Bank of America recruited an additional 1,000 contractors to help patch vulnerabilities discovered by Anthropic’s Mythos model, a scale-up the bank said was necessary to address a sudden flood of security work.
Brian Moynihan: remediation spending, contractors, and efficiency claims
Brian Moynihan, chairman and CEO at Bank of America, told analysts on the company’s Q3 earnings call that the bank spent “a couple of hundred million plus” in remediation costs tied to Mythos and to anti‑money laundering (AML) orders issued the same week. He said the firm brought in outside help because concerns grew over how it would quickly tackle all the work associated with Mythos’ discoveries, later reiterating the decision in remarks to CNBC.
Moynihan said the 1,000 contractors added in the quarter were layered on top of the bank’s existing 3,000 technical staff and that the contractors remain at the bank for now, although he expects that their assistance “won’t be needed in the longer term.” He also told analysts BoA has made its tech engineering workforce about 10 percent more efficient, and that each of the roughly 130 AI‑related projects the bank has running is expected to achieve a 2x or 3x return on investment over time. For 2026 he forecast AI projects would deliver between $250 million and $300 million in benefits, rising to an expected $700 million by the end of 2027, but “he didn't detail how.”
Anthropic’s Mythos: rapid discovery, marketing, and industry reactions
The bank’s contractor surge followed discoveries made by Anthropic’s Mythos model, which—according to the reporting—was marketed in ways that raised industry concern about disrupting the cybersecurity status quo. Mythos proved “highly effective and capable of identifying complex vulnerabilities quicker than humans,” producing a large influx of patches for early adopters.
At the same time, some practitioners tempered the marketing narrative. Mozilla CTO Bobby Holley said in April: “So far we've found no category or complexity of vulnerability that humans can find that this model can't,” after Mythos found 271 flaws in Firefox 150. Holley added: “We also haven't seen any bugs that couldn't have been found by an elite human researcher,” a comment that undercuts the claim that the model represents an entirely new class of discovery beyond existing human capability.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogFinCEN, OCC, and OFAC orders: concurrent penalties and a profit hit
The remediation numbers arrived in the same period Bank of America disclosed multiple regulatory settlements. The bank agreed to a $1.21 billion settlement with the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) related to failures to police national security risks, including Chinese money laundering, and a failure to report over $5 billion in suspicious activity. That order was issued concurrently with a $750 million penalty from the Office of the Comptroller of the Currency tied to Bank Secrecy Act and AML compliance deficiencies.
Bank of America also agreed to an $11.6 million settlement with the Office of Foreign Assets Control for sanctions violations, including those related to Iran, Russia, narcotics, and global terrorism. The bank reported a 17 percent drop in profits; its share price slid more than 8 percent Wednesday morning after that disclosure and the $1.21 billion settlement was announced.
Workforce reductions, management cuts, and AI's ambiguous role
Moynihan said the bank has reduced around 3,000 roles overall, including a 5 percent decrease in the number of managers on the payroll, but he did not specify how much of those reductions were driven by AI. He also did not break down how much of the “couple of hundred million plus” in remediation costs were devoted specifically to AI or to Mythos work versus costs tied to cleaning up AML issues; rather, the CEO lumped those remediation costs together on the call.
What this means for technologists and security teams; policymakers and regulators; procurement leaders
- Technologists and security teams: rapid, model-driven vulnerability discovery can produce a surge in patching work that requires immediate scale—Bank of America’s decision to add 1,000 contractors on top of 3,000 technical staff illustrates how discovery volume can outpace in‑house capacity.
- Policymakers and regulators: the concurrent FinCEN, OCC, and OFAC actions show that regulatory remediation can compound the cost and operational burden on a major financial institution; the bank grouped AML remediation and AI‑driven vulnerability work together when reporting costs.
- Procurement leaders and buyers: the case highlights the tension between marketing claims and operational reality—Anthropic’s Mythos was described as “marketed as an all‑powerful model” while some adopters judged its output comparable to elite human researchers, suggesting buyers must plan for both discovery volume and realistic expectations about what models deliver.
Bank of America’s disclosures stitch together two pressing pressures: a sudden wave of vulnerability findings attributed to an AI model, and regulatory penalties tied to longstanding compliance failures. The bank has signaled it expects AI to deliver rising economic returns—$250–$300 million in 2026, growing to $700 million by end‑2027—while simultaneously absorbing immediate remediation costs and temporary contractor spending. What remains explicit in the record is what Moynihan himself acknowledged: the bank spent “a couple of hundred million plus” and declined to parse how that total divides between AI remediation and AML-related remedies, leaving investors and observers to watch whether the projected AI gains materialize as the remediation burden fades.
