Bank of America CEO says 1,000 contractors hired to patch Mythos AI flaws

Brian Moynihan, chairman and CEO of Bank of America, confirmed on Wednesday that the bank recruited 1,000 external contractors to help remediate security vulnerabilities discovered by Anthropic’s Mythos artificial intelligence model. The executive made these remarks during the company’s third-quarter earnings call, detailing the significant operational effort required to address the findings.

Moynihan told CNBC that the bank brought in outside help after concerns grew over its ability to quickly tackle the volume of work associated with Mythos’ discoveries. The contractors were hired in the second quarter to ease the initial burden of patching a large number of flaws, an issue the CEO said should not be as pronounced in the longer term.

Remediation Costs and Workforce Impact

During the earnings call, Moynihan stated that Bank of America spent “a couple of hundred million plus” in remediation costs related to Mythos and anti-money laundering orders issued that week. These expenses are expected to decline over time as the initial surge of patching work subsides. The 1,000 contractors added to the bank’s existing 3,000 technical staff members, providing necessary capacity to manage the influx of required security updates.

The CEO noted that the bank has made its tech engineering workforce around 10 percent more efficient through these efforts. He also mentioned that each of the approximately 130 AI-related projects currently running is expected to achieve a two-to-three times return on investment over time.

Industry Context and Model Capabilities

Concerns about Mythos were shared globally, partly because Anthropic marketed the model as an all-powerful tool that threatened the status quo of cybersecurity. While the model proved highly effective at identifying complex vulnerabilities faster than humans, some early adopters argue it is no smarter than elite human researchers. Mozilla CTO Bobby Holley said in April that he had not seen any bugs that couldn’t have been found by elite human researchers, despite Mythos finding 271 flaws in Firefox 150.

As Threat Times reported on October 15, 2026, Moynihan previously stated the bank brought in outside help in Q2 to patch weaknesses found by Anthropic’s Mythos model, adding to internal remediation efforts. The current disclosure reinforces that scale of response and the financial impact associated with deploying such advanced AI security tools at an enterprise level.

What should you do?

Organizations evaluating AI-driven security testing should prepare for potential surges in remediation workload. Security leaders should review their current patching capacity and consider whether external resources may be needed to handle large-scale vulnerability discovery. It is also important to monitor vendor communications regarding new AI models that claim to identify complex software flaws.

What to do and how to stay safe: Bank of America

• Assess current patching capacity to determine if internal teams can handle large-scale vulnerability discovery without external help.
• Monitor vendor announcements for new AI security models that may identify complex vulnerabilities faster than traditional methods.
• Review budget allocations for potential remediation costs associated with adopting advanced AI-driven security testing tools.
• Establish clear processes for prioritizing and patching vulnerabilities identified by automated or AI-driven scanning tools.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many contractors did Bank of America hire to help with Mythos vulnerabilities?

Bank of America hired 1,000 contractors in the second quarter to assist with patching vulnerabilities discovered by Anthropic’s Mythos model.

What were the remediation costs for Bank of America related to Mythos?

CEO Brian Moynihan stated that the bank spent “a couple of hundred million plus” in remediation costs related to Mythos and AML orders.

Will the contractors remain at Bank of America long-term?

The contractors remain at the bank for now, but their assistance will not be needed in the longer term as the initial patching burden decreases.