Bank of America brought in 1,000 outside contractors this year to fix software flaws exposed by Anthropic’s Mythos and other powerful AI models. CEO Brian Moynihan shared the number on Wednesday, after the bank posted its third-quarter results. It is one of the first times a major US company has put real headcount and dollars on the cost of cleaning up after Anthropic Mythos.
How Anthropic Mythos Changed the Bank’s Security Plans
Anthropic released Mythos in April, but only to a small group of banks, tech firms, and government agencies through a program called Project Glasswing. The company said the model had found thousands of serious security holes. That set off a rush across the industry to patch old code before attackers could use similar tools.
Moynihan said Bank of America sat down soon after these frontier models appeared and asked how to get through the work fast. The answer was more people. The bank added 1,000 contractors in the second quarter, and they are still on the job today.
Contractors Join a Team of 3,000
The new workers sit on top of roughly 3,000 internal staff who already handle this area. Together, they are patching both the bank’s own software and code supplied by outside vendors. Moynihan called the threat “real risk” in his interview with CNBC.
| Detail | What Bank of America shared |
|---|---|
| Outside contractors added | 1,000, starting in Q2 2026 |
| Internal staff in the area | About 3,000 |
| Q3 cost (patching plus AML work) | A “couple hundred million plus” |
| Internal AI projects | About 130 |
| Expected AI savings in 2027 | $700 million |
What the Mythos Cleanup Is Costing
Moynihan did not give a separate price tag for patching alone. He told analysts the bank spent a “couple hundred million plus” in the third quarter on software fixes and anti-money laundering compliance combined. The money-laundering side is tied to a $1.21 billion settlement with the Treasury’s Financial Crimes Enforcement Network that also hit the quarter.
The bank’s shares fell as much as 8% on Wednesday as profits dropped. Moynihan tried to calm investors by saying the extra spending is temporary. His point was simple: once old code is patched, the pile of work shrinks, so costs should drift down over time.
A Warning About Who Sells the Fixes
Moynihan also made a sharp point about the security business. He said the bank has to stay ahead of attackers while remembering that the companies building these AI tools are often the same ones selling defensive services. In other words, banks are buying protection from the very labs whose models raised the alarm.
AI Is Also Saving the Bank Money
The Mythos story is only one side of the bank’s AI picture. Bank of America runs about 130 internal AI projects. Moynihan said savings from them should reach roughly $250 million to $300 million this year and climb to $700 million in 2027.
- He said the bank’s tech engineering staff has become about 10% more efficient.
- He expects each AI project to return two to three times its cost over time.
- Headcount fell by a few thousand roles over the past year, including about 5% of managers.
The bank did not say how much of that job reduction came from AI. That gap matters, because many workers want to know whether these tools are trimming teams or just changing how work gets done.
Why Early Doubts About Mythos Faded
When Anthropic first warned about Mythos, some critics called it a marketing stunt. OpenAI followed in May with its own cybersecurity program, called Daybreak. Over the following months, independent tests and real security incidents made the danger harder to dismiss.
Early users gave a more measured view. Mozilla’s CTO said in April that Mythos found 271 flaws in Firefox 150, but that none were beyond what an elite human researcher could find. The difference is speed and scale, and that is exactly what forces a big bank to hire an army of patchers.
You can read more about how Anthropic handles risky agent behavior in our earlier coverage.
What This Means for You
Most people will never touch Mythos, but its effects still reach your bank account and the apps you use. Here is what to keep in mind:
- Expect more frequent software updates from banks and apps. Install them promptly, since many now fix flaws AI has found.
- Turn on alerts for card and account activity, so you spot problems fast if a company slips.
- If you run a small business, ask your software vendors how they are handling AI-found bugs. A simple guide to AI threat detection can help you start that conversation.
- Watch for the same pattern at other big companies. Bank of America is early to share numbers, but it is unlikely to be the only firm paying for this cleanup.
For a wider look at defensive tools, browse our cybersecurity tools list. You can also learn more about the Claude AI assistant made by the same company behind Mythos.
Sources
This article draws on reporting from CNBC, The Register, and The Decoder, including comments from Bank of America’s CEO.
Conclusion
Bank of America has given the clearest look yet at what AI-found security flaws cost a large company: 1,000 extra contractors and hundreds of millions of dollars in a single quarter. The bank insists the spending will fall once the backlog is cleared. At the same time, its own AI projects are expected to save far more by 2027. The lesson is that frontier AI now cuts both ways, forcing big defensive bills even as it trims everyday costs. Follow more stories like this on our AI news page.
