Bank of America (NYSE: BAC) brought in roughly 1,000 external contractors during the second quarter of 2026 to help its existing workforce close software vulnerabilities uncovered by advanced AI models, including Anthropic’s Mythos, CEO Brian Moynihan disclosed in an interview with CNBC following the bank’s third-quarter earnings release on October 14.
The contractors, engaged as consultants and therefore excluded from the bank’s permanent headcount, joined approximately 3,000 internal technical staff already focused on the remediation effort.
They remain on site assisting with the work.
Moynihan explained that the findings affected both the bank’s proprietary code and software supplied by outside vendors.
“That risk is real risk, and that’s why when the frontier-type models came out… a lot of us sat down and said, ‘How do we figure out how to get through this quickly?’” he told CNBC.
Anthropic made a preview of Mythos available in April through its restricted Project Glasswing program to a limited set of banks, technology companies, and government agencies.
The model is designed to identify and, in controlled settings, demonstrate complex software weaknesses at scale—capabilities that have accelerated discovery of flaws that previously took longer for human teams to surface.
Early access by major financial institutions prompted a rapid industry-wide response to prioritize and apply patches before potential exploitation.
On the earnings call the same day,
Moynihan told analysts that third-quarter costs included “a couple hundred million plus” related to software remediation together with separate anti-money-laundering compliance work stemming from a recent Treasury Department penalty.
He indicated the software portion should decline once the initial backlog is cleared, noting that “once you patch, you don’t have to patch as much” and that the volume of work is expected to taper.
He also cautioned that organizations must remain alert because the same parties developing the scanning tools may later offer remediation services.
The episode underscores the dual effects of frontier AI in enterprise environments.
While models like Mythos force near-term defensive spending by revealing longstanding issues in both internal systems and vendor code, Bank of America is simultaneously applying AI elsewhere for efficiency gains.
Moynihan reported that the bank has roughly 130 internal AI projects underway, with expected savings projected to rise from about $300 million this year to $700 million in 2027.
The firm’s overall headcount has declined by roughly 3,400 over the past year, including cuts of about 5 percent of managers, though the precise contribution of AI to those reductions remains unclear.
Shares of Bank of America fell as much as 8 percent on the earnings day amid broader results that included the elevated remediation and compliance expenses.
The bank’s disclosures provide one of the more concrete public accounts yet of the staffing and financial resources major corporations are allocating to address vulnerabilities surfaced by restricted but highly capable AI security models.
Other large banks have also had access to Mythos and reported similar pressures to accelerate patching timelines from weeks to days in some cases.
As organizations continue integrating such tools, the balance between accelerated discovery of weaknesses and the capacity to remediate them at speed will remain a central operational and budgetary consideration for critical infrastructure providers and regulated industries.
