What happened
Business Insider reported that Bank of America hired 1,000 external consultants in the second quarter to address software vulnerabilities associated with increasingly capable AI models. CEO Brian Moynihan described the effort as “Mythos remediation” and said the contractors remained on staff alongside roughly 3,000 existing workers in the relevant area. The report does not state the initiative’s exact cost or identify which vulnerabilities were patched.
Business Insider reported that Bank of America CEO Brian Moynihan discussed the effort during a Wednesday earnings call and expanded on it in an interview with CNBC. Moynihan said the bank had hired 1,000 external consultants for what he called “Mythos remediation.”
According to the report, the bank began the work after executives considered how to quickly address software weaknesses exposed by powerful AI models, including Anthropic’s restricted Mythos model. Moynihan said the consultants were hired in the second quarter and remained at the bank, working alongside about 3,000 people already in the relevant area.
The report says the software is used by internal employees and external vendors, but it does not identify the affected applications, provide vulnerability counts, or describe specific patches. Moynihan did not disclose the exact cost of the AI-related initiative.
Business Insider also reported that Moynihan said Bank of America had spent “a couple hundred million plus” on software fixes and anti-money-laundering compliance issues connected to a $1.2 billion Treasury penalty. The source does not establish how much of that spending was attributable to AI-related remediation rather than compliance work.
Source details: businessinsider.com ↗
Why it matters
The report illustrates a practical security consequence of more capable AI systems: organizations may need to reassess software that was not previously known to be vulnerable to automated discovery and exploitation. Bank of America’s response also suggests that AI-related security work can require substantial staffing and spending at a major financial institution. However, the source does not independently verify the vulnerabilities, the effectiveness of the remediation, or whether the work was caused solely by Anthropic’s Mythos.
The reported hiring reflects a shift from treating AI security as a specialized research concern to treating it as an operational software-maintenance requirement. If powerful models can identify weaknesses at scale, financial institutions and other organizations may need larger teams to review code, prioritize patches, and examine software supplied by vendors.
The scale of the reported response is notable because it involves 1,000 external consultants at a bank that already had roughly 3,000 people in the relevant area. That indicates the possible labor and cost implications of responding to AI-enabled vulnerability discovery, though the source provides no independent assessment of whether the staffing level was proportionate or effective.
Business Insider cited prior comments from JPMorgan Chase CEO Jamie Dimon, who said cybersecurity risks increased tenfold after Mythos’s release. That statement is a separate executive opinion, not an independently demonstrated measurement. The source also mentions reported AI-agent activity involving other organizations, but does not provide primary evidence or independent verification for those examples.
The main limitation is attribution. The concrete details come from Moynihan as reported by Business Insider, and the source contains no technical audit, public incident report, vulnerability disclosure, or regulator finding confirming the specific weaknesses or the outcome of the remediation.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').An agent must create a draft calendar event for Tuesday at 2 p.m. Which evidence would establish the requested result?
What to watch next
Key unknowns include which systems were affected, whether any vulnerabilities were exploited, how much of the reported spending was specifically tied to AI-related remediation, and whether the contractors will remain after the current effort. Further disclosures from Bank of America, regulators, or independent security researchers would clarify the scope and results of the program.
Watch for Bank of America disclosures identifying the affected software, the number and severity of vulnerabilities, whether any were exploited, and how the remediation was validated.
The bank’s future financial filings or regulatory disclosures may clarify the cost of the initiative and separate AI-related security spending from the broader spending associated with anti-money-laundering compliance.
Independent security researchers or affected vendors could provide evidence about whether the vulnerabilities were newly exposed by AI systems, previously known weaknesses, or weaknesses found through conventional security testing.
Further reporting may establish whether the contractors were retained as a temporary response or whether banks are building permanent teams for testing against autonomous or semi-autonomous AI agents.
The source does not confirm general access to Anthropic’s Mythos, its precise capabilities, release conditions, or whether its reported role in the bank’s remediation was direct or indirect.