iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Bank of America added 1,000 outside contractors to its software-patching operation after Anthropic’s Mythos surfaced vulnerabilities, according to reporting disclosed on October 14, 2026. The contractors joined about 3,000 existing employees working on patches for the bank’s proprietary systems and software supplied by vendors. The episode shows the operational consequence of AI-assisted security testing: finding flaws faster can create a much larger human queue to validate, fix, test and safely deploy the changes.
What Bank of America disclosed
The bank hired the contractors in the second quarter of 2026. Six months later, they were still working when chief executive Brian Moynihan discussed the effort. Quartz reproduced his statement:
“We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area.” — Brian Moynihan, Bank of America chief executive, October 14, 2026.
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
State of AI and Quartz describe the 1,000 as outside contractors, not new permanent employees. Their work was added to an existing patching group of roughly 3,000 Bank of America employees.
#1 Best Overall
| Figure | What it represents | Timing or qualification |
|---|---|---|
| 1,000 contractors | Outside workers added for software patching | Hired in the second quarter of 2026; still working at the October 14 disclosure |
| About 3,000 employees | Existing staff in the same patching area | Bank of America figure quoted by Brian Moynihan |
| More than $100 million | Reported spending to fix vulnerabilities discovered by AI | TechRadar report; the figure is not a published count of Mythos findings |
| “A couple hundred million plus” | Combined third-quarter remediation and anti-money-laundering work | Bank of America description; not a Mythos-only cost |
Why an AI discovery system created so much patching work
Finding a flaw is not the same as fixing it
A system such as Mythos can inspect code, identify a potentially exploitable weakness and, in some cases, demonstrate an exploit. A bank still has to determine whether the result is a true vulnerability, reproduce it in a controlled environment, assess the affected data and systems, write a patch, review the change, run regression and security tests, and deploy it without disrupting regulated services.
Those steps are labor-intensive even when the initial discovery is automated. A high-volume stream of findings can therefore increase demand for engineers rather than reduce it. Contractors can provide parallel capacity for code review, remediation, testing, documentation and release work while employees retain ownership of architecture, risk decisions and production change control.
The affected estate included vendor software
Reporting describes the patching effort as covering both Bank of America’s own software and products obtained from vendors. A flaw in third-party code may require coordination with the supplier, a compensating control while a vendor patch is prepared, and additional testing to ensure the fix does not break integrations. That broadens the queue beyond changes the bank can make unilaterally.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What Anthropic’s Mythos is reported to do
The reports characterize Mythos as an advanced cybersecurity model designed to discover and exploit previously unknown software vulnerabilities. The Atlantic reported Anthropic’s claim that Mythos could “surpass all but the most skilled humans at finding and exploiting software vulnerabilities.” That is Anthropic’s capability claim, not an independently measured benchmark establishing how many Bank of America flaws it found or how often its exploits worked in production.
Rank #3
No searched source provides a verified Bank of America-specific number of vulnerabilities attributed to Mythos. It is also important to distinguish a weakness surfaced by an AI system from one confirmed as exploitable against a live production service. Banks normally triage findings before they are treated as confirmed exposure.
How much did the cleanup cost?
TechRadar reported that Bank of America spent more than $100 million fixing vulnerabilities discovered by AI. Separately, reporting on the bank’s third-quarter expenses described “a couple hundred million plus” for remediation and anti-money-laundering work together. Because those categories are combined, the larger figure cannot be assigned entirely to Mythos-related patching.
- More than $100 million: the reported amount for fixing AI-discovered vulnerabilities.
- “A couple hundred million plus”: a broader figure that includes remediation and anti-money-laundering work, so it is not a Mythos-only total.
Neither figure establishes the average cost per vulnerability, the contractors’ individual rates, or a final program total. The spending described publicly may also change as remaining patches, testing and vendor work are completed.
Does this mean AI replaces security engineers?
This case points to task reallocation, not an immediate replacement of security staff. Mythos may accelerate the search and exploitation-analysis phase, but people remain responsible for decisions that require business context and accountability:
Best Value
- Confirming that a reported issue is real and determining its severity.
- Tracing the vulnerable component through internal systems and vendor dependencies.
- Designing a patch or mitigation that preserves required functionality.
- Reviewing code and infrastructure changes under the bank’s change-control process.
- Testing for regressions, performance effects and new attack paths.
- Scheduling production deployment, monitoring the result and documenting closure for audit and regulatory needs.
AI can therefore make remediation capacity a limiting factor. If discovery runs faster than an organization can safely patch, the backlog becomes a risk-management problem even when the detection technology performs as intended.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What enterprises should take from the Bank of America example
Measure the whole vulnerability pipeline
Security programs evaluating autonomous or semi-autonomous testing should track more than findings per scan. Useful measures include the percentage of findings independently validated, time from discovery to approved patch, time from approval to production deployment, the share involving vendor software, and the number of findings closed with compensating controls rather than code changes.
Plan remediation capacity before expanding discovery
Before increasing automated scanning, an organization should estimate who will triage results, which teams own each application, how vendor fixes will be handled and how emergency changes will be tested. Bank of America’s additional 1,000 contractors illustrate the scale of capacity that may be needed when a large software estate is examined at machine speed.
Keep cost reporting separated
Combining security remediation with anti-money-laundering or other compliance spending makes it difficult to evaluate an AI security program. Separate labor, tooling, vendor remediation, testing and regulatory work in financial reporting so executives can see what the detection effort actually costs and what risk reduction it delivers.
What is still not publicly established
- The number of vulnerabilities Mythos identified in Bank of America systems.
- How many findings were confirmed exploitable in production.
- How many issues affected the bank’s own code versus vendor software.
- The average time from each finding to patch deployment.
- The contractors’ total compensation and the program’s final cost.
The confirmed facts are the staffing increase, the approximate existing workforce, and the reported spending ranges. They show that AI-assisted vulnerability discovery can expose remediation demand at a scale requiring thousands of people, but they do not by themselves prove that AI has replaced the engineers who must make those fixes safe.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
