Bank of America Hires 1,000 Contractors to Patch Flaws Found by Anthropic's Mythos
Bank of America hired 1,000 contractors and spent more than $100 million fixing software flaws uncovered by Anthropic's Mythos, CEO Brian Moynihan said. Other major banks are also spending heavily as advanced AI security tools expose vulnerabilities faster than teams can patch them.
Moynihan said the bank treated the bugs Mythos discovered as "real risk" and drew up a plan to address them. "We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area," he told CNBC. CNBC added that Moynihan told analysts earlier that day that Bank of America spent "a couple hundred million plus" on fixing bugs and addressing regulatory issues.
The hiring and spending are uncommon even for a bank of Bank of America's size. Moynihan said the increase was temporary and that once the vulnerabilities are addressed, there will not be as much work. "Once you patch, you don't have to patch as much. ... The pipeline moves through," he said.
Anthropic unveiled Mythos in April 2026, describing it as a tool with advanced cybersecurity capabilities that can autonomously discover and exploit previously unknown software vulnerabilities. The company restricted access to a handful of vetted organizations, including the U.S. government, critical infrastructure organizations, banks and some cybersecurity firms. When it disclosed Mythos, Anthropic said AI models had reached a level of coding capability "where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities." It warned: "The fallout – for economies, public safety, and national security – could be severe."
Other major banks are also responding. JPMorgan Chase CEO Jamie Dimon said the bank was working with peers and vendors to prepare its systems for what is coming. "It's serious work," Dimon said in a Bloomberg TV interview. "We have, I think, hundreds of people doing it full time now." Goldman Sachs CEO David Solomon said in mid-April he was "hyper-aware" of Mythos's capabilities and that the company was working "closely" with the tech firm. "Obviously the LLMs are making rapid progress and we're hyper-aware of the enhanced capabilities of these new models with the help of the US government and the model publishers," Solomon told analysts.
Tests by other technology and security companies have shown both the scale of the problem and the cost of responding. Mozilla called Mythos "every bit as capable as the world's best security researchers" after finding 22 security-sensitive bugs in a single round of testing. Palo Alto Networks used Mythos to find more than two dozen critical vulnerabilities in about three weeks, but the tests also showed companies needed significantly bigger AI security budgets.
The remediation effort at Bank of America is also unfolding against a regulatory backdrop. The Next Web noted that the compliance spending follows Treasury penalties of more than $1.21 billion announced on Oct. 13. Federal regulators said the bank had failed to report suspicious transactions worth $5 billion and to finish steps ordered in 2024.
The figures reported by TechRadar do not specify which software flaws were patched at Bank of America or how many vulnerabilities Mythos found there. The bank's response nonetheless shows how AI security tools are pushing financial institutions to dedicate large teams and budgets to patching weaknesses that the same tools can uncover quickly.