Bank of America hired 1,000 contractors to patch bugs that AI models found

Moynihan talked about it twice on Wednesday: on the bank's third-quarter earnings call with analysts, and in an interview with CNBC.

According to the quotes reported by CNBC, he called the risk from these models "real risk." When the "frontier-type models came out," he said, a lot of people at the bank sat down and asked how to get through the work quickly.

Their answer was more hands. Here is what he laid out:

• Contractors: 1,000 outside workers, hired in the second quarter of 2026.
• Existing team: about 3,000 people the bank already had in that area.
• Status today: the contractors are still at the bank, helping.
• The goal: patch the flaws quickly, before anyone else can use them.

That puts about 4,000 people on fixing software weak spots that AI helped find. The Decoder notes that Bank of America is one of the first major US companies to disclose a number like this.

Mythos is an AI model from Anthropic that is unusually good at one job: reading software and finding security holes in it. Think of it as a building inspector who can walk every floor of a skyscraper in an afternoon and leave a sticky note on every loose railing.

That skill cuts both ways. The same model that helps a defender find a hole could help an attacker use it. So in April 2026, Anthropic released Mythos only to selected partners through a program called Project Glasswing, and said the model had found thousands of serious vulnerabilities.

Earlier this month, Anthropic folded Glasswing into a bigger program with three access tiers. We covered that change in our story on Anthropic's expanded Cyber Verification Program. In that announcement, Anthropic said Glasswing partners found at least 129,000 verified vulnerabilities between April and July.

The Decoder points out that OpenAI followed in May with its own cybersecurity program, called Daybreak.

Finding a bug is the fast part. Fixing it is slow, careful work that takes real people and real time.

Each flaw has to be checked, ranked by how dangerous it is, fixed in code, tested so the fix doesn't break something else, and then rolled out. In a bank, that "something else" can be payments, ATMs or the app on your phone. Nobody wants a fix that stops paychecks from landing.

Why it matters: an AI can now produce findings faster than a normal security team can work through them. When the finding gets cheap, the fixing becomes the bottleneck, and that bottleneck is made of people.

The Register reports that the AI turned out to be highly effective, spotting complex vulnerabilities faster than humans, which led to a large influx of patches across the industry.

Not everyone sees it as superhuman, though. Mozilla's CTO Bobby Holley said in April, after Mythos found 271 flaws in Firefox 150, that his team had found no type of bug humans can find that the model couldn't. He also said they hadn't seen any bug that an elite human researcher couldn't have found.

In real life Imagine a home inspector who used to check one room a day suddenly checks your whole house in an hour and hands you 300 notes. The inspector is done. You now need a lot of plumbers.

Moynihan didn't give a clean number for the patching alone.

By the numbers: he said the bank spent "a couple of hundred million plus" in the third quarter. But that figure combines two things: the software remediation and new anti-money-laundering (AML) requirements. The Register notes he didn't say how much went to each.

The AML part comes from a separate matter. The Register reports that the bank agreed to a $1.21 billion settlement with the Treasury's Financial Crimes Enforcement Network, alongside a $750 million penalty from the Office of the Comptroller of the Currency and an $11.6 million settlement with the Office of Foreign Assets Control.

Those settlements weighed on the quarter. The Register reports a 17% drop in profit, and the bank's shares slid more than 8% on Wednesday morning.

Moynihan doesn't think so. He expects the patching costs to come down over time.

What's next: the first wave is the heavy one. When a new tool scans years of old code for the first time, it finds a big backlog all at once. After that, new code gets checked as it's written, so the pile should shrink.

The Register reports that the contractors remain for now, but that their help won't be needed in the longer term.

Yes, and Moynihan was upbeat about it on the earnings call. According to The Register:

• Projects: the bank runs about 130 AI-related projects.
• Expected return: each is expected to return 2 to 3 times its cost over time.
• Engineering: its tech engineering workforce is about 10% more efficient.
• Benefits: $250 million to $300 million from AI in 2026, rising to $700 million by the end of 2027.

He didn't explain how those benefits are calculated.

The big picture: the same technology is now on both sides of the ledger. AI is helping the bank work faster, and AI is also finding the holes the bank has to pay people to fix.

Plenty of companies. The Register says the concerns were shared around the world after Mythos arrived, partly because of how strong the model was said to be.

The Decoder adds that the mood shifted over time. Early warnings from the AI labs were dismissed by some critics as marketing. Then security incidents like the Hugging Face hack and independent tests confirming the models' abilities changed the conversation.

What Bank of America adds is a rare look at the size of the response. Most companies talk about AI security in general terms. Here, a CEO put a headcount on it.

• Your accounts: nothing in the reports says customer accounts were breached. This is about fixing weak spots before attackers find them.
• Updates matter more now: if banks need 4,000 people to keep up with AI-found bugs, the updates on your phone and laptop are worth installing promptly.
• Expect more of this: other big companies with lots of old software face the same backlog, so more patch-heavy months are likely.
• AI security is real work: the cost of AI isn't only the subscription. Sometimes it's the people you need to act on what it tells you.