Bank of America brought in 1,000 contractors in the second quarter to fix software vulnerabilities found by Anthropic's Mythos AI model, Chairman and CEO Brian Moynihan said, The Register reported Thursday. The figure is one of the first concrete measures from a major bank of what AI-driven vulnerability discovery costs: once a model can find flaws at scale, the hard and expensive part becomes fixing them.

What Happened

Mythos is an Anthropic model built to search software for security weaknesses, which the company has made available only to a limited group of organizations. According to The Register, the 1,000 contractors joined about 3,000 existing technical staff at the bank and are still working there. Moynihan told CNBC, as cited by The Register, that the bank sought outside help because of concern about how quickly it could work through what Mythos had found. The Register said the extra workers are not expected to be needed over the longer term.

On the bank's third-quarter earnings call Oct. 14, Moynihan put remediation spending at "a couple of hundred million plus." He grouped Mythos-related work with cleanup tied to anti-money-laundering orders issued that week and did not say how the total divided between the two. He said he expects remediation costs to decline as the contractors work through the initial backlog.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Moynihan also told analysts the bank has about 130 AI projects, each expected to return two to three times its cost over time, and that its technology engineering workforce is roughly 10% more efficient. He projected AI benefits of $250 million to $300 million in 2026, rising to about $700 million by the end of 2027, without explaining how those figures were calculated. The bank has cut about 3,000 roles, including 5% of managers, and did not say how much AI contributed.

Why It Matters

Security teams have long measured themselves on finding problems. Tools like Mythos shift the constraint to repair capacity: engineers to write and test fixes, change windows to deploy them and budget to pay for both. Bank of America's answer was to rent capacity quickly. Epic Systems, the health records vendor, took a different route and paused most product development to fix flaws Mythos surfaced.

For boards, the lesson is to budget for the backlog before switching on AI-assisted code audits, whether run internally or by vendors. A surge of findings can strain staffing, slow other projects and create a record of known but unfixed flaws that regulators and litigants may later examine.

The volume, not novelty, appears to be what changes. The Register recalled that Mozilla's chief technology officer, Bobby Holley, said in April that Mythos found 271 flaws in Firefox 150 but nothing an elite human researcher could not have found. Machines that do expert-level work at much higher speed still leave people to do the fixing.

Regulatory Backdrop

The remarks came in a difficult quarter. The Register reported that third-quarter profit fell 17%, driven by a $1.21 billion settlement with the Financial Crimes Enforcement Network, a Treasury Department bureau, over failures that included not reporting more than $5 billion in suspicious activity. The Register said the bank also faced a $750 million penalty from the Office of the Comptroller of the Currency over anti-money-laundering compliance and an $11.6 million settlement with the Treasury's sanctions office. FinCEN lists the enforcement action as Case 2026-03, released Oct. 13. The bank's shares fell more than 8% on the morning of Oct. 14, according to The Register.

What to Watch

Watch whether other large banks disclose similar remediation spending during this earnings season, and whether Bank of America separates its Mythos costs from its anti-money-laundering cleanup in later filings. Whether the contractor force shrinks in coming quarters will show if Moynihan's expectation of falling costs holds. U.S. bank supervisors are already asking banks how they control AI agents, and AI-found vulnerabilities could join those questions.