Bank of America has spent the past six months paying 1,000 outside contractors to patch software holes uncovered by the newest AI models, CEO Brian Moynihan said Wednesday.
Moynihan disclosed the hiring in an interview with CNBC after the bank released third-quarter results. The contractors came on in the second quarter to fix vulnerabilities in Bank of America’s proprietary systems and in software it licenses from vendors. Moynihan said models including Anthropic’s Mythos are now capable of finding those vulnerabilities. The contractors are still at the bank, working next to about 3,000 employees already assigned to the same job. Earlier in the day, Moynihan told analysts on the earnings call that the patching work and a separate anti-money-laundering compliance effort together cost the bank a few hundred million dollars in the third quarter.
Few large U.S. companies have put a headcount or a dollar figure on their response to Mythos. Bank of America has now done both.
How the patching started
Anthropic released Claude Mythos Preview in April to a limited group of tech companies, banks and government agencies through a program it calls Project Glasswing. JPMorgan Chase was one of the launch partners. The idea was to let defenders use the model to find weaknesses in their software before attackers had anything comparable. About a month after launch, Anthropic reported that the program had identified more than 10,000 high- or critical-severity vulnerabilities. In April, Switzerland’s financial regulator, FINMA, said that unrestricted access to models like Mythos would count as a systemic risk for banks.
Finding a vulnerability takes a model minutes. Fixing one still means a person has to write the patch, test it and get it into production without breaking anything else. At a bank with decades of internal and third-party code, that adds up to a lot of people.
Moynihan told CNBC that when the frontier models came out, he and other bank leaders met to work out how to close the gaps as quickly as possible. He also noted that the companies developing these models are the same ones now trying to sell the bank security services.
Where AI is saving the bank money
Moynihan also pointed to AI as a source of savings. Bank of America has about 130 internal AI projects, and he told analysts the savings from them should more than double in 2027. The bank’s headcount is down about 3,400 from a year ago, and it cut roughly 5% of its managers. The bank did not say how many of those reductions were tied to AI.
That leaves Bank of America cutting jobs because of AI in some parts of the company while it pays for 1,000 temporary workers because of AI in another.
Our read
Moynihan told CNBC the spending is temporary. “Once you patch, you don’t have to patch as much,” he said, and he expects remediation costs to fall as the bank works through its backlog. Shareholders sold anyway, and the stock fell as much as 8% on Wednesday.
His argument holds for the vulnerabilities found so far. It may not hold for the next round. Mythos-class models have since become available to more users. Each new model release could expose older flaws that earlier models missed. If that keeps happening, the bank will be paying for patching every year.
The cost figure is also hard to interpret. The bank reported the patching expense together with its anti-money-laundering remediation, which is tied to a separate regulatory matter. That makes it impossible to tell how much of the few hundred million dollars went to fixing AI-discovered bugs.
Smaller banks are in a harder spot. Bank of America could add 1,000 contractors to a security team that already had 3,000 people. A regional lender with a few dozen engineers and a lot of old vendor software has no comparable option, and it will be waiting on those vendors to ship fixes.
