Bank of America Hired 1,000 Contractors Just to Patch the Flaws Anthropic's Mythos Found in Its Code

Frontier AI found so many holes in Bank of America's software that the bank had to hire an army to fill them. CEO Brian Moynihan said Wednesday that the bank brought in 1,000 contractors during the second quarter to patch vulnerabilities exposed by advanced AI models, including Anthropic's Mythos.

"We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area," Moynihan said, Quartz reported. On the earnings call he called the effort "Mythos remediation."

It is among the first disclosures of what companies actually spend fixing flaws found by frontier models, PYMNTS noted. The contractors do not show up in the bank's headcount because they were hired as consultants.

Real risk, and an awkward bind

The weaknesses sat both in the bank's own code and in software supplied by vendors. "That risk is real risk," Moynihan said. When the frontier models arrived, "a lot of us sat down and said, 'How do we figure out how to get through this quickly?'"

He also named the uncomfortable part himself. "We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services," he said.

The tension runs through the bank's own pitch. Bank of America has about 130 AI projects, and Moynihan expects $250 million to $300 million in AI benefits in 2026, rising to $700 million by the end of 2027, though he did not detail how, The Register reported. He said the tech engineering workforce is about 10% more efficient. The same wave is now generating a patching bill.

A messy quarter

How big that bill is remains unclear. Moynihan said the quarter included a "couple hundred million plus" for software remediation and anti-money-laundering compliance combined, without splitting the two.

The AML side traces back to the more than $1.21 billion in Treasury penalties announced Tuesday over the bank's failure to report more than $5 billion in suspicious activity. The bank also faces a $750 million OCC penalty and an $11.6 million OFAC settlement. Profits fell 17%, a drop owed to the FinCEN settlement.

Revenue rose about 3% to nearly $30 billion, but adjusted earnings of $1.08 a share missed forecasts, The Next Web reported. The stock fell as much as 8% on Wednesday and closed almost 5% lower.

What Mythos set loose

Anthropic released Mythos in April to a small group of banks, tech companies and government agencies through Project Glasswing, so they could find and patch flaws before attackers did. In May, US regulators paused some cyber exams to give the largest banks time to fix what it turned up.

Banks found anywhere from several hundred to thousands of flaws, mostly low to moderate severity, and remediation that once slipped for weeks was getting done within days by May. Anthropic said that month that Mythos Preview had found more than 10,000 vulnerabilities across 50 partner organizations.

Bank of America is not alone in feeling it. JPMorgan CEO Jamie Dimon told Bloomberg TV on 6 October that cybersecurity risks "went up 10-fold" after Mythos. "AI created vulnerabilities that we didn't know about, and we always worried about cyber before these things," he said, Business Insider reported. In May he said JPMorgan had hundreds of people working on it full time.

Regulators are leaning in too. Supervisors in the US and Europe are questioning banks about AI agents and cyber risk, and the European Central Bank wants plans against AI-enabled threats by the end of October.

Moynihan is betting the bill shrinks from here. "Once you patch, you don't have to patch as much," he said. "The pipeline moves through."

Some offers on this page may be paid placements or contain affiliate links.