Bank of America has put 1,000 outside contractors to work patching software flaws that Anthropic's Mythos model exposed, and the cost now shows up in its quarterly results. CEO Brian Moynihan disclosed the headcount and the spending on Wednesday, October 14, during the bank's third-quarter earnings call. Shares slumped as much as 8% that day, according to CNBC.
The disclosure offers one of the most concrete looks yet at what AI-discovered vulnerabilities cost a large company to fix. It also answers a question many security teams have been asking: when a model finds old bugs at scale, who does the cleanup? At Bank of America, the answer is a mix of consultants and internal staff, paid for out of current earnings.
Bank of America Mythos contractors: who is doing the work
Moynihan told analysts the bank brought in 1,000 third-party consultants to work alongside 3,000 internal staff. The group is patching proprietary and vendor software flaws that Mythos surfaced. The contractors were added in the second quarter and are still working, according to Moynihan's account to CNBC.
Other coverage describes the effort as covering "advanced AI models, including" Mythos, which suggests the work is not limited to a single tool (Slashdot). Moynihan also described the hires as "Mythos remediation" on the call, according to a Ground News summary of the earnings call.
The reports do not say how much of the effort is tied to Mythos rather than other AI models. That split matters. If most of the work traces to one model, the spending is a response to a single discovery. If it spans several tools, it is a broader cost of AI-era security work that other banks will likely face too.
What Bank of America spent in the third quarter
Moynihan said the bank spent a "couple hundred million plus" in the third quarter on software remediation and on anti-money-laundering compliance work. BigGo put the figure at more than $200 million. Because the number blends two cost centers, the Mythos-only share is not separated out.
Moynihan framed the increase as temporary and said he expects remediation costs to decline over time. On the remediation push itself, he told CNBC: "We've got to stay ahead of them." The fourth-quarter and 2027 results will show whether the cost decline holds. The table below collects the key figures from the coverage.
| Item | Figure reported | Source |
|---|---|---|
| Outside contractors added | 1,000 | CNBC, Slashdot |
| Internal staff on the work | 3,000 | CNBC, Slashdot |
| Q3 spend on remediation and AML work | "couple hundred million plus" | CNBC |
| Q3 spend, BigGo estimate | More than $200 million | BigGo |
| Share decline on earnings day | Up to 8% intraday (CNBC); about 5% (BigGo) | CNBC, BigGo |
| Projected AI savings | $700 million next year | CNBC |
| Mythos scan findings | More than 23,000 potential issues | CryptoBriefing |
Stock reaction and the AI savings promise
Investors reacted sharply. CNBC reported that shares fell as much as 8% intraday, while BigGo put the decline at about 5%. The two figures have not been reconciled, so the 8% number should be read as the day's worst intraday level rather than a closing move.
The earnings story also carried a counterweight. CNBC reported that Bank of America's 130 internal AI projects are projected to produce $700 million in savings next year. BigGo described a different path, with $300 million this year rising to $700 million by 2027. Those timelines do not match, so the savings should be treated as a projection, not a result.
The core tension for investors is timing. Security spending arrives now, while AI efficiency savings are a forecast that arrives later. Bank stocks are sensitive to cost stories, and this one shows how an AI-discovered flaw can hit the income statement before any breach or fine does.
What the Mythos flaw scan found
Mythos is not publicly available. According to Superpower Daily, Anthropic released the model in April to a small group of banks, technology firms and government agencies through a program it calls Glasswing.
One scan of bank systems reportedly flagged more than 23,000 potential issues, according to CryptoBriefing. Most were rated low to moderate severity, but some critical flaws also surfaced. Raw counts can overstate risk, since many findings are minor, yet the critical items drive most of the urgency.
A secondary aggregator reported that, as of Anthropic's April publication, fewer than 1% of the potential vulnerabilities the company identified had been fully patched. That figure is secondhand, so check it against Anthropic's own page before citing it.
CNBC's analysis found that Mythos's ability to find and exploit old software flaws has forced firms into costly defensive work. That is the central reason the cost story matters beyond one bank.
Why regulators and banks are watching Mythos
The US Treasury and the Federal Reserve held briefings to walk bank CEOs through the heightened risks tied to Mythos, according to CryptoBriefing. A month after the April release, US regulators paused some cyber exams so the largest banks could fix what the model had found, as The Next Web reported.
The response is not limited to regulators. Jamie Dimon said in May that JPMorgan had hundreds of people working full-time on the issue, per The Next Web. CryptoBriefing also reported that Dimon has pointed to a potential tenfold increase in cyber risk exposure tied to Mythos.
Separately, the White House's new Super Intelligence Task Force began its first meeting on October 15. The task force is focused on using existing liability law to hold AI companies accountable for harms, according to Yahoo News, citing Politico. USA 24 has covered that angle in depth in a separate story on who pays when AI agents go rogue.
The Bank of America numbers point to a labor effect. AI-found vulnerabilities are creating demand for human patching work, not reducing it, at least in the near term. Consultants and vendors gain from that demand, while banks absorb the cost.
What bank customers should do now
The disclosure does not identify any customer data breach, and these reports do not show that customer information was exposed. Readers should not assume a breach occurred based on this coverage.
Standard security steps still apply. These are general recommendations, not advice drawn from the sources in this story:
- Keep banking apps updated from the official app store.
- Turn on multifactor authentication for your bank login and your email account.
- Install operating system and browser updates when prompted, and restart to finish the install.
- Review account alerts and report any unfamiliar transaction to your bank right away.
What to watch next
Several questions will determine whether this becomes a template for the industry. The first is whether other large banks will disclose comparable headcount or costs, which the reports do not yet show. The second is how the 1,000-contractor effort splits between Mythos and other AI models. The third is whether remediation spending falls as Moynihan expects, and the fourth is whether Anthropic's own patching data supports the less-than-1% figure.
The debate over containing powerful models is moving in parallel. Hinton, Bengio and about 400 scientists have urged air-gapped AI models, as USA 24 reported. For now, Bank of America's disclosure suggests that the bill for AI-driven defense will land in earnings long before any AI-driven savings do. The next earnings season will show whether that gap closes.
