Bank of America has deployed 1,000 contractors alongside 3,000 internal staff to patch a wave of software vulnerabilities uncovered by Anthropic’s powerful Mythos model, laying bare the scale of disruption the AI has unleashed across global finance.
Key Highlights
- BofA added 1,000 contractors in Q2 to join 3,000 internal staff patching Mythos-found flaws
- Anthropic’s Mythos surfaced hundreds to thousands of vulnerabilities at early-access banks
- Patching timelines collapsed from weeks to days under the model’s pressure
- BofA spent “a couple of hundred million plus” in Q3 (bundled with AML work)
- A separate $1.2 billion AML penalty hit the bank the same week
- Moynihan expects remediation costs to fall as fixes work through the pipeline
- AI-driven savings projected to rise from $300M (2026) to $700M (2027)
The fallout began earlier this year when a small group of large US banks secured early access to Mythos. The model proved extraordinarily effective, reportedly surfacing hundreds to thousands of vulnerabilities and excelling at chaining low-risk weaknesses into high-risk threats across legacy and vendor systems.
CEO Brian Moynihan quantified the response after BofA’s third-quarter results. The 1,000 contractors added in the second quarter “remain here today,” he said, working atop the bank’s existing 3,000-strong security team to compress patching timelines from weeks to days.
The financial toll is real but blurred. BofA spent a “couple of hundred million plus” in Q3 on patching and regulatory matters, though that figure also bundles in anti-money-laundering work, so it cannot be read as Mythos’s standalone price tag.
Compounding the pressure, the bank was separately hit this week with a $1.2 billion penalty over “deficient and ineffective” AML processes, a reminder that cyber and compliance burdens are landing simultaneously.
Yet Moynihan struck an optimistic note. Patching costs should ease over time, he argued: once systems are fixed, the burden lightens as “the pipeline moves through.” Meanwhile, AI is cutting costs elsewhere, with savings from 100-plus projects set to climb from $300 million this year to $700 million by 2027.
So will BofA succeed? Likely yes, on remediation; its resources dwarf the problem. The deeper test is structural: Mythos exposed how shared vendors and aging code leave the whole sector exposed, meaning BofA’s real victory depends on resilience, not just this round of patches.
