Bank of America is assigning 4,000 employees to address vulnerabilities discovered by Anthropic's Mythos and other AI models.
Bank of America has assigned 1,000 external contractors and 3,000 internal employees to remediate software vulnerabilities discovered by AI models, including Anthropic's Mythos. The effort began after security labs promoted AI-driven vulnerability discovery, with earlier skepticism eased by incidents and evaluations. The bank's third-quarter spending combined software remediation and compliance work, leaving exact patching costs unclear. Executives expect costs to decline as models reduce false positives and banks integrate AI findings into routine security operations.
Key Takeaways
- Bank of America has assigned about 4,000 workers—1,000 external contractors and 3,000 internal employees—to fix software vulnerabilities found by AI models such as Anthropic’s Mythos.
- The bank spent several hundred million dollars in the third quarter on this software remediation work combined with anti-money-laundering requirements, but did not disclose the patching cost separately.
- The effort began after Anthropic’s April Mythos release, which reportedly identified thousands of serious security flaws, while OpenAI’s May Daybreak program showed major AI labs entering cybersecurity tooling.
- Initial skepticism toward AI-driven security warnings has eased after incidents such as the Hugging Face hack and independent evaluations confirmed stronger model capabilities.
- Bank of America’s disclosure offers a rare early view of the staffing and spending triggered by AI-discovered vulnerabilities, though expected future cost reductions depend on better models and integrated security processes.
Bank of America Deploys 1,000 Contractors to Patch AI-Found Software Flaws
Lead: Bank of America has brought in 1,000 outside contractors to fix software vulnerabilities surfaced by AI models such as Anthropic's Mythos, CNBC reported. CEO Brian Moynihan said the contractors have worked alongside 3,000 internal employees since the second quarter, and that the bank spent a few hundred million dollars in the third quarter on the software work and anti-money-laundering requirements combined. He did not break out a separate figure for patching alone.
Background: How the AI Vulnerability Push Began
The remediation effort traces back to April, when Anthropic released Mythos only to select partners through Project Glasswing. At the time, Anthropic said the model had found thousands of serious security vulnerabilities. OpenAI followed in May with its Daybreak cybersecurity program, signaling that major AI labs were moving into security tooling as a distinct product area.
Early reaction was skeptical. Critics dismissed the labs' warnings and countermeasures as public relations. That framing has since shifted, according to the report, as security incidents such as the Hugging Face hack changed the conversation, alongside independent evaluations that confirmed the new models' stronger capabilities.
What Bank of America's Disclosure Shows
Bank of America is one of the first major US companies to disclose how many people it has assigned to fixing vulnerabilities that AI found. The numbers — 1,000 external contractors plus 3,000 internal employees — give a rare view of the labor required to act on AI-generated security findings at a large institution.
The timeline matters: the contractors have been in place since the second quarter, and the third-quarter spending figure of a few hundred million dollars covers both the software work and anti-money-laundering requirements. Because the bank did not separate patching costs from AML costs, the exact price of the AI-driven remediation remains unclear.
What to Watch Next
Moynihan expects patching costs to come down over time. Whether that happens depends on how quickly the underlying models improve at filtering false positives and how well banks can fold AI-discovered vulnerabilities into routine security operations. For now, the Bank of America disclosure stands as an early data point on the staffing and spending that AI-driven vulnerability discovery can trigger at a major US company.
Comments
No comments yet. Be the first to comment.