The Pulse
Bank of America Adds 1,000 Contractors to Patch AI-Found Flaws
Bank of America CEO Brian Moynihan said the bank added 1,000 contractors in the second quarter to help patch software vulnerabilities identified by advanced AI models, including Anthropic’s Mythos. He told analysts that third-quarter remedi
AI.info Team · Written with AI ·
1,000 Contractors Joined 3,000 Staff
On October 14, Bank of America CEO Brian Moynihan said the bank had brought in about 1,000 outside contractors during the second quarter to help repair software weaknesses identified by advanced AI models. He named Anthropic’s Mythos among those models. The contractors were still working at the bank when Moynihan made the disclosure, alongside roughly 3,000 employees already assigned to the work.
Moynihan described the contractors as consultants rather than bank employees. The distinction matters: the additional workers mark a sizable short-term expansion of the patching effort, but do not appear in the bank’s reported employee count. The bank has not published a separate figure for how many vulnerabilities the group has repaired.
On the earnings call, Moynihan, Bank of America’s chair and CEO, said:
“We added 1,000 extra staff to work on that, not in the headcount but in consultants.”
The Work Reaches Beyond Bank of America’s Code
The vulnerabilities affect software used by the bank and by its outside vendors, according to Moynihan’s account. That broadens the repair task beyond systems Bank of America built itself: fixes may also depend on software suppliers, their release schedules and the bank’s own testing before changes reach production. The disclosure does not identify particular products or flaws.
Anthropic opened access to Mythos in April through Project Glasswing, a limited programme involving companies, banks and government agencies that aimed to find and patch software weaknesses before attackers could exploit them. A month later, U.S. regulators paused some cyber examinations to give large banks time to address vulnerabilities identified by the model, The Next Web reported. JPMorgan Chase CEO Jamie Dimon had also said in May that his bank had hundreds of people working full-time on the issue.
One Spending Figure Covers Two Problems
Moynihan told analysts that third-quarter remediation costs reached “a couple hundred million dollars plus.” The figure combines work related to Mythos with repairs to the bank’s anti-money-laundering controls; the bank did not break out the AI-related portion. It therefore cannot be read as a price tag for Mythos or for the contractors alone.
Moynihan expects the Mythos-related share of that work to decline as the patching queue moves forward. He framed the contractors as help for an unusually large burst of repairs, rather than a permanent addition to the bank’s employee base. The remarks did not specify when the current contractors might leave or how much the bank expects to spend on remediation in later quarters.
The Patch Queue Is the Measurable Result
The disclosure puts a headcount on the work that follows AI-assisted vulnerability discovery, but it does not show how much faster the bank can close flaws or how many fixes have reached its systems. It also leaves open how much of the task depends on vendors, whose software sits outside the bank’s direct control. Those details will determine whether the added staff are clearing a one-time backlog or supporting a longer-running repair programme.
For now, Moynihan’s figures describe a team of roughly 4,000 people: 3,000 existing employees and 1,000 consultants brought in during the second quarter. The contractors remain separate from Bank of America’s employee headcount, while the quarter’s combined remediation figure still includes anti-money-laundering work.