Bank of America Hires 1,000 Contractors to Patch AI-Exposed Software Flaws
Anthropic restricted Mythos model exposed decades-old vulnerabilities in bank code, costing Bank of America hundreds of millions to fix.
Business · Source: AlphaStreet (BofA Q3 2026 earnings call transcript)
What happened
Bank of America hired 1,000 outside contractors to help 3,000 internal staff patch software vulnerabilities. Anthropic restricted Mythos AI model exposed these flaws. Chief Executive Brian Moynihan confirmed the hiring during an interview on CNBC. The contractors are fixing both the bank proprietary code and software supplied by third-party vendors. The effort places outside workers alongside the bank existing team to accelerate repairs.
The cleanup is proving expensive for the financial giant. Moynihan told analysts the bank spent a couple hundred million plus in the third quarter alone. That figure covers both the software remediation and regulatory issues related to anti-money-laundering compliance. The contractors arrived in the second quarter and were still working at the bank as of mid-October. Moynihan characterized the spending increase as temporary while the repair work moves through the bank systems.
Anthropic released Mythos in April to a small group of banks, technology companies, and government agencies. The advanced model can identify and exploit software flaws that have existed for decades. Moynihan described the risk as real and said the bank moved to work through the vulnerabilities quickly. Other banks share these concerns. JPMorgan Chase CEO Jamie Dimon noted that cyber risks rose tenfold after the model launched.
Key facts
- 1,000 — Number of outside contractors hired by Bank of America to patch software flaws
- 3,000 — Number of internal bank staff working on the software patching effort
- $700 million — Projected savings from Bank of America internal AI projects in 2027
- 130 — Number of internal AI projects currently running at Bank of America
- 8% — Maximum drop in Bank of America shares on October 14
Why it matters
This is the first hard look at the enterprise cost of defending against frontier AI models. AI is not inventing new ways to hack into systems. It is simply pointing out where the doors have been left open for decades. The vulnerabilities were always there. They were hiding in millions of lines of legacy code. It took an advanced model to find them at scale. Now banks are forced to clean up years of technical debt all at once.
The second-order effect is a massive transfer of wealth to cybersecurity contractors and IT service providers. AI models find the holes instantly. But human workers still have to write, test, and deploy the patches. Vendors who sold vulnerable software are now likely charging to help fix it. This creates a lucrative loop for tech services. It balloons defense budgets for large enterprises while they wait for AI coding agents to become reliable enough to fix the bugs they find.
For builders
Sell remediation services to large enterprises
Advanced models will expose legacy vulnerabilities across every Fortune 500 company. Enterprises need human contractors to patch these flaws right now. If you run a development shop, pivot to AI-driven security remediation and sell your services to legacy institutions.
Audit vendor software before deployment
Bank of America is paying to fix code they did not even write. Third-party vendor software is a massive liability when AI can read the binaries. Builders who create automated auditing tools for vendor code can charge a premium to procurement departments.
Build internal AI to offset defense costs
Bank of America expects savings from 130 internal AI projects to hit 700 million dollars in 2027. Defense costs money, but automation saves it. Build internal tools that cut operational overhead to fund your growing security budget.
My take
We thought AI would give hackers new weapons. Instead, it just showed us our own sloppy work. AI did not break into the bank. It just pointed to the open doors. Finding the bugs is automated, but fixing them still requires thousands of expensive humans.
Original reporting: AlphaStreet (BofA Q3 2026 earnings call transcript). This is my rewrite and opinion.