Bank of America added 1,000 contractors to patch flaws found by AI models
For a regional bank cio setting next year's budget
Bank of America added about 1,000 outside contractors in the second quarter to patch software flaws exposed by advanced AI models, CEO Brian Moynihan said after the bank's third-quarter earnings announcement, according to a RocketNews report.1
Moynihan characterized the security risk from advanced AI capabilities as significant, which led the bank to remediate quickly across its internal systems and vendor relationships earlier this year, RocketNews reported.1 Anthropic's Mythos model became available to a limited group of banks, technology firms and government agencies in April, according to RocketNews; IBM's Security Intelligence podcast page also links the hiring to flaws found by Mythos and other AI security models.12
The contractors supplement an existing team of 3,000 employees dedicated to patching, according to RocketNews.1
The bank spent several hundred million dollars in the third quarter on software remediation and anti-money-laundering compliance matters combined, so the portion tied to AI-found flaws is not known from the sources.1
Moynihan indicated remediation spending should decline as patching is completed, and he pointed to savings from the bank's approximately 130 internal AI initiatives rising from $300 million this year to $700 million in 2027, RocketNews reported.1
The bank's workforce fell by roughly 3,400 employees over the past year, and RocketNews said it is uncertain how much AI adoption contributed. The sources are secondhand; neither is a Bank of America filing or transcript.1
Each flaw an AI model finds creates fix, test and release work at the bank and at its vendors, and Bank of America's staffing shows that work can require hundreds of added people. Executives planning for similar tools should budget for remediation capacity and vendor patch timelines, not just for the scanning.
Our take. Bank of America put 4,000 people on patching what Mythos found. Its several-hundred-million-dollar bill also includes AML fixes. You may not have Mythos, but flaws it finds can sit in vendor code your bank also runs.
Action. Vendor risk management: Ask critical software vendors for their patch plan and timeline for AI-discovered vulnerabilities, and budget contractor capacity for your share.
What our records say
Bank of America's AI strategy is described as the opposite of a big-bang rollout: a decade of one assistant, Erica, extended step by step into employees' tools, treasury products and advisor workflows.1 CEO Brian Moynihan's stated constraint is accuracy: 'the data has to be perfect'.1 An AI council ran about 15 proofs of concept outside the Erica platform, found teams 'reinventing the wheel', and the bank rebuilt Erica as a second-generation, model-agnostic platform in 2025.2
From our records
- Bank of Americabank · latest Treasury, FinCEN and OCC impose $1.21 billion in AML and sanctions penalties (Oct 2026) · vendors BioCatch, Microsoft Copilot, Claude
- Claude (Anthropic)vendor · banks using it (21) Goldman, JPMorgan, BankUnited · alternatives Microsoft Copilot, ChatGPT Enterprise, Gemini Enterprise