Bank of America Hired 1,000 Contractors to Patch Software Flaws Exposed by Anthropic Mythos

Bank of America Mobilizes 1,000 Contractors to Address AI-Exposed Flaws

Bank of America hired 1,000 contractors during the second quarter to patch software flaws exposed by Anthropic Mythos, CEO Brian Moynihan disclosed during the company's Q3 earnings call on Wednesday1

1

2

2

. These external consultants joined the bank's existing 3,000 technical staff already assigned to remediation work, creating a workforce of 4,000 dedicated to addressing vulnerabilities in both proprietary and vendor software2

2

3

3

. The contractors remain on the job today, though Moynihan expects their assistance won't be needed long-term as the initial wave of patching work subsides1

1

.

Remediation Costs Reach Hundreds of Millions

Bank of America spent "a couple of hundred million plus" on remediation costs related to software vulnerabilities and anti-money laundering compliance during the third quarter1

1

5

5

. Brian Moynihan lumped together costs associated with Anthropic Mythos discoveries and AML issues without breaking down the specific allocation1

1

. Speaking to CNBC, Moynihan characterized the vulnerability risk as "real risk" that prompted urgent action when frontier AI models emerged2

2

. The CEO reassured investors that remediation costs should decline over time, explaining that "once you patch, you don't have to patch as much"2

2

5

5

.

Anthropic Mythos Triggers Industry-Wide Security Scramble

Anthropic released Mythos in April 2026 through Project Glasswing, limiting initial access to select banks, technology firms, and government agencies3

3

4

4

. The model demonstrated capabilities that Anthropic described as surpassing "all but the most skilled humans at finding and exploiting software vulnerabilities," with potential fallout for economies, public safety, and national security4

4

. Mozilla CTO Bobby Holley confirmed after Mythos found 271 flaws in Firefox 150 that "we've found no category or complexity of vulnerability that humans can find that this model can't," though he noted it wasn't smarter than elite researchers1

1

. By May, U.S. regulators paused some cyber examinations to give major banks time to address what the model uncovered3

3

.

Financial Sector Faces Mounting AI-Driven Security Risks

Bank of America isn't alone in confronting AI-exposed flaws. JPMorgan Chase CEO Jamie Dimon revealed in May that his bank deployed hundreds of people full-time to address Mythos findings, calling it "serious work"3

3

4

4

. Goldman Sachs CEO David Solomon stated he was "hyper-aware" of Mythos capabilities and working closely with Anthropic4

4

. Palo Alto Networks discovered more than two dozen critical vulnerabilities in approximately three weeks using the model, though testing revealed companies needed significantly larger AI security budgets4

4

. Moynihan highlighted the dual challenge banks face: "We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services"2

2

5

5

.

Regulatory Pressures Compound Cybersecurity Challenges

The vulnerability remediation coincided with significant regulatory penalties for Bank of America. The bank agreed to a $1.21 billion settlement with FinCEN over failures to police national security risks, including Chinese money laundering, and failure to report over $5 billion in suspicious activity1

1

. Additional penalties included $750 million from the Office of the Comptroller of the Currency for Bank Secrecy Act and anti-money laundering compliance deficiencies, plus an $11.6 million settlement with the Office of Foreign Assets Control for sanctions violations related to Iran, Russia, narcotics, and global terrorism1

1

. Regulatory pressures are intensifying across jurisdictions, with U.S. and European regulators questioning banks about AI agents and cybersecurity risks, while the European Central Bank demanded plans against AI-enabled threats by October's end3

3

.

AI Investments Offset Defensive Spending

Despite defensive expenditures on patch software vulnerabilities, Bank of America expects AI to drive substantial returns. The bank operates approximately 130 AI-related projects, each projected to achieve 2x or 3x return on investment over time1

1

. Moynihan forecasts AI projects will deliver between $250 million and $300 million in benefits during 2026, surging to $700 million by the end of 20271

1

2

2

. The bank has achieved approximately 10 percent greater tech engineering efficiency and reduced its workforce by roughly 3,400 employees over the past year, including a 5 percent decrease in managers, though the role AI played in these reductions remains unspecified1

1

2

2

. Bank of America's share price dropped more than 8 percent on Wednesday morning following the Q3 earnings call, driven by a 17 percent profit decline tied to the FinCEN settlement1

1

5

5

.