Bank of America hires 1,000 contractors to patch software flaws exposed by Anthropic's Mythos

Bank of America hired 1,000 external contractors to help patch software vulnerabilities that Anthropic's Mythos AI model exposed, CEO Brian Moynihan told CNBC on Wednesday. The bank's third-quarter remediation and compliance costs swelled by hundreds of millions of dollars, driving a stock drop of as much as 8% as investors weighed the immediate price of defensive AI security.

The contractors joined 3,000 internal staff during the second quarter to rush fixes across proprietary and vendor code. "That risk is real risk, and that's why when the frontier-type models came out … A lot of us sat down and said, 'How do we figure out how to get through this quickly?'" Moynihan said. "We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today."

Moynihan told analysts the bank spent a "couple hundred million plus" in the third quarter on software remediation and anti-money laundering compliance issues. The comments mark one of the first times a major U.S. corporation has disclosed specific headcount and dollar figures tied to defending systems against Mythos, which was released in April to a restricted group of banks, technology firms, and government agencies.

The dual cost of AI capability

The episode illustrates a split reality for large enterprises. While generative AI can cut costs through automation, models like Mythos can also identify and exploit decades-old software flaws, forcing companies into expensive, urgent patch cycles. Moynihan acknowledged the tension: "We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services."

Despite the short-term hit, Moynihan said the spending spike should recede. "Once you patch, you don't have to patch as much. … The pipeline moves through," he said. The remediation work targets both internal systems and third-party vendor software, widening the scope beyond what an internal team alone could handle quickly.

Savings from internal AI projects

The bank is also generating returns from its own AI investments. Bank of America runs about 130 internal AI projects, and Moynihan told analysts that savings from those efforts are projected to climb from $300 million this year to $700 million in 2027. The bank's total head count fell by roughly 3,400 employees over the past year, including a 5% reduction in managers, though the company has not specified how much of that decline ties directly to AI-driven efficiency.

Organizations facing similar vulnerability exposure can benefit from structured training that connects cybersecurity practices with AI-specific threats. Courses in AI Security Analytics help teams build the detection and response capabilities that large-scale patch efforts demand.

Why this matters for executives and strategy leaders

The Bank of America disclosure provides a concrete benchmark for the defensive costs that frontier AI models can impose on large organizations. A "couple hundred million plus" in quarterly expenses - and a 1,000-person contractor surge - signals that AI-driven vulnerability exposure is not a theoretical risk. It is a line item that can move earnings and stock prices. Leaders should model remediation costs as a recurring, though potentially declining, operational expense rather than a one-time event. For CIOs and strategy heads, integrating AI threat response into budget planning and workforce strategy - including targeted upskilling through resources like an AI IT Strategy Training path - is now a fiduciary concern, not just a technical one.