Bank of America Adds 1,000 Contractors to Address Vulnerabilities Revealed by AI
Table of Contents
You might want to know
- Why did Bank of America bring in 1,000 contractors, and what role did advanced AI models play in that decision?
- How does the bank balance the immediate cost of software remediation against AI-related savings and productivity improvements?
Main Topic
Bank of America has hired a large group of external contractors to help repair software vulnerabilities identified amid the development of advanced artificial intelligence models, including Anthropic’s Mythos. Chief Executive Officer Brian Moynihan described the effort in an interview with CNBC on Wednesday, following the bank’s third-quarter earnings release. His account offered a rare public view into the people and spending involved as a major U.S. financial institution works to secure its technology systems.
Moynihan said that earlier this year the bank moved quickly to strengthen a wide range of its own software and code supplied by vendors. The work involved thousands of employees and outside personnel. The concern, he explained, was that frontier-level AI models could make it easier to locate weaknesses in software that might otherwise remain hidden. That possibility prompted the bank and others to consider how to address vulnerabilities at speed.
“That risk is real risk, and that's why when the frontier-type models came out. … A lot of us sat down and said, 'How do we figure out how to get through this quickly?” Moynihan told CNBC’s Leslie Picker. The statement conveys the urgency behind the bank’s response: its security work was not limited to a routine review, but was accelerated in reaction to a changing threat environment.
To expand the effort, Bank of America brought in 1,000 contractors during the second quarter to work on software patching. Moynihan said those contractors remained at the bank at the time of the interview, working alongside 3,000 people already assigned to that area. The figures illustrate the scale of the response, while also showing that the remediation work is being handled by a combination of temporary outside support and an established internal workforce.
The bank’s immediate response combines 1,000 contractors with 3,000 existing personnel focused on the work. Patching software means correcting code or applying updates intended to close known security weaknesses. In a large organization, that process can involve identifying affected systems, prioritizing risks, testing changes, coordinating with vendors, and deploying fixes without disrupting essential services.
The financial commitment has also been significant. Earlier on Wednesday, Moynihan told analysts that the bank spent a “couple hundred million plus” in the third quarter on software remediation and regulatory issues related to anti-money laundering compliance. The reported amount covers more than one category of work, so it should not be interpreted as a precise figure for Mythos-related security fixes alone. Even so, it conveys that the bank is addressing a substantial set of technology and compliance obligations at the same time.
The disclosure is notable because it is among the first statements from a major U.S. corporation to specify both the workforce and the spending associated with protecting software systems in response to Mythos. The model was released to a small group of banks, technology companies, and government agencies in April. Its limited availability does not eliminate broader concerns: capabilities demonstrated by advanced models can influence how organizations assess their own exposure, even when a particular model is not widely accessible.
The episode illustrates the dual-edged nature of AI. On one side, AI tools may help organizations improve productivity and reduce costs. On the other, models capable of finding and potentially exploiting vulnerabilities in older software can intensify pressure on companies to review and repair systems that have accumulated over many years. Security teams may need to examine both internally developed code and software provided by vendors, making the work broad and operationally complex.
Moynihan also emphasized the importance of being cautious about the relationship between technology providers and their customers. “We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services,” he said. The comment points to a practical governance issue: companies rely on external providers for technology, but they also need to assess the security of the products and services those providers offer.
For Bank of America, the immediate spending increase may not continue at the same pace indefinitely. Moynihan spoke as the company’s shares fell by as much as 8% on Wednesday and sought to reassure investors that the higher costs were temporary. He said that once systems are patched, the need for the same level of remediation should diminish. “Once you patch, you don't have to patch as much. … The pipeline moves through,” he said, adding that remediation costs are expected to decline over time.
That expectation depends on the nature of the work. A large initial effort can address a backlog of weaknesses, but software security is not a one-time task. New vulnerabilities may emerge, systems can change, and vendors may issue further updates. The bank’s comments therefore suggest both a near-term push to complete existing fixes and an ongoing need to maintain security processes after the current pipeline has moved through.
At the same time, Bank of America is using AI in other parts of its operations to seek efficiencies. The company has about 130 internal AI projects. Moynihan told analysts that savings from those projects are expected to increase from $300 million this year to $700 million in 2027. These estimates reflect anticipated benefits across the bank’s efforts, rather than a claim that any single project will produce those results.
The bank’s workforce has also changed. Moynihan said its head count fell by about 3,400 employees in the past year, while the firm cut roughly 5% of managers. The available information does not establish how much, if any, of that reduction resulted from AI. Workforce changes can arise from many factors, including reorganizations, business priorities, and efficiency measures, so the figures alone do not demonstrate a direct causal link between AI adoption and job reductions.
Taken together, the disclosures describe a company navigating two distinct effects of technological change. Advanced AI has increased the urgency of defensive work, requiring additional people and substantial spending to repair software weaknesses. Separately, the bank expects its own AI projects to contribute to savings over time. Those efforts are related by the broader adoption of AI, but they involve different goals, costs, timelines, and measures of success.
Key Insights Table
| Aspect | Description |
|---|---|
| Contractor support | Bank of America added 1,000 contractors in the second quarter to help patch software vulnerabilities; they remained on the work alongside 3,000 existing personnel. |
| Third-quarter spending | The bank spent a “couple hundred million plus” on software remediation and regulatory issues related to anti-money laundering compliance. |
| AI security concern | Anthropic’s Mythos and other advanced models have raised concern about the discovery and potential exploitation of long-standing software flaws. |
| Expected remediation trend | Moynihan said remediation costs are expected to decline as the current patching pipeline progresses. |
| Internal AI projects | The bank has about 130 internal AI projects, with anticipated savings rising from $300 million this year to $700 million in 2027. |
| Workforce changes | Head count fell by about 3,400 employees in the past year, and roughly 5% of managers were cut; the share attributable to AI is unclear. |
Afterwards...
The experience highlights areas where organizations, researchers, and policymakers may need to build further knowledge. One priority is developing reliable methods to assess how AI systems identify software vulnerabilities, including how to distinguish useful defensive analysis from capabilities that could enable misuse. Clear testing protocols and responsible access practices can help organizations understand risks without overlooking the benefits of security research.
Companies will also need to strengthen the everyday processes that support secure software. This includes maintaining accurate inventories of internal and vendor code, prioritizing fixes according to risk, testing patches carefully, and establishing clear accountability between technology providers and their customers. AI can accelerate discovery, but effective protection still depends on sound engineering, coordinated governance, and sustained human oversight.
Finally, organizations should evaluate AI-related savings and workforce effects with care. Forecasts can help leaders plan, but they do not by themselves establish which tasks will change or how employment outcomes will be affected. Continued research into productivity measurement, security practices, and responsible automation can help institutions make decisions based on evidence rather than assumptions. The central challenge is to use AI’s capabilities while preparing for the new security demands those same capabilities can create.
Last edited at：2026/10/15