Bank of America adds 1,000 contractors to fix Mythos findings

Bank of America hired 1,000 additional contractors to repair vulnerabilities identified by Anthropic’s Mythos model, according to The Register – Security. The episode exposes a practical limit to AI-led security: finding weaknesses faster can increase the immediate demand for people rather than reduce it. The bank has disclosed a substantial remediation expense, but not a separate bill for Mythos.

What happened

Brian Moynihan, Bank of America’s chairman and chief executive, described the additional hiring during the bank’s third-quarter earnings call on Wednesday. The contractors arrived in the second quarter and were still working at the bank when he spoke. They supplemented an existing group of 3,000 technical staff, according to the report.

Against that stated staffing base, the contractors represent an increase of roughly one-third. That comparison concerns the technical group described in the report, not the bank’s entire technology workforce. Even with that qualification, it is a sizeable addition to the people available to tackle the work.

Moynihan subsequently told CNBC that the bank sought outside help because of concerns about how quickly it could handle the discoveries. The immediate constraint was therefore not access to an AI model capable of finding flaws. It was the capacity to act on what the model found.

The chief executive put remediation spending at “a couple of hundred million plus”, according to The Register. Crucially, that figure combined work associated with Mythos and work connected to anti-money-laundering orders issued that week. He did not disclose the division between them. Treating the whole amount as an AI-security bill would give a precise-looking answer to a question the bank has not answered.

Nor does the report provide a count of the bank’s vulnerabilities, their severity or the proportion already repaired. The contractor total establishes the scale of the staffing response; it does not establish a cost per flaw, a completion rate or how much risk has been removed.

The background

The Register describes Mythos as effective at discovering complex vulnerabilities faster than humans. It also reports that Anthropic’s marketing helped stir wider concern about the model’s implications for cybersecurity. Those are distinct propositions: a tool can materially accelerate research without possessing capabilities that no human researcher could match.

Mozilla provides the clearest comparison in the source. Mythos found 271 flaws in Firefox 150. In April, Bobby Holley, Mozilla’s chief technology officer, said the organisation had not encountered a category or complexity of human-discoverable vulnerability beyond the model’s reach. Equally, it had not seen the model uncover anything an elite human researcher could not have found.

That distinction matters commercially. The disruptive feature may be the volume and speed of findings rather than an entirely new class of discovery. Faster identification brings existing weaknesses to management’s attention sooner, but it also brings forward the work and expenditure required to address them. Discovery is an output; a repaired system is a different one.

The broader business exposure is not confined to large banks. Our earlier examination of the risks of centralising AI access in LiteLLM considers another aspect of the same budgeting problem: AI infrastructure brings security obligations alongside its operating benefits. Neither a powerful model nor a convenient access layer eliminates the need to maintain the systems around it.

Bank of America’s earnings also contained substantial compliance costs unrelated to any separately disclosed Mythos bill. The Register reported a 17% decline in profits, attributed to a $1.21bn settlement with the Treasury’s Financial Crimes Enforcement Network, or FinCEN. Shares fell more than 8% on Wednesday morning. The source does not establish that investors were reacting specifically to AI spending.

FinCEN’s order concerned failures to police national-security risks, including Chinese money laundering, and to report more than $5bn in suspicious activity. The Office of the Comptroller of the Currency concurrently issued a $750m penalty for Bank Secrecy Act and anti-money-laundering compliance deficiencies. A separate $11.6m settlement with the Office of Foreign Assets Control covered sanctions violations. These matters explain why the bundled remediation figure cannot sensibly serve as a clean measure of AI economics.

What people are saying

Moynihan’s position is that the additional security workload is initially heavy, not permanently so. The contractors are intended to absorb the first wave of repairs, and the bank expects remediation costs to decline. The report gives no date for their departure. Temporary assistance can still span several reporting periods, as the second-quarter hiring and continued presence demonstrate.

The chief executive also presented a much broader productivity case for AI. He said the bank had made its technology-engineering workforce around 10% more efficient. Each of its approximately 130 AI-related projects was expected to generate a return on investment of two or three times over time. These are management’s assessments and expectations, not independently verified results presented in the source.

For 2026, Moynihan forecast $250m–$300m in benefits from AI projects, rising to $700m by the end of 2027. He did not explain how those benefits would be achieved. Without a breakdown of the benefits and the Mythos-related costs, the figures cannot show whether this particular security application has paid for itself.

The bank has also cut around 3,000 roles, including a 5% reduction in managers. It did not specify AI’s contribution to those reductions. The simultaneous arrival of security contractors and departure of other employees is therefore evidence of different staffing movements, not a demonstrated exchange of permanent workers for AI.

Holley’s assessment supplies a useful counterweight to the marketing surrounding Mythos. His comparison with elite researchers supports a claim of strong capability while resisting the suggestion of unprecedented intelligence. For buyers, matching expert work at greater speed could be commercially important enough; it does not require a more extravagant explanation.

Murray Wilkinson, founder of Found Revenue, an AI business services provider with three UK locations, says owners raising this worry should start by listing where AI already touches their business, then set clear checks on cost, accuracy and data before committing further.

What happens next

The bank’s stated expectation is that the initial repair burden will subside and the additional contractors will eventually be unnecessary. Whether that happens is the next practical test. A falling requirement for outside help would be consistent with clearing a backlog; continued reliance would leave open questions about the recurring workload. The source provides neither a future staffing target nor a patching timetable.

The next financial test is disclosure. A separate figure for Mythos-related remediation would allow a more meaningful comparison with the bank’s claimed AI benefits. Until then, subtracting the bundled compliance-and-security expense from projected AI gains would mix different activities and produce a misleading net figure.

For other businesses, the spending categories are worth keeping distinct. AI account theft and budget exposure concern securing access to tools; the Bank of America episode concerns the work those tools generate. A budget that recognises only the cost of buying AI misses the possibility that successful deployment will reveal more work than the existing team can promptly complete.