Bank of America hired 1,000 outside contractors to help patch software vulnerabilities surfaced by advanced AI models, including Anthropic's Mythos, chief executive Brian Moynihan told CNBC on Wednesday. The disclosure, made in an interview after the bank's third-quarter earnings release, is one of the first times a major US corporation has spelled out the workforce and dollar cost of defending its systems against frontier AI models.
According to CNBC, the contractors were brought on in the second quarter of 2026 to support the roughly 3,000 internal employees who work in that area, and they remain at the bank today. "We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area," Moynihan told CNBC's Leslie Picker. For more context on this story, see our ongoing AI industry coverage.
Hundreds of Millions in Quarterly Costs
The patching push was not cheap. Moynihan told analysts earlier on Wednesday that software remediation, combined with regulatory work related to anti-money-laundering compliance, added "a couple hundred million plus" to the bank's costs in the third quarter. The bank's shares slumped as much as 8 percent on Wednesday following the earnings report, and the remediation spending was part of a broader conversation with investors about expense pressure.
Mythos, which Anthropic released to a small group of banks, technology firms and government agencies in April, has been credited with uncovering and exploiting decades-old software flaws — capabilities that have forced companies holding sensitive financial data into a costly defensive scramble. Bank of America rushed to bolster a wide spectrum of its internal and vendor code earlier this year, Moynihan said, using thousands of employees and outside personnel.
"That risk is real risk, and that's why when the frontier-type models came out … a lot of us sat down and said, 'How do we figure out how to get through this quickly?'" Moynihan said in the CNBC interview.
The Dual-Edged Nature of Frontier AI
The episode captures the strange economics of frontier AI for large enterprises. The same class of models that helps companies cut costs by boosting productivity can also expose weaknesses in software that has quietly accumulated for decades. Moynihan acknowledged the tension directly, noting that the vendors supplying the bank's software are themselves racing to equip their tools with frontier AI.
"We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services," he said.
A Temporary Spike, Moynihan Argues
Speaking as the stock fell, Moynihan sought to reassure investors that the spending increase would prove temporary. "Once you patch, you don't have to patch as much … The pipeline moves through," he said, adding that the bank expects remediation costs to decline over time.
The bank is also betting that AI will more than pay for the defensive work elsewhere. Bank of America runs about 130 internal AI projects that it projects will drive roughly $700 million in savings next year, according to CNBC — a figure that dwarfs the near-term remediation bill, even if the timing of the two is uncomfortable.
What It Says About the Industry
Bank of America's disclosure offers one of the clearest data points yet on what AI-driven vulnerability discovery actually costs a large institution. Analysts have warned since frontier cybersecurity models began shipping that legacy codebases at banks, hospitals and governments represent a vast attack surface that AI can map far faster than human auditors. Until now, most of that discussion has been theoretical; Moynihan put a headcount and a price tag on the response.
The comments also underline the delicate position of companies like Anthropic, which are selling powerful cybersecurity models to a select group of institutions while the broader industry argues about how — and how quickly — such capabilities should spread. Reports of AI-assisted hacking attempts have put containment and monitoring practices under scrutiny, and enterprise customers are now budgeting for the assumption that their vulnerabilities will be found first.
بینکوں کے لیے حساب سیدھا ہے: پیچ لگانے کے اخراجات قابل پیمائش اور پابند ہیں، جب کہ کامیاب استحصال کی قیمت نہیں ہے۔ سرمایہ کاروں کے لیے موئنیہان کا پیغام یہ تھا کہ اضافہ ایک بار کی صفائی ہے، نہ کہ مستقل اخراجات کی لکیر — لیکن یہ واقعہ ایک یاد دہانی ہے کہ ماڈل کی صلاحیت میں ہر چھلانگ خاموشی سے ہر اس کمپنی کی حفاظتی کرنسی کو بدل سکتی ہے جو سافٹ ویئر چلاتی ہے۔
چونکہ فرنٹیئر ماڈلز خامیوں کو تلاش کرنے میں بہتری لاتے رہتے ہیں، بنک آف امریکہ کا تجربہ کم اور ایک ٹیمپلیٹ بن سکتا ہے: ہزاروں عملہ، ایک ٹھیکیدار فوج، اور کئی سو ملین ڈالر کی انوائس، یہ سب ایک ایسے ماڈل کے ذریعے شروع ہوتا ہے جس نے کبھی بھی بینک کے نظام کو براہ راست چھوا نہیں تھا۔
دوسرے بڑے مالیاتی اداروں میں سیکیورٹی ٹیمیں پلے بک کو قریب سے دیکھ رہی ہیں۔ اگر AI ماڈلز ایک دہائی کی جمع شدہ کمزوریوں کو دنوں میں ظاہر کر سکتے ہیں، تو ہر بینک کے لیے اب یہ سوال نہیں ہے کہ آیا اس کے کوڈ میں خامیاں ہیں - یہ وہ ہے کہ کون انھیں پہلے ڈھونڈتا ہے، اور کیا ادارے کے پاس ان خامیوں کے استعمال سے پہلے جواب دینے کی صلاحیت ہے۔ Moynihan کے انکشاف سے پتہ چلتا ہے کہ امریکہ کے دوسرے سب سے بڑے بینک کے لیے، جواب میں AI سے چلنے والے علاج کو معمول کے آئی ٹی لائن آئٹم کے بجائے سہ ماہی کی وضاحت کرنے والے اخراجات کے طور پر علاج کرنے کی ضرورت ہے۔
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
