Key Notes
- Bank of America added about 1,000 contractors in the second quarter to help existing staff patch software weaknesses exposed by advanced AI models, including Mythos.
- The hundreds of millions in disclosed third-quarter remediation spending covers both software repairs and anti-money-laundering work, with no standalone Mythos bill provided.
- Management expects benefits from its internal AI project pipeline to reach about $700 million in 2027, while anticipating that remediation costs will decline.
Bank of America Corp. (NYSE: BAC) brought in about 1,000 outside contractors to help patch software weaknesses exposed by advanced artificial intelligence models, including Anthropic’s Mythos, Chief Executive Brian Moynihan told CNBC.
The contractors joined during the second quarter and were still assisting the bank’s approximately 3,000 existing staff in that area when Moynihan spoke on October 14. CNBC reported that the work covered both proprietary systems and software supplied by third parties.
The disclosure illustrates an immediate cost of more capable AI: identifying weaknesses can create additional remediation work before productivity savings appear. It does not establish that the bank created 1,000 permanent developer positions or that Mythos caused the underlying vulnerabilities.
Contractors Expanded the Patching Effort
Moynihan described a push to address risks across a broad range of software as frontier AI capabilities advanced. The extra workers supplemented the bank’s existing personnel rather than replacing the whole security function.
His account places the hiring in April through June, not in the three months immediately before the October interview. The fact that the contractors remained involved in October also indicates that the work continued beyond the initial recruitment period.
Finding a vulnerability and resolving it are separate tasks. A financial institution must determine which systems are affected, prioritize the risk, coordinate changes with vendors and test whether a fix works without disrupting services.
The staffing increase therefore describes demand for a particular remediation effort. It does not, by itself, measure the net effect of AI on banking employment or establish how long those contractor assignments will last.
The Cost Figure Covers Two Remediation Programs
The bank’s own earnings-call transcript confirms Moynihan’s explanation that more than a couple of hundred million dollars of third-quarter spending covered both anti-money-laundering remediation and work associated with Mythos implementation.
The public disclosure does not provide a separate dollar amount for Mythos-related software repairs. Assigning the entire combined figure to the AI model would overstate what the bank has disclosed.
Moynihan also described the additional 1,000 workers as consultants outside employee headcount. That distinction helps explain how contractor spending can increase while the bank reports fewer employees overall.
The compliance work follows the enforcement actions we previously reported. Those regulatory proceedings concern the bank’s anti-money-laundering and sanctions controls; they should not be presented as a penalty for using Mythos.
Mythos Exposes Existing Software Risks
Anthropic introduced Claude Mythos Preview through Project Glasswing in April, providing selected organizations with access for defensive security work. The company describes the model as capable of finding and exploiting software vulnerabilities at a substantially higher level than earlier systems.
Anthropic says its testing identified thousands of high-severity flaws across major software products. That is the developer’s description of its wider research, not a published count of vulnerabilities found inside Bank of America.
The bank has not disclosed a detailed inventory of affected applications, the severity of every finding or how many fixes have been completed. The available reporting also does not establish that the identified weaknesses resulted in a customer-data breach.
The economic issue is the gap between detection and resolution. Faster discovery can reveal a larger backlog of work, while deployment, validation and coordination still require people and operating resources.
AI Savings Remain a Separate Forecast
Moynihan told analysts the bank had implemented about 130 internal AI projects. He put the benefits at roughly $250 million–$300 million in 2026, with the project pipeline expected to reach about $700 million in 2027.
He also described technology development as an area where greater efficiency could allow more work for the same expenditure. These comments concern expected productivity benefits across the bank, rather than savings from the security-patching project alone.
The figures cannot be combined into a precise AI profit-and-loss calculation. The disclosed remediation costs include non-AI compliance work, while the projected benefits cover a different collection of projects and future periods.
Moynihan expects the elevated remediation costs to decline as the initial work moves through the system. That is management’s expectation, not a confirmed date for completing the fixes or ending the contractor assignments.
Investors Need to Track Costs and Execution
The staffing disclosure came alongside Bank of America’s third-quarter results. As we reported, a $1.2 billion regulatory settlement charge and weaker trading performance weighed on that earnings release and the October 14 stock reaction.
The new details add context to operating expenses without changing the nature of the fine. Paying a settlement, completing compliance requirements and repairing software involve different obligations, even when all three affect the bank’s cost outlook.
For investors, evidence of progress would include lower remediation spending alongside reliable systems and delivery of the projected productivity benefits. A reduction in cost alone would not establish that security risks had been resolved.
The broader employment lesson is similarly specific: AI-supported vulnerability discovery increased demand for contractors at one major bank. It is evidence that automation can create additional work in particular functions, while leaving the bank-wide and longer-term employment effects unsettled.
