Bank of America puts 1,000 contractors on AI-found flaws

Bank of America brought in about 1,000 outside contractors to fix software flaws exposed by advanced AI models, including Anthropic's Mythos, CEO Brian Moynihan said on October 14, 2026. The contractors joined about 3,000 bank employees already on the job. It is one of the clearest signs yet of what AI bug hunting costs the companies whose code it searches.

Mythos is an Anthropic model built to find security flaws in software. Anthropic made it available in April to a small group of companies, banks and government agencies through a program called Project Glasswing, The Next Web reports. Access is limited: Anthropic kept Mythos 5.1 invitation-only when it launched in September.

What Moynihan said

Moynihan disclosed the contractor figure in a CNBC interview after the bank's third-quarter results. The Next Web and Superpower Daily say the contractors arrived in the second quarter. Startup Fortune says only that they were hired this year.

Figure	Detail
Contractors	About 1,000, hired as consultants
Bank staff on the work	About 3,000
Combined team	About 4,000, per Superpower Daily and Startup Fortune
Quarterly cost	"A couple hundred million dollars plus," including other compliance work
End date	None given

The contractors are "not in the headcount," Moynihan said, because they were hired as consultants, according to The Next Web. He told analysts on the earnings call that the quarter's cost was "a couple hundred million dollars plus." That figure also covers repairs to the bank's anti-money-laundering controls, so it is not a bill for the Mythos work alone.

The flaws sit in code used by the bank and by its outside vendors, Moynihan said. Some of those providers build software that they sell to the bank, Superpower Daily reports. He expects the cost to fall as patching catches up, but gave no date.

Why AI bug hunting creates a backlog

AI models like Mythos can find flaws faster than people can fix them. Moynihan warned of "a big change in the amount of work that will have to go on" in a Bloomberg Television interview earlier this year, Startup Fortune reports.

Anthropic's own numbers show the gap. As of an April 7 assessment, fewer than 1% of the potential flaws Anthropic had found were fully patched, Superpower Daily reports. In testing, Mythos reportedly turned up thousands of previously unknown flaws, including a 27-year-old bug in OpenBSD, Startup Fortune says. It adds that most findings in the banking sector were rated low to moderate severity.

Mythos has already found a flaw that attackers exploited a day after it was published, in the Rejetto HFS file server. That is the risk the bank is racing: once a flaw is known, the clock starts.

Other banks and regulators

Bank of America is not alone. JPMorgan Chase CEO Jamie Dimon said in May that hundreds of people were working on it full time, The Next Web reports. Regulators in the United States paused some cyber exams a month after Mythos arrived. The European Central Bank wants banks' plans by the end of October, the outlet adds.

The disclosure came a day after the Treasury announced penalties of more than $1.21 billion against the bank, The Next Web reports. Third-quarter revenue rose about 3% to nearly $30 billion, but adjusted earnings of $1.08 a share missed forecasts. The shares closed almost 5% lower.

What this means for developers

• Budget for fixing, not just finding. An AI scanner can produce more findings in a week than a team can fix in a quarter. Plan the people and time for repair before you switch one on.
• Ask your vendors about their code. The bank's flaws included vendor software. If a supplier's product runs in your systems, ask how they are scanning and patching it.
• Triage by severity first. Most banking findings were low to moderate severity, per Startup Fortune. Fix the few critical ones before working through the long tail.
• Expect regulators to ask. Supervisors in the United States and Europe are already asking banks about AI-found flaws. Other regulated industries should prepare the same answers.
• Treat every finding as time-sensitive. The Rejetto case shows attackers can move within a day of disclosure. Keep fixes and disclosure on the same schedule.