Bank of America Hired 1,000 Contractors to Patch Flaws Found by Anthropic's Mythos

Bank of America added 1,000 contractors in the second quarter to patch software vulnerabilities surfaced by advanced AI models, including Anthropic's Mythos, CEO Brian Moynihan told CNBC. The disclosure came Wednesday, October 14, as the bank reported third-quarter results.

The contractors did not leave when the quarter did. According to Times Brasil's CNBC-based report, Moynihan said they are still working alongside the 3,000 people the bank already had in that area.

What the bank says it did

Mythos was released in April to a restricted group of banks, technology companies and government agencies, per Times Brasil. Bank of America was evidently on the receiving end of what these models can turn up. Moynihan, speaking to CNBC's Leslie Picker, described the mood when frontier models arrived:

"That risk is real risk, and that's why when the frontier-type models came out. … A lot of us sat down and said, 'How do we figure out how to get through this quickly?"

The disclosed response: 1,000 humans on contract. The models surfaced flaws; the bank bought fixing capacity by the thousand. That is a useful data point about where the work lands.

Moynihan also made a pointed remark about vendors, as Times Brasil renders it: the people who build the software are the same ones trying to sell the bank services. Read that as you like. I read it as a CEO's raised eyebrow.

The money, such as it is

Here the numbers get muddy, and the muddiness is the story. Bank of America spent "a few hundred million dollars" in the third quarter on software fixes and on regulatory issues tied to anti-money laundering compliance, Times Brasil reported. Futu News, citing Moynihan's remarks to analysts, put it at "over $200 million." Both describe one combined bucket.

So what did the patching cost on its own? The reporting does not say. It also does not break out how much went to the anti-money laundering work, which sits against a separate backdrop: Times Brasil's coverage also references fines of nearly $2 billion for failures in that area.

The broader picture, per the same coverage:

• Third-quarter profit: $6.9 billion.
• Shares fell as much as 8% on Wednesday, while Moynihan sought to reassure investors, according to Times Brasil. The coverage does not say what drove the drop.
• Moynihan expects remediation costs to decline as patching finishes. Once a problem is fixed, he said in the report, you do not have to do it as often, though the water keeps flowing.

What was not measured

The coverage gives a head count and a dollar range. It does not give a count of vulnerabilities found, how many were critical, or how many are fixed. It does not say which proprietary systems or third-party vendor codebases were affected. It does not say how long the contractors will stay.

A bill with no denominator is a vibe with a currency symbol.

Moynihan also gave analysts a second, quieter number set. The bank runs about 130 internal AI projects, with savings expected to rise from $300 million this year to $700 million in 2027, per Futu News. CNBC's framing says "next year," which lands on the same 2027. Over the past year the bank's workforce shrank by about 3,400 people as it cut roughly 5% of its managers. How much of that is attributable to AI is unclear, according to Futu News.

Put those side by side. One column projects hundreds of millions in savings from internal AI projects. Another says advanced models exposed flaws that needed 1,000 contractors and a chunk of a few-hundred-million-dollar quarterly line. The two are not netted against each other anywhere in the reporting, and I would not net them for the bank.

What to watch

Three things. First, whether the bank ever separates software remediation from anti-money laundering costs in its disclosures, so the software-remediation bill can be read directly. Second, whether the contractors roll off on a schedule or quietly become permanent. Third, whether other banks with access to these restricted models report similar surges, since Mythos went to a limited group of banks, tech companies and agencies.

The original CNBC story, by Hugh Son, ran Wednesday. The bank says the cost curve bends down. The bank says the cost curve bends down. For now, the reporting gives us an assurance, not a quantified forecast.