Key points
- Bank of America brought in 1,000 outside workers to patch code flaws found by an AI security tool.
- CEO Brian Moynihan disclosed the effort after third-quarter results, citing costs in the hundreds of millions.
- The remediation follows a separate $1.21 billion Treasury penalty for anti-money-laundering failures.
Bank of America recruited roughly 1,000 external contractors to repair software weaknesses that an artificial intelligence model identified in its systems.
How it unfolded
- In April, Anthropic released Mythos to a limited group of vetted organizations, including banks, to find security flaws.
- US regulators paused some cyber exams a month later to allow large banks time to address what the model uncovered.
- In July, CEO Brian Moynihan warned that the model would significantly increase the workload for banks.
- On 14 October, Moynihan told CNBC that the bank hired 1,000 contractors in the second quarter for this work.
- The same day, federal regulators announced a $1.21 billion penalty against the bank for unrelated compliance failures.
Who is affected
Bank of America is managing a large-scale remediation effort involving both its own employees and outside consultants. According to Moynihan, about 3,000 internal staff members were already assigned to this task before the contractors joined. The weaknesses existed in code used by the bank and its outside vendors. The CEO stated that the remediation costs totaled "a couple hundred million dollars plus" for the quarter. This spending covered both the Mythos-related patching and repairs to anti-money-laundering controls. The 1,000 contractors are not included in the bank’s official headcount because they were hired as consultants.
What happens next
Moynihan expects the spending related to the Mythos project to decrease now that the additional workforce is in place. He noted that once vulnerabilities are patched, the immediate need for such intensive labor will diminish. Financially, the bank’s revenue rose about 3% to nearly $30 billion in the quarter. However, adjusted earnings of $1.08 per share missed analyst forecasts, causing the stock to close almost 5% lower. Regulatory pressure remains high, with US and European authorities questioning banks about AI risks.
The background in plain language
Advanced AI models can now scan code at speeds humans cannot match, uncovering hidden errors that traditional reviews miss. These tools do not just find bugs; they can demonstrate how an attacker might exploit them. When such a model reveals widespread weaknesses, organizations must prioritize fixes to prevent data breaches or service disruptions. This often requires scaling up engineering teams quickly to patch systems before malicious actors take advantage of the known vulnerabilities.
What to do and how to stay safe: Bank of America
- Review your organization’s code scanning procedures to ensure they include automated vulnerability detection tools.
- Establish a clear process for prioritizing and patching high-severity flaws discovered by external audits or AI tools.
- Monitor official channels for regulatory guidance on AI-enabled security risks and compliance requirements.
- Verify that third-party vendor contracts include clauses requiring timely remediation of discovered software weaknesses.
Step-by-step guide: Injection attacks examples: how prompt leaks break AI systems
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much did Bank of America spend on these fixes?
CEO Brian Moynihan stated that remediation costs were "a couple hundred million dollars plus," covering both AI-found flaws and AML repairs.
What is Anthropic’s Mythos?
Mythos is a generative AI model with cybersecurity capabilities designed to autonomously discover and exploit unknown software vulnerabilities.
Why did regulators pause cyber exams?
US regulators paused some examinations to give large banks time to fix the vulnerabilities that the Mythos model had identified.
