Bank of America CEO Brian Moynihan: Hiring an Additional 1,000 Contractors to Fix Anthropic Mythos Vulnerabilities
Bank of America CEO Brian Moynihan disclosed that to address software security risks exposed by cutting-edge AI models including Anthropic Mythos, the bank hired an additional 1,000 contractors in the second quarter to assist in fixing vulnerabilities in internal code and third-party vendor software.
These 1,000 contractors joined the existing team of about 3,000 people to work on the remediation; the contractors are in a consulting capacity and are not counted in the official headcount, and they are still assisting.
The bank spent "hundreds of millions of dollars" in the third quarter on software remediation and anti-money laundering compliance-related matters, and Moynihan expects related costs to gradually decrease as the remediation is completed.
Mythos will be opened to a limited number of banks, tech companies, and government agencies through Project Glasswing in April 2026 for discovering software vulnerabilities; the bank views it as a real risk and has quickly expanded its workforce to respond.
The bank is advancing about 130 AI projects internally, expecting savings from these projects to grow from about $300 million in 2026 to about $700 million in 2027, while engineering team efficiency is expected to improve by about 10%.
In market mechanisms, buyers are financial institutions like Bank of America that spend on vulnerability remediation labor and compliance, while sellers are AI models like Anthropic that provide vulnerability discovery capabilities; the event is driven by cutting-edge models scanning to expose long-hidden defects, with funds flowing from bank operating costs to outsourced remediation and internal AI projects, benefiting security remediation service providers and AI efficiency tools, while financial institutions face pressure to quickly address large-scale vulnerabilities.
Moynihan stated that once the main remediation is completed, the subsequent pipeline workload will decrease, with short-term defensive spending and long-term AI savings coexisting.
Source: Public Information
ABAB AI Insight
Anthropic will open Mythos to limited partners through Project Glasswing in April 2026 for large-scale security scanning, with previous reports indicating that a single scan can uncover tens of thousands of potential issues; Bank of America expanded outsourcing in Q2, reflecting the rapid response of large financial institutions to the vulnerability discovery capabilities of cutting-edge models.
The capital path reflects a concentration of short-term spending on joint remediation by outsourced and internal teams, covering both proprietary code and vendor software; at the same time, the expected savings from about 130 internal AI projects have been raised from $300 million in 2026 to $700 million in 2027, forming a hedging structure of defensive costs and efficiency gains.
This is similar to other banks and tech companies that have access to Mythos, as well as the historical path of financial institutions concentrating resources on remediation after significant vulnerability disclosures; we are currently in a phase where AI is transitioning from a supportive tool to actively exposing security flaws, with defensive spending and internal AI investments expanding in tandem.
Essentially, this represents a technological substitution: cutting-edge AI models are beginning to replace traditional manual security audits, discovering long-standing software defects at a higher speed and coverage, shifting remediation costs from dispersed manual checks to concentrated large-scale outsourcing and internal resource investment, while internal AI projects replace some traditional human processes to achieve cost savings.
ABAB News · Cognitive Laws
- The speed of vulnerability discovery determines the scale of the remediation bill.
- Short-term defensive costs coexist with long-term efficiency savings.
- The faster the model finds issues, the more outsourcing piles up.