Bank of America hires 1,000 contractors to patch bugs found by Anthropic's Mythos model

Bank of America recruited 1,000 contractors to patch the flood of vulnerabilities Anthropic's Mythos model uncovered, CEO Brian Moynihan said Wednesday.

Moynihan disclosed the staffing surge during the bank's third-quarter earnings call, saying the bank spent "a couple of hundred million plus" on remediation tied to both the Mythos findings and anti-money laundering orders issued this week. The contractors, hired in the second quarter, remain at the bank today.

The bank turned to outside help as the scale of the patching work grew beyond what its existing team could absorb, Moynihan told CNBC. Anthropic marketed Mythos as a model that would upend cybersecurity, and early results supported the hype: the model identified complex vulnerabilities faster than human researchers could, producing a backlog of fixes that required the extra hands.

Early adopters see capability, not magic

The results from other organizations point to Mythos as a force multiplier rather than a replacement for skilled researchers. Mozilla CTO Bobby Holley said in April that Mythos found 271 flaws in Firefox 150 and reported no category of vulnerability the model could find that humans couldn't.

"We also haven't seen any bugs that couldn't have been found by an elite human researcher," Holley said.

The 1,000 contractors joined Bank of America's existing 3,000 technical staff. Moynihan said the bank expects the contractors' help to taper off as the initial patching backlog clears.

AI savings and layoffs run alongside patching costs

Moynihan told analysts the bank has made its technology engineering workforce about 10% more efficient. Each of roughly 130 AI projects now running is expected to return two to three times its cost over time. For 2026, Moynihan expects AI projects to deliver between $250 million and $300 million in benefits, rising to $700 million by the end of 2027. He did not detail how the bank arrives at those figures.

The bank also cut about 3,000 roles, including a 5% reduction in managers, without specifying how much of that stemmed from AI adoption.

Regulatory fines drag on results

The Mythos patching costs arrived alongside a much larger regulatory mess. Bank of America agreed to a $1.21 billion settlement with the Treasury's Financial Crimes Enforcement Network over failures to police national security risks, including Chinese money laundering, and to report more than $5 billion in suspicious activity. The Office of the Comptroller of the Currency added a $750 million penalty for Bank Secrecy Act and anti-money laundering compliance failures, and the bank settled with the Office of Foreign Assets Control for $11.6 million over sanctions violations tied to Iran, Russia, narcotics and global terrorism.

Those penalties contributed to a 17% drop in quarterly profits. Shares fell more than 8% Wednesday morning after the results.

Moynihan lumped the regulatory cleanup and Mythos remediation together in his "couple of hundred million plus" figure without breaking out how much went to each, though the contract work is expected to decline as patching slows.

What changes

For other institutions watching Mythos rollouts, the Bank of America episode offers a concrete planning lesson. An AI model that finds vulnerabilities faster than humans shifts the bottleneck from discovery to remediation, and remediation demands people. Banks and large enterprises running similar tools should budget for surge patching capacity, because the flaws the model surfaces don't fix themselves.

The remediation costs should ease over time as the initial backlog clears, Moynihan said, leaving the contractors to move on while the bank's permanent engineering staff absorbs the ongoing load.

Comments