Bank of America CEO Brian Moynihan disclosed that the bank hired 1,000 external contractors to patch software vulnerabilities exposed by advanced artificial intelligence models, including Anthropic’s Mythos. Speaking after the third-quarter earnings release, Moynihan explained that the bank rushed to bolster internal and vendor code earlier in the year using thousands of employees and outside personnel. The remediation effort, which began in the second quarter, involved spending a "couple hundred million plus" on software fixes and anti-money laundering compliance issues during the third quarter.
The comments represent one of the first detailed disclosures by a major U.S. corporation regarding the manpower and financial resources dedicated to protecting systems from Mythos, an AI model released to a select group of banks, technology firms, and government agencies in April. Moynihan noted that while frontier AI models offer productivity benefits, their ability to uncover and exploit decades-old software flaws has forced companies into a costly defensive scramble. He emphasized the need to stay ahead of these risks, particularly given that software developers are also selling services to the institutions they build for.
This disclosure highlights a critical operational risk emerging from the rapid deployment of frontier AI models: the acceleration of vulnerability discovery outpacing traditional patch cycles. By mobilizing 1,000 contractors alongside 3,000 existing staff, Bank of America illustrates the scale of resource commitment required to secure legacy infrastructure against AI-driven exploits. This is not merely a technical upgrade but a fundamental shift in cybersecurity economics, where the cost of defense rises sharply as offensive capabilities become more accessible and potent through general-purpose AI tools.
The dual-edged nature of AI adoption presents a complex challenge for institutional credibility and market structure. While efficiency gains are promised, the immediate reality for large banks involves significant capital expenditure to mitigate newly exposed weaknesses. The tension between relying on vendors who sell both development services and security solutions underscores a potential conflict of interest that regulators may scrutinize. As other major corporations face similar pressures, the industry may see a consolidation of security operations or increased demand for specialized AI-audit services, reshaping how financial institutions allocate technology budgets.
