Bank of America Put 1,000 Contractors on Patch Duty After AI Found the Flaws

Bank of America Put 1,000 Contractors on Patch Duty After AI Found the Flaws

Moynihan says the extra 1,000 came on in the second quarter

Bank of America hired 1,000 outside contractors in the second quarter to help patch software flaws exposed by advanced artificial intelligence models, including Anthropic's Mythos, CEO Brian Moynihan told CNBC in an interview after the bank's third-quarter earnings release. "We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us," he said. The work covered both the bank's own code and software it buys from vendors.

The contractors sit on top of 3,000 existing staffers

Moynihan framed the hires as additive. The 1,000 contractors stand alongside the roughly 3,000 people the bank already had working in that area, CNBC reported, describing them as third-party consultants supporting 3,000 internal staff. That takes the patching bench from about 3,000 to about 4,000 people, a quarter of them outside the company. It is among the first times a major U.S. corporation has put a headcount and a dollar figure on defending itself from Mythos.

A "couple hundred million plus" hit third-quarter costs

On the earnings call, Moynihan told analysts the bank spent "a couple hundred million plus" in the quarter on software remediation and on regulatory matters tied to anti-money-laundering compliance — read by outlets as more than $200 million. The same quarter's results: net income of $6.9 billion, earnings per share of $0.91 and revenue of $30.0 billion, up 3% year over year, including a $1.2 billion non-deductible regulatory settlement charge. Profit fell 17%, ending a six-quarter streak of beating estimates.

Mythos was never a public tool

Anthropic released Mythos in April 2026 to a limited set of users rather than the general public, handing access to banks, technology companies and government agencies through an initiative called Project Glasswing. Anthropic said on April 7 that Claude Mythos Preview had found thousands of high-severity vulnerabilities, including some in every major operating system and web browser.

Glasswing partners verified 129,000 flaws in four months

Scale is what makes the disclosure land. Anthropic later said participants in Project Glasswing identified 129,000 verified software vulnerabilities between April and July 2026; one reported tally put more than 10,000 high- or critical-severity findings in the project's first month alone, and a single scan once flagged more than 23,000 potential issues, most rated low to moderate. Quartz noted that remediation banks might once have deferred for weeks was being completed within days by May, with the volume of flaws per bank ranging from several hundred to thousands.

Dimon's number was bigger: risk up tenfold

JPMorgan Chase CEO Jamie Dimon, speaking at the JPMorgan Tech Stars conference in London on October 6, told Bloomberg TV that "risks from AI went up 10-fold after Mythos," adding that "AI created vulnerabilities that we didn't know about." Morgan Stanley is working with Mythos Preview to harden its security infrastructure, Goldman Sachs has Mythos and is working with Anthropic and its security vendors, and Citigroup's Jane Fraser has flagged AI-driven cyber risk as a priority. The industry already has a word for the resulting backlog: "Patchmageddon."

Regulators moved in April, not October

Treasury Secretary Scott Bessent and then-Fed Chair Jerome Powell convened the CEOs of the most systemically important banks at Treasury headquarters in April to discuss Mythos and its implications for the financial system. The UK Financial Conduct Authority said in a September review that frontier AI lets firms identify and analyze weaknesses in software and infrastructure far more quickly. Banking watchdogs are stepping up AI scrutiny, and European banks and regulators have complained about getting thin access to Mythos this year.

Headcount is heading the other way

Moynihan also said the bank's head count fell by about 3,400 over the past year as it cut roughly 5% of managers. It is unclear how much of that reduction is attributable to AI. Separate coverage put the bank at replacing about 75% of departing employees. The same institution adding contractors to patch code is shrinking its payroll overall.

Patching is a treadmill, not a finish line

The bottleneck is that AI finds flaws faster than people fix them. German outlet Heise reported that AI can surface vulnerabilities within days, if not hours, leaving banks to catch up on years of deferred work, and that open-source patches often never reach banks. A U.S. Cybersecurity and Infrastructure Security Agency review of 2024 and 2025 data found that exploited flaws remain dominated by memory safety, input validation, injection, path traversal and missing authentication.

The bill is supposed to peak, not keep climbing

Moynihan offered the optimistic version: remediation costs should fall as the work gets done. "Once you patch, you don't have to patch as much. … The pipeline moves through," he said. The bank runs about 130 internal AI projects, with savings projected to rise from $300 million this year to $700 million in 2027. Anthropic, meanwhile, recast its Cyber Verification Program into three tiers on October 6, with Mythos 5.1 and similar models still limited to a small set of vetted organizations — the capability that found the flaws is not about to become a public utility.