Bank of America brought in about 1,000 contractors during the second quarter to help patch vulnerabilities in its proprietary and vendor software, CEO Brian Moynihan said Wednesday. The contractors joined roughly 3,000 internal employees working on the remediation effort and remained in place after the initial surge in work.
The push followed the emergence of advanced AI systems such as Anthropic’s Mythos, which can identify software weaknesses that may have escaped human review for years.
Anthropic’s public testing describes Mythos as capable of finding and, when directed, exploiting some zero-day vulnerabilities. Intelligence agencies, the model identified vulnerabilities in highly sensitive government systems within hours, although officials emphasized that finding a weakness did not mean the model had exploited it.
For Bank of America, the defensive work added to hundreds of millions of dollars in third-quarter costs alongside spending on anti-money-laundering compliance. Moynihan said the remediation expense should decline as the bank moves through its software pipeline, because systems require less patching after the identified flaws are addressed.
The spending illustrates the financial tension created by more capable AI systems: the same technology that can accelerate software review can also expose a much larger backlog of vulnerabilities that organizations must validate and repair. Bank of America has about 130 internal AI projects, with projected savings rising from $300 million this year to $700 million in 2027.
The bank’s head count declined by about 3,400 employees over the past year, including a reduction of roughly 5% of managers. The portion of that decrease attributable to AI was not established. Moynihan also cautioned that banks must remain alert to conflicts created when software developers are also selling the services used to secure the code.