Bank of America Adds 1,000 Contractors to Address Software Risks Revealed by AI

Table of Contents

• You might want to know


• Main Topic


• Key Insights Table


• Afterwards...

You might want to know

• Why did Bank of America bring in 1,000 contractors to work on software security?


• How does the bank balance the costs of AI-related cyber risks against the potential savings from its own AI projects?

Main Topic

Bank of America hired 1,000 external contractors to help repair software vulnerabilities identified with the assistance of advanced artificial intelligence models, including Anthropic’s Mythos. Chief Executive Officer Brian Moynihan described the effort in an interview with CNBC on Wednesday, following the bank’s third-quarter earnings release. His comments offered a rare public account of the staffing and spending involved in a large financial institution’s response to AI-enabled software risk.

Moynihan said the bank moved earlier this year to strengthen a broad range of its own software and code supplied by vendors. The work drew on thousands of employees and outside personnel. He told CNBC’s Leslie Picker that the arrival of frontier-type AI models prompted financial institutions to consider how to respond quickly to the risks they could create. The concern, he indicated, was not limited to one application or one vendor: the review covered a wide spectrum of internal and third-party code.

In the second quarter, Bank of America brought in 1,000 contractors specifically to help with patching. Moynihan said those contractors remained at the bank, working alongside the 3,000 people already in that area. A software patch is a change designed to correct a flaw or otherwise improve a program’s security. In this case, the scale of the effort reflects the challenge of reviewing and updating code across a large organization, particularly when potential weaknesses may have accumulated over many years.

The disclosure matters because Mythos was made available in April to a limited group of banks, technology companies, and government agencies. Models with advanced code analysis capabilities can help identify weaknesses that might be difficult to locate through conventional review alone. In the wrong hands, the same ability to find vulnerabilities could also help attackers exploit them. The technology therefore presents a security challenge even for organizations that are not using it directly: they may need to assess whether their systems contain flaws that more capable tools can reveal.

Bank of America’s response also involved significant expense. Earlier Wednesday, Moynihan told analysts that the bank spent a “couple hundred million plus” in the third quarter on software remediation and regulatory matters related to anti-money-laundering compliance. The statement described spending across those areas together; it did not assign a separate amount to Mythos-related remediation. It does, however, indicate that security work and compliance obligations can create overlapping demands on a large bank’s resources.

The central issue is the dual nature of AI: tools that can improve productivity may also expose software weaknesses that organizations must urgently fix. Companies can use AI to support analysis, automate tasks, and reduce costs. At the same time, models capable of examining code may increase pressure on organizations to find and address vulnerabilities before someone else exploits them. For businesses with extensive software estates, that can mean additional staffing, accelerated testing, and higher short-term spending.

Moynihan emphasized the need to remain ahead of potential threats and to scrutinize the interests of companies that develop and sell software services. His comments point to a practical concern for customers: software providers can offer useful products, but buyers still need to understand how those products are built, maintained, and secured. Independent review and careful vendor oversight can help organizations assess risks that may not be apparent from a product’s advertised capabilities.

The chief executive also tried to reassure investors that the increased remediation costs would not continue at the same level indefinitely. As patches are applied and the backlog of issues moves through the repair process, the bank expects to need less remediation work over time. In Moynihan’s words, “Once you patch, you don’t have to patch as much.” That outlook suggests the spending surge is being treated as a time-limited response to a concentrated set of vulnerabilities, although the bank’s actual future costs will depend on what further reviews uncover.

The comments came as Bank of America’s shares fell by as much as 8% on Wednesday. The decline took place on the same day Moynihan discussed the additional spending, but the information provided does not establish that the software work alone caused the share-price movement. Investors may consider both the immediate cost of remediation and the potential longer-term effect of improving security. For a bank, preventing a serious breach can also protect customers, operations, and trust, even when the preventive work requires substantial near-term resources.

Meanwhile, Bank of America is pursuing AI projects intended to improve efficiency. Moynihan told analysts that the company has about 130 internal AI projects. Savings from those efforts are expected to increase from $300 million this year to $700 million in 2027. These projections present a contrasting side of the bank’s AI strategy: the technology is a source of new security demands, but it is also expected to help lower expenses in other parts of the business.

The bank’s workforce has also changed. Moynihan said head count fell by about 3,400 employees in the past year, while the company reduced its number of managers by roughly 5%. The available information does not clarify how much of the workforce reduction was attributable to AI. It would therefore be premature to treat the staffing changes as evidence that AI directly replaced a specific number of employees. The figures describe simultaneous developments, but they do not establish a direct causal link.

Together, these details show why AI-related investment cannot be understood as a simple choice between spending and saving. A company may invest in AI to raise productivity, while also spending more on security, software maintenance, compliance, and oversight. The net effect depends on the balance between those costs and the value created by new systems. For Bank of America, the contractor deployment and the projected savings from internal AI projects represent different parts of that broader calculation.

The episode also underlines the importance of preparation. Organizations need an accurate understanding of the software they use, including systems developed by external vendors. They may need processes for identifying vulnerabilities, prioritizing fixes, testing patches, and confirming that updates work as intended. A large, fast-moving response can help address urgent risks, but durable cybersecurity also depends on routine maintenance and clear responsibility across internal teams and suppliers.

Key Insights Table

Afterwards...

Bank of America’s experience points to several areas that businesses, policymakers, and researchers may need to explore further. One is how to evaluate AI systems that can identify software vulnerabilities: organizations need reliable ways to understand what a model can discover, how consistently it performs, and what safeguards are appropriate before its capabilities are used at scale. Clear testing methods could help distinguish between legitimate security research and activity that increases the risk of exploitation.

Another priority is strengthening the software supply chain. Large organizations depend on products and code from many providers, making it difficult to assess every component independently. Better documentation, coordinated vulnerability disclosure, secure development practices, and effective vendor review could help customers understand where risks originate and who is responsible for addressing them. These practices are particularly important as AI tools make it faster to search for weaknesses across large codebases.

Organizations should also study how to measure the full economic impact of AI. Savings from automation and productivity improvements need to be considered alongside the costs of cybersecurity, compliance, training, and system maintenance. In Bank of America’s case, the expected savings from internal projects and the current remediation effort illustrate why both sides belong in the same assessment. A balanced view of AI should account for productivity gains as well as the safeguards required to use the technology responsibly.

Finally, future research and policy discussions can examine how workforce changes relate to AI adoption without assuming that every reduction is caused by automation. Reliable evidence about job roles, changing skill requirements, and the distribution of productivity gains would help employees and employers prepare more effectively. As AI capabilities advance, the most durable approach will combine technical security, responsible oversight, transparent evaluation, and continued investment in human expertise.