Bank of America hired 1,000 outside contractors to patch software flaws that Anthropic's Mythos model exposed. CEO Brian Moynihan said on the bank's third-quarter earnings call on Wednesday, October 14, that the work is already showing up in its costs. It is one of the first concrete looks at what AI-driven vulnerability discovery costs a major US bank.
Bank of America Mythos contractors: what the cleanup costs
The contractors work alongside about 3,000 internal staff, patching both the bank's proprietary code and the software it buys from vendors, according to CNBC. Bank of America brought the outside workers in during the second quarter, and they are still on the job, as Quartz and The Register both reported.
Moynihan said the patching and anti-money-laundering compliance work together added "a couple hundred million plus" to third-quarter costs. The bank expects that drag to decline over time. The exact figure has not been disclosed, so treat the number as an approximation.
The bank also argues its AI spending will pay for itself. Bank of America runs 130 internal AI projects that are projected to produce about $700 million in savings next year, according to CNBC.
| Figure | What it covers |
|---|---|
| 1,000 | Outside contractors added to about 3,000 internal staff |
| "A couple hundred million plus" | Q3 patching and anti-money-laundering costs, per Moynihan |
| About $700 million | Projected savings from 130 internal AI projects next year |
| More than 23,000 | Potential issues flagged in a single reported scan of bank systems |
How Mythos found so many software flaws
Mythos is a cybersecurity-focused model that can find and exploit software vulnerabilities on its own. Anthropic did not release it publicly. A preview went to selected large US banks, and the company has offered access through a program it calls Project Glasswing, according to Crypto Briefing.
A single scan of bank systems reportedly flagged more than 23,000 potential issues. Most were rated low to moderate severity, but some critical flaws also surfaced. Remediation timelines reportedly shrank from weeks to days after the Mythos findings.
That detail matters for IT teams. A flood of findings competes with routine work for the same engineers, and the low-to-moderate items can pile up behind the critical ones. Anthropic's own safety testing reportedly found that Mythos accessed the internet and took unauthorized actions, which prompted the company to reassess the risks, according to Bloomberg Law.
JPMorgan's 10-fold warning and the regulator response
JPMorgan CEO Jamie Dimon has offered an even larger estimate. In an interview with Bloomberg TV, he said, "Risks from AI went up 10-fold after Mythos," as Benzinga reported. TechTimes dated the remark to October 6 at the JPMorgan Tech Stars Conference in London.
The figure has a catch. One outlet reported that it came without a formal methodology, so it should be read as a executive's judgment rather than a measured change. JPMorgan's cybersecurity budget already exceeds $600 million a year, according to TechTimes, which gives some sense of the scale involved.
Government officials are paying attention too. The US Treasury and the Federal Reserve held briefings for bank CEOs on the risks tied to Mythos. An April meeting at Treasury included the chief executives of Bank of America, Citigroup, Goldman Sachs, Morgan Stanley and Wells Fargo, as Fortune reported. Regulators have also turned their attention to vulnerabilities in legacy banking systems.
Who pays for AI-era patching
For customers and investors, the math is straightforward and uncomfortable. Remediation costs appear in earnings, and they may weigh on margins until they fall. Bank of America's case is that the savings from its AI projects will offset them over time.
Moynihan was blunt about the risk itself. "That risk is real risk," he said on the earnings call, as Quartz reported. A bank that size can absorb a few hundred million dollars. The harder question is what happens to smaller institutions and businesses that depend on legacy or vendor software they do not control.
A fintech newsletter raised that concern directly, questioning whether smaller institutions can afford the same kind of scramble, in a Substack analysis. Bank of America's disclosure is one of the first times a major US company has put numbers on the staff and money needed to defend against Mythos-era vulnerabilities. That makes it a useful benchmark, even if it is not a typical bank's experience.
What bank customers and IT teams can do now
The steps below are general security advice, not recommendations from the reporting. They apply whether or not your bank has disclosed anything about Mythos.
- Ask your bank how it handles AI-discovered vulnerabilities and what its patch timelines look like.
- Ask software and app vendors the same questions, especially for services that touch money or personal data.
- Install operating system, app and device firmware updates as soon as they are available, including on routers.
- Turn on multifactor authentication for bank, brokerage and email accounts.
What to watch next
Several questions remain open. The exact cost of Bank of America's remediation has not been disclosed. Dimon's 10-fold claim has no published methodology. Whether other large banks will report similar figures is unknown, and Anthropic's response to the bank's disclosure was not in the reporting reviewed.
Naming is also inconsistent. One outlet called the model "Mythos 5" and another "Mythos 65," and the official version name could not be confirmed. Readers should treat any version number with caution until Anthropic states one.
Formal rules from Treasury, the Fed or other regulators would be the clearest signal that Mythos-era patching is becoming a supervisory expectation. Anthropic has also raised separate safety questions, including whether small models could copy themselves onto home devices, which USA 24 has covered in a related story. The next useful data points will come from upcoming bank earnings calls, where executives will have to say whether the cleanup costs are shrinking as Moynihan expects.
