Bank of America Hired 1,000 Contractors to Patch Software Flaws That Frontier Models Like Anthropic's Mythos Could Expose

Bank of America has assembled what amounts to a patching army to defend its software against the exposure risk created by frontier AI models — and its CEO has put a headcount and a price tag on the effort. The bank added 1,000 third-party contractors in the second quarter to help fix vulnerabilities in proprietary and vendor software, CEO Brian Moynihan told CNBC on Wednesday, speaking after the bank's third-quarter earnings release.

"We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area," Moynihan said in an interview with CNBC's Leslie Picker. The contractors were brought in as the bank rushed to shore up "a wide spectrum" of internal and vendor code earlier this year.

The threat Moynihan described is specific: models like Anthropic's Mythos, which was released in April to a small group of banks, technology firms and government agencies, can uncover and exploit decades-old software flaws at machine speed. "That risk is real risk, and that's why when the frontier-type models came out... a lot of us sat down and said, 'How do we figure out how to get through this quickly?'" he said.

The bill is material. The bank spent "a couple hundred million plus" in the third quarter on software remediation combined with regulatory issues related to anti-money-laundering compliance, Moynihan told analysts earlier Wednesday. The comments are among the first by a major U.S. corporation to specify the manpower and dollars devoted to protecting systems from a frontier model — and they underline the dual-edged nature of AI for corporate America: the same technology that promises productivity gains also forces expensive defensive scrambles.

Moynihan sought to reassure investors that the spending is temporary, speaking as the bank's shares slumped as much as 8% on Wednesday. "Once you patch, you don't have to patch as much... The pipeline moves through," he said, adding that remediation costs should decline over time. He also framed the vendor relationship with characteristic bluntness: "We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services."

The offset is already visible elsewhere in the bank's AI program. Bank of America runs about 130 internal AI projects, and savings from those efforts are expected to rise from $300 million this year to $700 million in 2027, Moynihan told analysts. The bank's total head count fell by about 3,400 employees over the past year as it cut roughly 5% of managers, though it is unclear how much of that reduction is attributable to AI.

The broader lesson for enterprise security teams is that Mythos-class models have turned "known but unexploited" into "urgent." A flaw that a human researcher might find in months can be surfaced in hours — and every company running older software, which is to say every company, is now implicitly racing against that clock. BofA's answer — thousands of people, hundreds of millions of dollars, and a CEO publicly promising the curve bends down — is likely to become the reference case other chief information security officers cite when they ask their own boards for patching budgets.