Bank of America hires 1,000 contractors to patch AI-exposed software flaws

CEO Moynihan says spending on remediation from Anthropic's Mythos model i temporary

By LineZotpaper
Published
Read Time2 min
Sources3 outlets
Bank of America CEO Brian Moynihan revealed that the bank hired 1,000 external contractors in the second quarter to patch software vulnerabilities exposed by advanced AI models including Anthropic's Mythos, as the lender spent 'a couple hundred million plus' on software remediation and anti-money laundering compliance in the third quarter.

In an interview after the bank's third-quarter earnings release, Moynihan told CNBC that the company rushed earlier this year to bolster a wide spectrum of internal and vendor code. 'That risk is real risk, and that's why when the frontier-type models came out... A lot of us sat down and said, How do we figure out how to get through this quickly?' he said.

The 1,000 contractors, put on in the second quarter, remain employed today, working alongside 3,000 internal staff in that area. 'We spent a couple hundred million plus on the software remediation and regulatory issues related to anti-money laundering compliance in the third quarter,' Moynihan told analysts.

The comments are among the first by a major US corporation to detail the manpower and cost of protecting systems from Mythos, which was released to a small group of banks, technology firms and government agencies in April. They highlight the dual-edged nature of AI: while it can boost productivity, the ability of models like Mythos to uncover and exploit decades-old software flaws has forced firms into a costly defensive scramble.

'We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services,' Moynihan said.

Speaking as Bank of America's shares slumped as much as 8% on Wednesday, Moynihan sought to reassure investors that the spending increase was temporary. 'Once you patch,' he said, the need for extra contractors would diminish.

§

Analysis

Why This Matters

  • The disclosure reveals the real-world cost of defending against frontier AI models, which can uncover legacy software vulnerabilities that human auditors might miss.
  • As banks and other critical infrastructure firms scramble to patch, the temporary spike in spending could pressure near-term earnings and raise questions about long-term cybersecurity budgets.
  • This sets a precedent for transparency around AI-driven remediation costs, potentially influencing how other corporations disclose their own defensive spending.

Background

Anthropic's Mythos is a frontier AI model released in April 2026 to a limited group of banks, technology firms and government agencies. Like other advanced models, it can analyze code and identify security flaws at scale, forcing organisations to rush patches for decades-old software. Bank of America, one of the largest US lenders, has been under regulatory scrutiny for anti-money laundering compliance, adding to the urgency.

Key Perspectives

Bank of America: The bank views the spending as a necessary investment to mitigate real risk from AI-exposed vulnerabilities, and expects the extra contractor costs to be temporary once patching is complete. Anthropic and AI developers: Advanced models like Mythos are positioned as productivity tools, but their ability to discover flaws creates a defensive burden for clients, highlighting the dual-use nature of the technology. Other financial institutions: Competitors may face similar pressures to patch legacy systems, potentially leading to industry-wide spending increases and tighter vendor code scrutiny.

What to Watch

  • Bank of America's fourth-quarter earnings for any further update on remediation spending and contractor headcount.
  • Other major banks' disclosures about AI-related security costs in upcoming earnings calls.
  • Regulatory reactions if the patching effort uncovers systemic vulnerabilities across the financial sector.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe