MediumII Cyber Warfare & Critical Infrastructure15 October 2026, Thursday
Bank of America hires 1,000 contractors to patch flaws found by AI
Bank of America CEO Brian Moynihan said on the 14 October third-quarter call that the bank had taken on 1,000 extra contractors in the second quarter to fix flaws found by Anthropic's Mythos model. He put the cost, together with anti-money-laundering work, at more than several hundred million dollars.
According to a 15 October report by The Register, the contractors were added to the bank's existing 3,000-strong technical staff and remain at the bank for now. Moynihan did not separate the cost of Mythos-driven remediation from the anti-money-laundering clean-up, and said he expected the cost to fall over time. The number of flaws the bank has patched was not disclosed.
According to a 14 October report by Crypto Briefing, citing CNBC, Anthropic gave selected large US banks a preview of Mythos through the Project Glasswing programme in early April 2026, before releasing it publicly. The scans found thousands of flaws. According to the report, a single scan flagged more than 23,000 potential issues, most of them of low or medium severity. Whether that scan belonged to Bank of America could not be verified. Patching times are reported to have fallen from weeks to days.
According to the same report, the US Treasury and the Fed briefed bank CEOs on Mythos-related risks, and regulators are examining flaws in legacy systems. According to The Register, Mozilla's chief technology officer had said the model found 271 flaws in Firefox 150. As of October 2026, Mythos releases are available only to vetted security and research users through controlled programmes.
Talay assessment
Bottom line
AI has made finding flaws cheaper but not fixing them; one bank adding 1,000 contractors to a 3,000-strong team is the concrete cost of that gap. Controlled access gives large banks a head start for now. Once the same capability spreads to attackers, the patching capacity of smaller institutions becomes the real constraint. The most likely path is that large banks maintain remediation budgets and regulators tighten patch-time expectations for legacy systems.
Likely effects
- Bank technology spendingNegativeWeeks
With remediation costs above several hundred million dollars, technology budgets at large banks swell before any AI efficiency gains arrive.
- Smaller financial institutionsNegative1–6 months
Institutions without Mythos access and with limited patching staff remain more fragile once similar scans pass into attackers' hands.
- Cyber security servicesPositive1–6 months
Outsourcing patch work to contractors lifts demand for security consulting and software maintenance services.
Possibilities, ranked
- 1Remediation budget continues55%
Large banks keep the extra staff for a while, and the cost appears in fourth-quarter expenses too.
Watch: Technology and remediation cost disclosures on large US banks' fourth-quarter calls
- 2Regulatory bar rises30%
The Fed and the Treasury publish written expectations on patch times for legacy systems.
Watch: Written guidance to banks from the Fed or the Treasury on AI-discovered flaws
- 3Cost falls quickly15%
The backlog of flaws clears within a few months and most contractors leave by year-end.
Watch: Bank of America's comments on contractor numbers at its January call
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Extra contractors▼ 1,000
- Existing technical staff▲ 3,000