Bank of America brought in 1,000 outside contractors because Anthropic’s Mythos surfaced software vulnerabilities faster than the bank’s existing teams could safely remediate them. The contractors joined roughly 3,000 employees already assigned to patching systems, creating a much larger human operation behind the automated discovery.
The episode is an early, concrete example of an important security trade-off: AI can accelerate vulnerability discovery, but every credible finding still requires engineers to verify impact, develop and review a fix, test it against production dependencies, and deploy it without disrupting a bank’s operations.
As an Amazon Associate I earn from qualifying purchases.
What happened at Bank of America
The contractor hiring
State of AI reports that Bank of America spent the six months before its October 14, 2026 disclosure paying 1,000 outside contractors for patching work. The contractors were hired in the second quarter of 2026 and were still working when chief executive Brian Moynihan described the effort.
Quartz reproduced Moynihan’s statement: “We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area.”
#1 Best Overall
What they were patching
The work covered Bank of America’s proprietary systems as well as software supplied by vendors. That distinction matters: a bank may control the remediation process while depending on an outside provider to issue a fix, clarify a component’s behavior, or publish an updated package.
The reports do not establish how many vulnerabilities Mythos identified for Bank of America. No verified bank-specific count has been published, so a precise total would be speculation.
What Anthropic’s Mythos means in this case
An offensive security model
The reporting describes Mythos as an advanced cybersecurity model designed to discover and exploit previously unknown software vulnerabilities. Anthropic has claimed that Mythos could “surpass all but the most skilled humans at finding and exploiting software vulnerabilities,” a statement reported by The Atlantic. That is Anthropic’s capability claim, not an independently measured Bank of America performance result.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Discovery is not the same as a confirmed production exploit
An AI system can flag a weakness or demonstrate a possible exploit path without proving that the same path is reachable in a bank’s live environment. Security teams must reproduce the result, determine which versions and configurations are affected, assess business impact, and rule out false positives before treating it as a production incident.
Rank #3
How much did the cleanup cost?
TechRadar reports that Bank of America spent more than $100 million fixing vulnerabilities discovered by AI. A separate description of the bank’s third-quarter spending calls it “a couple hundred million plus” for remediation and anti-money-laundering work together. Because those categories were combined, the larger figure cannot be attributed entirely to Mythos or to vulnerability patching.
| Figure | What it covers | Qualification |
|---|---|---|
| 1,000 outside contractors | Patching assistance | Hired in Q2 2026 and still working at the October 14 disclosure, according to State of AI and Quartz |
| About 3,000 employees | Existing staff in the same patching area | Figure stated by Brian Moynihan and reproduced by Quartz |
| More than $100 million | Fixing AI-discovered vulnerabilities | Reported by TechRadar; the report does not provide a vulnerability count |
| “A couple hundred million plus” | Third-quarter remediation and anti-money-laundering work | Combined spending; not a Mythos-only cost |
Why AI discovery created more remediation work
Finding flaws is only the first stage of a patching program. At a large bank, each finding can trigger a chain of work across application security, infrastructure, software owners, risk management, quality assurance, change control and operations.
- Validate the finding. Engineers reproduce the behavior and check whether the reported weakness is real in the bank’s specific build.
- Scope exposure. Teams identify affected applications, versions, environments, data flows and vendors, then rank the issue by exploitability and business impact.
- Choose a remediation path. The fix may be a code change, configuration change, dependency upgrade, compensating control or temporary isolation while a vendor prepares an update.
- Review the patch. Developers and security specialists inspect the change for regressions, hidden attack paths and conflicts with other systems.
- Test safely. Automated tests, integration testing and controlled security testing help show that the repair closes the weakness without breaking payments, authentication or other critical services.
- Deploy and verify. Change-management controls govern rollout, and monitoring confirms that the vulnerability is closed in the environments that matter.
- Document and report. The bank records evidence for internal risk decisions, auditors, regulators and any affected vendors.
Mythos can compress the time needed for the first step, and potentially expose issues that a conventional review would miss. It does not remove the labor in the remaining steps; in fact, a higher volume of credible findings can make those steps the bottleneck.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallDoes this mean AI replaces security engineers?
It changes the staffing mix more than it eliminates people
Bank of America’s response points in the opposite direction from a simple replacement story. Automated discovery was followed by a substantial increase in patching capacity, with contractors supplementing existing employees. The scarce resource became remediation throughput: people who understand the affected code, can negotiate fixes with vendors, and can make safe production changes.
Best Value
Where automation can reduce effort
- Searching large codebases and dependency inventories for suspicious patterns.
- Generating and testing exploit proofs in controlled environments.
- Grouping duplicate findings and prioritizing issues by technical evidence.
- Suggesting candidate patches or configuration changes for engineer review.
- Continuously retesting systems after a fix is deployed.
Where human judgment remains essential
- Determining whether an exploit is reachable under the bank’s real controls and network architecture.
- Balancing security urgency against availability, transaction integrity and customer impact.
- Approving changes to systems governed by strict segregation-of-duties and audit requirements.
- Coordinating fixes in vendor software that the bank cannot modify directly.
- Accepting residual risk when an immediate patch is impossible.
What the episode signals for enterprise security
Discovery capacity must be matched by remediation capacity
Organizations evaluating autonomous security tools should measure the entire path from finding to verified closure, not just the number of weaknesses an AI system can identify. Useful operational measures include triage time, percentage of findings confirmed as exploitable, time to deploy a tested fix, reopened vulnerabilities and the backlog by application owner.
Vendor software can widen the queue
Because Bank of America’s effort included vendor-provided software, the bank had to manage dependencies outside its direct control. Contracts, software inventories and escalation procedures become part of the security response, alongside source-code fixes.
Cost reporting needs clear boundaries
Remediation, regulatory work and anti-money-laundering programs may run in parallel and draw on overlapping teams. Reporting them as one spending figure can obscure the cost of an AI-driven vulnerability program. Bank-specific totals should therefore identify which expenses are directly tied to findings, which support broader compliance work, and which are shared overhead.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Timeline
- Second quarter of 2026: Bank of America hired the outside contractors for patching work.
- Six months before October 14, 2026: State of AI says the bank was paying the contractor contingent during this period.
- October 14, 2026: Brian Moynihan publicly described the contractors’ continuing work alongside the bank’s existing patching staff.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
