Bank of America Hired 1,000 Contractors to Patch Software Flaws Exposed by Anthropic's Mythos AI, CEO Says

NEW YORK — Bank of America brought in 1,000 outside contractors to help patch software vulnerabilities exposed by advanced artificial intelligence models, including Anthropic's Mythos, CEO Brian Moynihan said, offering one of the first detailed looks at what major companies are spending to defend against AI-driven cyber risks.

In an interview with CNBC after the bank released third-quarter earnings on Wednesday, Moynihan said the company rushed earlier this year to shore up a wide range of internal and vendor software using thousands of employees and outside personnel.

"We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area," Moynihan said.

'Real risk'

Moynihan said the arrival of powerful new AI models prompted an urgent response from the bank and others in the industry.

"That risk is real risk, and that's why when the frontier-type models came out," Moynihan told CNBC's Leslie Picker. He said many in the industry sat down to figure out how to get through the issue quickly.

Mythos, Anthropic's most advanced model, was released in April to a small group of banks, technology companies and government agencies. Its ability to uncover and potentially exploit long-standing flaws in software has forced organizations to move quickly to fix vulnerabilities before they can be used by attackers.

Anthropic has made an early version of the model available to a limited number of trusted organizations through a program aimed at finding and fixing security weaknesses in critical software.

Hundreds of millions in costs

The bank spent a "couple hundred million plus" in the third quarter on software remediation and on regulatory issues tied to anti-money laundering compliance, Moynihan told analysts earlier Wednesday.

The comments are among the first by a major U.S. company to specify how much manpower and money it has devoted to protecting its systems from the risks posed by Mythos and similar models.

Moynihan also noted a broader challenge for companies relying on outside technology providers.

"We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services," he said.

Costs expected to fall

Moynihan sought to reassure investors that the elevated spending would be temporary.

"Once you patch, you don't have to patch as much," he said, adding that the bank expects remediation costs to decline over time as the work moves through its pipeline.

AI as a cost saver

The comments highlight the double-edged nature of AI for large companies. While advanced models can expose costly security weaknesses, they can also help businesses become more efficient.

Bank of America has about 130 internal AI projects, and savings from those efforts are expected to rise from $300 million this year to $700 million in 2027, Moynihan told analysts.

The bank's head count fell by about 3,400 employees over the past year as it cut roughly 5% of its managers, he said. It was not clear how much of that reduction was tied to AI.

Tough quarter for the bank

The disclosures came on a difficult day for Bank of America. The bank reported that third-quarter profit fell 17% from a year earlier, weighed down by a $1.2 billion penalty from federal regulators over failures in its anti-money laundering controls and a slowdown in trading and investment banking revenue.

Treasury Department regulators said the bank failed to report more than $5 billion in suspicious transactions. Excluding the penalty, Bank of America said it earned $8.1 billion, or $1.08 per share.

Bank of America shares fell as much as 8% on Wednesday.

Industry-wide concern

Bank of America's response reflects growing concern across the financial sector and other industries about the cybersecurity implications of increasingly capable AI systems.

Banks rely on vast amounts of legacy software, some of it decades old, as well as code supplied by outside vendors. Security experts have warned that advanced AI models could make it far easier and faster to find weaknesses in such systems, raising the stakes for organizations to fix them before malicious actors can exploit them.

At the same time, the same tools can help defenders identify and fix vulnerabilities more quickly, which is why some companies and government agencies have been given early access to such models.

Investors will be watching whether Bank of America's remediation costs decline as Moynihan expects, and whether its AI-driven savings materialize as projected next year.

Other large banks and corporations may face pressure to disclose their own spending on AI-related security efforts, as regulators and shareholders seek to understand how companies are managing the risks and opportunities presented by advanced AI.