Bank of America hired 1,000 contractors to plug security holes uncovered by AI models
CEO Brian Moynihan said the bank brought on 1,000 contractors in the second quarter, on top of 3,000 existing employees, to fix software vulnerabilities exposed by Anthropic's Mythos — one of the first concrete accountings of the defensive work that frontier AI capabilities are triggering in the financial sector.
The news
On Wednesday, October 14, 2026, Bank of America CEO Brian Moynihan offered a rare concrete look at the operational and financial aftermath of advanced AI systems uncovering software vulnerabilities at scale. According to CNBC, the bank hired 1,000 external contractors in the second quarter of this year to help patch software flaws exposed by Anthropic's Mythos and other advanced AI models.
"We brought in 1,000 contractors to help us with the patching in the second quarter, and they are still here today helping us, on top of the 3,000 people we have in that area," Moynihan told CNBC.
That means roughly 4,000 people working on this defensive effort, still in place months after the security problems were identified.
The money — and what isn't separated
In his comments to analysts on the bank's third-quarter earnings report earlier on Wednesday, Moynihan said Bank of America spent "a couple hundred million plus" on software remediation combined with regulatory issues related to anti-money-laundering rules in the third quarter. He expects the remediation costs to decline.
The critical caveat: the figure combines Mythos-related software remediation with AML compliance costs, and neither Moynihan nor any of the sources breaks down how much belongs to AI-driven defensive work versus money-laundering obligations. Any attempt to isolate a "Mythos cost" from that number would be speculation.
The context: Mythos and what followed
Anthropic released Mythos in April of this year, only to a small group of banks, technology companies and government agencies through Project Glasswing. The company claimed the model had found thousands of serious security flaws — a claim that comes from Anthropic itself and has not been independently verified, according to The Decoder. OpenAI followed in May with its Daybreak cybersecurity program.
CNBC noted that Moynihan's comments are among the first from a major US company to specify the labor and dollars spent defending software systems against Mythos specifically. It is exactly this specificity that makes the disclosure significant: most discussions of AI-driven cybersecurity remain abstract, while this one puts actual numbers on the table.
A sector-wide echo
Moynihan is not alone. This earnings week brought similar comments from CEOs at other major banks. Jane Fraser at Citigroup, Ted Pick at Morgan Stanley, David Solomon at Goldman Sachs and Jamie Dimon at JPMorgan all raised defenses against "rogue" AI agents in their remarks, according to Business Insider via Yahoo Finance.
Fraser put it this way: "We don't wait for risks to happen," adding: "We have hardened our systems and run challenging and disruptive scenarios to stress-test our defenses and our responses."
The financial picture
The context for Moynihan's disclosure is significant: Bank of America's share price fell more than 8 percent on Wednesday morning after a 17 percent drop in profit, tied to a $1.21 billion settlement, The Register reported. The profit decline stemmed from that settlement, not the Mythos costs, but together they made the disclosure immediately market-moving news.
Moynihan countered with an AI-optimistic narrative. The bank has roughly 130 internal AI projects, with expected savings rising from $300 million this year to $700 million in 2027, according to comments to analysts. He said each project is expected to deliver two to three times its return over time, that the technology engineering workforce has become about 10 percent more efficient, and that the bank has cut around 5 percent of its managers.
The unresolved item: The Register reported that headcount fell by "around 3,000 roles" in that process, while CNBC suggested roughly 3,400 employees over the past year. That discrepancy is not resolved, and both figures stem from secondary reporting of the same CNBC interview and earnings report.
What we don't know
Several critical questions remain open:
- Mythos's share of the costs: The "couple hundred million plus" figure mixes software remediation with AML compliance; the AI-specific component is not separated.
- The duration of the contractor effort: Moynihan said the contractors are "still here today," but did not say whether the 1,000 roles will persist, be scaled down or convert to permanent hires.
- Independent verification: Anthropic's claim of "thousands of serious security flaws" found by Mythos comes from the company itself; neither that claim nor the specific vulnerabilities that triggered Bank of America's response have been independently confirmed.
- The workforce figures: The discrepancy between 3,000 and 3,400 cut roles remains unresolved.
Why it matters
This is one of the first concrete, quantified accountings of the defensive work that advanced AI cybersecurity capabilities are already forcing on major institutions — not as a future risk, but as a present cost measured in thousands of workers and hundreds of millions of dollars combined with other regulatory outlays. It also points toward a broader industrial adjustment: even as banks invest aggressively in AI for savings, they are simultaneously spending significant resources defending against the same set of capabilities.