Bank of America hires 1,000 contractors for Mythos flaws

Bank of America disclosed it hired 1,000 outside contractors in the second quarter to patch software vulnerabilities exposed by Anthropic's Mythos AI model, joining 3,000 internal staff already assigned to remediation. The effort cost the bank "a couple hundred million plus" in third-quarter expenses, as Mythos scans identified thousands of security weaknesses across both internal systems and vendor-supplied software.

Bank of America CEO Brian Moynihan revealed during the bank's third-quarter earnings call on October 14 that the institution brought in 1,000 external contractors to address software flaws discovered by advanced AI models, particularly Anthropic's Mythos. These contractors, hired in the second quarter, are working alongside approximately 3,000 existing internal staff members dedicated to vulnerability remediation, making it a combined effort of 4,000 personnel addressing AI-exposed security issues.

Mythos, a cybersecurity-focused AI model released to vetted users including major financial institutions in April 2026, has proven remarkably effective at uncovering software weaknesses. A single scan conducted by Bank of America surfaced more than 23,000 potential vulnerabilities, most rated low to moderate severity though some critical flaws were also identified. The discovery timeline compression has been dramatic: repair windows have shrunk from weeks to just days since the Mythos findings became available.

The financial impact of this remediation effort is substantial. Moynihan stated that the bank incurred "a couple hundred million plus" in repair costs during the third quarter alone, though this figure combines software remediation expenses with anti-money laundering compliance costs. The work encompasses both Bank of America's proprietary code and third-party vendor software, presenting a challenge that extends beyond the bank's direct control.

CEO Moynihan acknowledged the stakes, calling the security risk presented by advanced AI models like Mythos "real risk." He also highlighted an industry paradox: "We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services"-meaning vendors who build code are simultaneously selling solutions to patch vulnerabilities their software may contain. The disclosure represents one of the first times a major U.S. financial institution has quantified both the workforce and financial commitment required to address AI-discovered vulnerabilities at scale.