Bank of America deploys 4,000 staff to patch AI-discovered flaws
The bank hired 1,000 contractors to join 3,000 internal workers fixing vulnerabilities found by models like Anthropic’s Mythos, CEO Brian Moynihan says.
Key points
- Bank of America assigned 4,000 people to remediate software flaws identified by AI models.
- The effort began in the second quarter with 1,000 outside contractors and 3,000 employees.
- Third-quarter spending on this work and anti-money-laundering compliance reached hundreds of millions.
Bank of America has mobilized a workforce of 4,000 people to address software vulnerabilities discovered by artificial intelligence models, according to CEO Brian Moynihan. This includes 1,000 external contractors hired specifically to patch weaknesses found by tools such as Anthropic’s Mythos. The bank began this remediation effort in the second quarter, as reported by CNBC and The Decoder.
Moynihan stated that these contractors have been working alongside 3,000 internal employees since the second quarter to fix the code issues. The bank spent a few hundred million dollars in the third quarter on this software work combined with anti-money-laundering requirements. Moynihan did not provide a separate cost figure for the patching activities alone, leaving the exact financial impact of the AI-driven remediation unclear.
Context of AI Security Findings
Anthropic released its Mythos model in April exclusively to select partners through Project Glasswing. The company stated that the model identified thousands of serious security vulnerabilities during its deployment. OpenAI launched a similar cybersecurity program called Daybreak in May. These initiatives mark a shift in how AI labs approach software security, moving beyond theoretical risks to concrete vulnerability discovery.
Critics initially dismissed these warnings and countermeasures as public relations stunts. However, the conversation has shifted following security incidents such as the Hugging Face hack. Independent evaluations have also confirmed that these new models possess stronger capabilities in identifying code flaws. Bank of America is among the first major US companies to disclose the specific number of staff assigned to fixing vulnerabilities that AI systems found.
Impact and Future Outlook
The scale of the remediation effort highlights the significant operational burden placed on financial institutions by advanced AI security tools. Moynihan expects that the costs associated with patching these vulnerabilities will decrease over time. This suggests that as AI models become more efficient at identifying issues, the manual labor required to fix them may become less resource-intensive. The bank’s disclosure provides a rare look into the internal logistics of managing AI-discovered technical debt.
As Threat Times reported on October 15, 2026, Moynihan had previously disclosed that the bank brought in outside help in the second quarter to address vulnerabilities found by Anthropic’s Mythos model. The current reporting expands on those numbers, confirming the total headcount involved in the ongoing remediation process.
What should you do?
Organizations should monitor vendor disclosures regarding AI-driven security testing and remediation efforts. Review internal processes for handling vulnerabilities discovered by automated tools. Ensure that security teams have the resources to validate and patch issues identified by AI models. Watch for industry trends in AI security capabilities and adjust internal strategies accordingly.
What to do and how to stay safe: Bank of America
- Monitor vendor announcements for details on AI-discovered vulnerabilities and remediation timelines.
- Assess internal capacity to handle increased volumes of security findings from automated tools.
- Validate AI-generated vulnerability reports before applying patches to avoid unnecessary changes.
- Track industry trends in AI security models to anticipate future shifts in threat detection.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many people is Bank of America using to fix AI-found flaws?
Bank of America is using 4,000 people, including 1,000 contractors and 3,000 internal employees, to fix vulnerabilities found by AI models.
What AI model helped find these vulnerabilities?
Anthropic’s Mythos model, released in April to select partners, helped identify thousands of serious security vulnerabilities.
How much did Bank of America spend on this work?
The bank spent a few hundred million dollars in the third quarter on software work and anti-money-laundering requirements combined.
