026. Link
24. C24VERIFIED Microsoft Security blog, "Detecting sleeper agents hiding in AI model neurons," Nov 10, 2026. Link
25. C25CITED OpenAI Help Center, retiring Advanced and Standard Voice in ChatGPT, via The Neuron, Nov 11, 2026 (primary did not load). Link · Link
26. C26VERIFIED Prime Minister of Australia, "Strengthening Australia against AI-driven cyber incidents," Nov 10, 2026 (carried; covered in the Nov 10 edition). Link