Bank of America contractors were brought in to patch software flaws spotted after testing bank systems with Anthropic’s Mythos security model. Chief Executive Officer Brian Moynihan revealed the hiring during an interview with CNBC, saying the 1,000 outside coders joined 3,000 staff members to fix the findings. The bank treats tool-spotted bugs as a real risk. That patching push won’t slow down until the backlog clears [1].
Why Bank of America Contractors Were Brought In
Chief Executive Officer Brian Moynihan said that when Mythos began flagging flaws in the bank’s code, leaders saw a pressing need for extra coding help to manage the workload. “We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area,” he told CNBC. The temporary hiring push created a combined team of 4,000 people focused on checking, rewriting, and fixing weak banking code. Bank of America contractors took on high-priority tools because in-house coders couldn’t handle the rising bug count alone while keeping routine bank services running smoothly for retail users [1].
Fixing code at this scale isn’t cheap for a major bank. The work costs real money. Moynihan told analysts that the bank spent “a couple hundred million plus” on software fixes and regulatory issues during the third quarter. The bank hasn’t shared the exact count of bugs found by the AI system [1].
He pointed out that this heavy spending won’t stay permanent because patching slows once teams resolve older flaws. “Once you patch, you don’t have to patch as much. … The pipeline moves through,” Moynihan said while discussing bank software spending with analysts. Leaders viewed the software flaws as a tangible danger that demanded quick dev work before any third party could exploit them [1].
Anthropic Mythos Found Hidden Software Flaws
Anthropic unveiled Mythos in April 2026 as a smart AI model designed to find and exploit older software flaws. Because the tool showed sharp hacking skills, Anthropic locked down general release and gave early access only to vetted groups [1].
Access was given to a select group of partners through Project Glasswing, including big banks, key utility operators, security firms, and the US government. Outside testing quickly showed that the model possessed skills far beyond older bug scanners, which often rely on rigid rule sets and known signs rather than reasoning through complex code paths. When Mozilla tested Mythos, staff said the model was “every bit as capable as the world’s best security researchers” after it uncovered 22 security-sensitive bugs in a single testing round. Palo Alto Networks also ran the model in controlled setups and found more than two dozen deep flaws in roughly three weeks, warning that firms using such smart testing tools must prepare bigger patching budgets to handle what turns up [1].
OpenAI later introduced its Daybreak security program in May to study defensive tools. That move followed high-profile attacks such as the Hugging Face breach, which convinced industry leaders that AI flaw hunting had become a practical reality rather than hype [2].
Patching Budgets Expand Following Testing Results
Bank of America’s software spending coincided with strict legal orders that added urgency to system reviews in its retail units. The bank faced mounting pressure after federal agencies issued fines exceeding $1.21 billion on 13 October, as reported by The Next Web. Government officials stated that the bank had failed to report questionable money transfers valued at $5 billion and hadn’t completed required fix steps ordered back in 2024. Handling official mandates while fixing code placed unusual strain on bank security budgets as audit deadlines drew near [1].
Moynihan didn’t split the exact dollar sum between AI patching and anti-money-laundering systems, but he said total costs reached several hundred million dollars. Fixing root bugs isn’t just a coding task. It’s also a governance rule that agencies watch closely when auditing bank health [2].
Similar concerns about AI security exposure spread in tech after our report analyzing secret leaks in 1.8M Android apps, which showed how smart tools uncover hidden keys in code. For Bank of America, bringing in outside help prevented bug hunts from stalling daily dev work, so key banking systems stayed safe from future attacks while teams cleared the backlog [1].
Bank of America Contractors Join Ongoing Patching Operations
The Bank of America contractors hired during the second quarter continue to work with the bank’s 3,000 in-house security staff members. Managing 4,000 people on bug defense ranks as one of the largest software patching efforts shared by an American bank [2].
Rather than replacing in-house coders, the outside workers provide extra dev hours needed to rewrite weak code without upsetting regular customer web tools. Fixing thousands of code flaws needs careful testing before any change goes live on bank servers. Programmers must verify that updates don’t break older setups, introduce fresh bugs, or freeze payment links that millions of bank customers rely on every day. Moynihan described the workflow as a pipeline that slowly clears as fixes move from test setups into production, trimming upkeep costs over time as the code stabilizes [1].
Bank of America became one of the first major American firms to openly share the staff size needed to handle AI-generated bug reports. The bank’s move shows that adopting sharp security models doesn’t cut human labor in the short term. Instead, it creates a sharp rise in demand for seasoned coders who can fix flaws quickly [2].
Peer Banks Prepare for Smart Security Tools
Other major banks are mounting similar responses as smart code tools become standard gear. In an interview on Bloomberg TV, JPMorgan Chase Chief Executive Officer Jamie Dimon said his bank was working with peer lenders and tech vendors to prepare digital defenses [1].
“It’s serious work,” Dimon said during the broadcast. “We have, I think, hundreds of people doing it full time now.” Goldman Sachs leaders have taken a watchful stance toward smart scanning models. In mid-April, Chief Executive David Solomon told market analysts that his firm was “hyper-aware” of the skills displayed by Mythos and was working closely with tech providers and government agencies. Solomon said large language models are making fast progress in software analysis, prompting banks to inspect codebases before outside exploits spread on the open web [1].
The work at Bank of America, JPMorgan Chase, and Goldman Sachs shows how frontier artificial intelligence tools reshape bank security. While models like Mythos can spot subtle flaws that human auditors might miss for years, fixing those bugs still depends on skilled human coders. As smart testing tools become common in global finance, lenders will have to budget for the human teams needed to turn machine-found flaws into safe code [3].
- ONLINE NEWS Fadilpašić, S. (2026, October 15). Bank of America had to hire 1,000 contractors to patch software flaws spotted by Anthropic Mythos. TechRadar. [Article Link]
- ONLINE NEWS Schreiner, M. (2026, October 15). Bank of America puts 4,000 people on fixing vulnerabilities uncovered by Anthropic’s Mythos and other AI models. The Decoder. [Article Link]
- ONLINE NEWS Jones, C. (2026, October 15). Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified. The Register. [Article Link]
