Bank of America Hires 1,000 Extra Staff in Frantic Race To Fix Security Flaws Exposed by New Anthropic AI

Bank of America has brought in 1,000 extra contractors to help fix software vulnerabilities identified by advanced artificial intelligence (AI) models, including Anthropic's Mythos, as the US banking giant moves to strengthen its cyber defences against emerging threats.

Chief executive Brian Moynihan told CNBC that the contractors were hired in the second quarter of 2026 to help patch software flaws. They are working alongside an existing team of around 3,000 people already involved in software remediation.

The move highlights the growing challenge facing businesses as increasingly capable AI models identify software weaknesses that could potentially be exploited by cybercriminals. For banks, where digital systems underpin payments, customer accounts and sensitive financial data, addressing such weaknesses is a critical part of managing cyber risk.

Mythos was among several AI models used in the process, and Moynihan did not specify how many vulnerabilities had been identified or how severe they were.

'We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area,' Moynihan told CNBC.

Why Bank of America Is Fixing Software Vulnerabilities

Anthropic made Mythos available to a limited group of banks, technology companies and government agencies in April 2026. The model drew attention for its ability to identify software vulnerabilities, raising concerns about how quickly similar capabilities could be used to discover weaknesses in systems before organisations have time to address them.

Moynihan said the bank recognised the need to respond quickly as advanced AI models became available. The bank's response involves patching software vulnerabilities identified by these models, rather than addressing flaws attributed solely to Mythos.

The growing capabilities of AI tools present a challenge for organisations responsible for maintaining complex software systems. Finding a vulnerability is only the first step: businesses must assess the risk, develop and test a fix, and deploy it without disrupting essential services.

For financial institutions, this work can involve multiple teams and systems, making the speed and scale of remediation particularly important. However, the bank has not disclosed the number of vulnerabilities identified or provided a breakdown of the work required to address them.

Concerns Over Third-Party Software and Cyber Risks

The chief executive also highlighted the importance of scrutinising software supplied by external providers, saying the bank needed to remain alert to potential risks associated with the companies developing the technology it uses.

'We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services,' Moynihan said.

His comments underline a wider challenge for businesses that rely on third-party software: identifying vulnerabilities is only part of the process, as organisations must also ensure that flaws are fixed before they can be exploited.

AI-assisted vulnerability discovery could put additional pressure on software developers and the companies that depend on their products to respond quickly. The speed at which organisations can identify, prioritise and patch weaknesses may become increasingly important as these tools improve.

How Much Is Bank of America Spending on Software Repairs?

Bank of America has not disclosed how much it has spent specifically on fixing vulnerabilities identified by Mythos or other AI models.

However, Moynihan told analysts that the bank had spent 'a couple hundred million plus' during the third quarter on software remediation and regulatory issues related to anti-money-laundering compliance.

The figure covers both areas of spending and should not be interpreted as the cost of Mythos-related repairs alone.

Moynihan indicated that remediation costs could decline as the bank works through the vulnerabilities and completes the necessary patches.

'Once you patch, you don't have to patch as much. ... The pipeline moves through,' Moynihan said.

The scale of the contractor deployment illustrates the resources major financial institutions may need to commit to securing their systems as AI tools become more effective at identifying weaknesses in software.

For banks, the challenge is not simply discovering flaws, but ensuring that they are addressed promptly while maintaining the security and reliability of the services customers depend on.