Bank of America CEO: 1,000 Contractors Hired to Fix AI-Exposed Code Flaws
Brian Moynihan says the bank brought in outside help in Q2 to patch weaknesses found by Anthropic’s Mythos model, adding to internal remediation efforts.
Key points
- Bank of America hired 1,000 contractors in the second quarter to fix code vulnerabilities identified by AI models.
- CEO Brian Moynihan stated that Anthropic’s Mythos model was one of the tools used to expose these software weaknesses.
- Remediation costs for the quarter exceeded a few hundred million dollars, covering both the AI findings and anti-money-laundering fixes.
Bank of America chief executive Brian Moynihan stated on 14 October that the bank engaged approximately 1,000 outside contractors during the second quarter to repair software weaknesses. These vulnerabilities were exposed by artificial intelligence models, including Anthropic’s Mythos, which scanned the bank’s codebase for potential security flaws before attackers could exploit them.
Moynihan revealed the contractor figures in a CNBC interview following the bank’s third-quarter earnings report. He noted that roughly 3,000 internal employees were already working on the same remediation tasks before the external consultants joined the effort. The weaknesses identified by the AI models existed in code used by both the bank itself and its external vendors, requiring a broad scope of repair work across the organization’s technology infrastructure.
Financial Impact and Regulatory Context
The remediation effort carried a significant financial burden, with Moynihan estimating costs of “a couple hundred million dollars plus” for the quarter. This spending covered two distinct initiatives: the technical repairs triggered by the Mythos model and necessary upgrades to the bank’s anti-money-laundering controls. Moynihan indicated that the portion of spending dedicated to the AI-driven code fixes is expected to decrease now that the additional workforce is fully operational.
These technical expenditures coincide with severe regulatory penalties. The US Treasury announced fines exceeding $1.21 billion on 13 October, citing the bank’s failure to report $5 billion in suspicious transactions and its inability to complete remediation steps ordered in 2024. Despite a 3% rise in quarterly revenue to nearly $30 billion, adjusted earnings of $1.08 per share missed analyst expectations, causing the stock to close nearly 5% lower.
Industry-Wide AI Security Shifts
Anthropic launched Project Glasswing in April, granting a limited group of banks, government agencies, and companies access to the Mythos model. The program’s objective was to allow these institutions to identify and patch code flaws proactively. In response to the influx of discovered vulnerabilities, US regulators paused certain cyber examinations a month later, giving the largest banks additional time to address the issues found by the AI tool.
Moynihan had previously highlighted the scale of this challenge in July, telling Bloomberg Television that the model would significantly increase the workload for banks. Jamie Dimon, CEO of JPMorgan Chase, echoed this sentiment in May, stating that his institution had deployed hundreds of staff members full-time to handle similar remediation tasks.
Regulatory pressure regarding AI risks is intensifying globally. Supervisors in the US and Europe are actively questioning banks about their exposure to AI agents and cyber threats. The European Central Bank has specifically requested plans to counter AI-enabled threats by the end of October, signaling a broader shift in how financial regulators view automated code analysis and security.
What should you do?
Security leaders should monitor vendor communications for disclosures regarding AI-driven code scans. Organizations should prepare for increased remediation workloads as AI tools become more prevalent in security testing. It is critical to maintain clear records of all code fixes to demonstrate compliance to regulators.
What to do and how to stay safe: Bank of America
- Review current vendor contracts to understand how third-party code vulnerabilities are handled and reported.
- Assess internal capacity to handle large-scale code remediation projects triggered by automated security scans.
- Monitor regulatory guidance from the Treasury and other bodies regarding AI-enabled security testing and reporting requirements.
- Ensure that anti-money-laundering and cybersecurity remediation efforts are tracked separately for accurate financial and compliance reporting.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many contractors did Bank of America hire to fix the AI-exposed flaws?
The bank hired about 1,000 outside contractors in the second quarter to assist with the remediation work.
Which AI model was used to find the software weaknesses?
CEO Brian Moynihan identified Anthropic’s Mythos model as one of the tools used to expose the code flaws.
Did the bank report a profit in the third quarter?
Revenue rose about 3% to nearly $30 billion, but adjusted earnings of $1.08 per share fell short of analyst forecasts.
