Bank of America has brought in 1,000 external contractors to address software vulnerabilities identified by advanced artificial intelligence models, including Anthropic's Mythos model. Bank CEO Brian Moynihan shared this with analysts following the release of quarterly results. According to him, the contractors were hired in the second quarter and continue to work side by side with 3,000 internal specialists focused on security and software patch management. Thus, the bank has effectively doubled its resource base dedicated to patching accumulated defects in its own systems.
AI Audit as a Trigger: What Mythos Changed
According to reports, Anthropic provided access to the Mythos model in April, limiting the user base to select banks, tech companies, and government entities. Following the model's release, U.S. banks began actively auditing their software systems: vulnerabilities that previously might have taken weeks to fix began to be resolved in days. The number of discovered defects, according to Moynihan, numbered in the thousands, with the vast majority falling into low or moderate severity categories. This year, the bank is auditing and fixing both its own code and software from third-party vendors.
Scale of Work and Risk Assessment
Brian Moynihan described the risks associated with software vulnerabilities as real and emphasized that banks need to stay ahead of threats while simultaneously assessing the security of vendor software products. Deploying 1,000 contractors alongside 3,000 internal security specialists indicates that the volume of identified defects exceeded the capacity of the permanent team. Bank leadership, by its own account, expects software remediation expenses to decrease over time once the accumulated issues are resolved.
Financial Footprint: Over $200 Million for the Quarter
According to Moynihan, the bank spent more than $200 million in the third quarter on vulnerability remediation and related regulatory compliance measures. These costs include not only direct code-fixing work but also measures to comply with regulatory requirements, including anti-money laundering efforts. Consequently, AI auditing has turned into a notable expense item for one of the largest U.S. banks, though management expects it to decline going forward.
Regulatory Context: $1.2 Billion FinCEN Fine
Additional bank expenses are also tied to compliance with anti-money laundering requirements. Last week, the U.S. Financial Crimes Enforcement Network (FinCEN) announced a $1.2 billion fine against Bank of America over inadequate reporting of suspicious transactions. This episode underscores that regulatory pressure on the bank remains high and, alongside technical vulnerability remediation work, demands significant financial resources.
Outlook: Declining Expenses After Fixing Accumulated Problems
Bank of America management expects software remediation expenses to decrease as accumulated problems are resolved. The logic is simple: once the primary defects identified by AI models are fixed, the need for mass contractor engagement will diminish. Nevertheless, the very fact of hiring 1,000 external specialists and spending over $200 million in a quarter shows that the transition to AI software auditing has become a sustainable cybersecurity spending trend for the banking sector rather than a one-off event.
