Bank of America hired 1,000 contractors to patch Mythos flaws

Bank of America just put a hard number on what frontier AI is doing to bank cybersecurity budgets. On Wednesday, October 14, 2026, after third-quarter results, CEO Brian Moynihan told CNBC that the bank added 1,000 third-party contractors in the second quarter to help patch software vulnerabilities exposed by advanced models, including Anthropic's Mythos. Those contractors are still on the job, Moynihan said, on top of about 3,000 people the bank already has in that area.

The comments are among the clearest public accounting yet from a major US bank of the labor and cash spent to keep up with Mythos-era vulnerability discovery. Quartz and The Register both amplified the same earnings-day story. The picture that emerges is simple and uncomfortable: models that help banks find risk also force them to hire armies of humans to close it.

This article walks through what Moynihan said, how Mythos landed in banking in the spring, what the cost numbers do and do not prove, and why the dual edge of AI (offense against legacy code, defense and productivity bets inside the same firm) now sits on every large bank's balance sheet conversation.

What Moynihan said on earnings day

In an interview with CNBC's Leslie Picker after the bank's third-quarter release, Moynihan framed the Mythos moment as a real operational risk, not a hypothetical red-team slide.

"That risk is real risk, and that's why when the frontier-type models came out. … A lot of us sat down and said, 'How do we figure out how to get through this quickly?'" he told CNBC.

"We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area," he said.

The work covers a wide spectrum of the bank's own code and software supplied by vendors. That vendor piece matters. Banks do not only own the applications they write. They run decades of third-party stacks, integrations and tools. A model that chains lower-severity weaknesses into higher-risk paths does not care who wrote the code. It only cares whether the path works.

On the analyst call the same day, Moynihan said the bank spent a "couple hundred million plus" in the third quarter on software remediation and on regulatory issues tied to anti-money-laundering (AML) compliance. He did not break out how much of that figure was Mythos-driven patching versus AML remediation. Both The Register and CNBC note the blended nature of the number. Readers should treat it as a combined cost bucket, not a pure Mythos invoice.

Moynihan also tried to reassure investors that the remediation spike is temporary. "Once you patch, you don't have to patch as much. … The pipeline moves through," he told CNBC. In other words: the first wave of discovery creates a backlog, the backlog burns cash and contractor hours, and later quarters should look lighter if the inventory of known issues shrinks.

How Mythos hit the banks

According to CNBC, Anthropic made Mythos available in April 2026 to a limited set of banks, technology companies and government agencies. Bank of America is among the lenders with access. That limited release was intentional: Mythos is treated as a high-capability model with serious cyber implications, not as a consumer chatbot.

By May 12, 2026, Reuters reported that US banks were rushing to fix IT weaknesses flagged by Mythos. Sources said large banks with access were uncovering issues and, in some cases, informing smaller banks that lacked direct access so those firms could prepare. Cybersecurity experts described Mythos as especially strong at chaining lower-risk weaknesses into higher-risk exploit paths against legacy systems.

Quartz, summarizing that spring scramble, says remediation that banks might once have deferred for weeks was being finished within days by May, and that the volume of findings ranged from several hundred to thousands, most rated low to moderate in severity. Low and moderate labels can still matter when an automated agent can stitch them together.

The Register adds early-adopter color from outside banking. Mozilla CTO Bobby Holley said in April that Mythos found 271 flaws in Firefox 150, and that so far Mozilla had found no category or complexity of vulnerability that humans can find that Mythos cannot. Holley also said the team had not seen bugs that an elite human researcher could not have found. The model looked less like magic and more like a tireless elite researcher that never sleeps and never forgets a path.

That framing helps explain Moynihan's hiring decision. If Mythos compresses discovery timelines, the bottleneck moves to triage, patch ownership, vendor coordination and regression testing. Adding 1,000 contractors is a blunt but understandable response to a sudden inventory of "fix this soon" tickets across proprietary and vendor code.

The cost story, carefully told

Three money figures dominate the coverage. They should stay distinct.

1. Q3 remediation and AML bucket. Moynihan told analysts the bank spent a couple hundred million dollars plus in the third quarter on software remediation and AML-related regulatory issues. That is a blended figure. It is evidence of a large near-term cost, not a precise Mythos price tag.

2. FinCEN and related AML penalties. On the same earnings cycle, Bank of America took a heavy compliance hit. The Register reports a $1.21 billion FinCEN settlement tied to failures around suspicious activity reporting and national security risks, a concurrent $750 million OCC penalty for Bank Secrecy Act and AML deficiencies, and an $11.6 million OFAC settlement for sanctions violations. Shares fell more than 8% on Wednesday as profits dropped. Those penalties are not Mythos costs. They do help explain why Moynihan lumped AML work into the same quarterly cost narrative, and why investors were already nervous when the contractor story landed.

3. AI savings trajectory. Moynihan told analysts Bank of America has about 130 internal AI projects. CNBC reports expected savings rising from about $300 million this year to $700 million in 2027. The Register quotes a 2026 band of $250 million to $300 million, rising to $700 million by end of 2027, and says each project is expected to achieve a 2x or 3x return over time. The bank also cut roughly 3,000 to 3,400 roles over the past year, including about a 5% reduction in managers, without saying how much AI drove those cuts.

Put together, the bank is telling two stories at once. Story A: frontier models force expensive defensive labor against old software. Story B: the bank's own AI program should more than pay for itself by 2027. Both can be true. Neither cancels the other.

The vendor bind Moynihan named out loud

One of Moynihan's sharper lines was not about headcount. It was about incentives.

"We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services," he told CNBC.

Banks buy models, scanners, managed detection, patch tooling and consulting from overlapping vendors. The same ecosystem that surfaces Mythos-class findings also sells remediation capacity. Moynihan's warning is that a bank can become dependent on the very firms whose tools expand the vulnerability queue. That does not mean the tools are bad. It means procurement, conflict checks and in-house capability still matter when the discovery rate jumps.

The contractor surge fits that tension. Outside help clears the backlog. It also deepens reliance on the market that created the urgency. Moynihan's "pipeline moves through" line is the optimistic exit: finish the first wave, shrink the contractor footprint, keep a stronger steady-state remediation muscle.

Why this matters beyond one bank

Bank of America is not a niche fintech experiment. It is a systemically important US bank saying, on the record, that a frontier model forced a four-digit contractor surge and a multi-hundred-million-dollar quarterly cost conversation. That has several implications.

Cyber insurance and capital. If Mythos-class tools become standard for large banks, examiners and insurers will ask whether peers without equivalent discovery capacity are under-finding risk, or whether peers with access are under-funding the patch factory. Either answer raises the bar.

Vendor software liability. When findings land in third-party code, banks become the customer screaming for patches. Independent software vendors that ship to regulated finance will face faster SLAs and harder questions about secure development. The spring Reuters reporting already hinted that large banks were sharing signal with smaller banks. That pattern can become an industry expectation.

Dual-use AI governance. Mythos sits in the awkward zone between defensive security research and offensive capability. Anthropic limited access. Banks still had to treat the outputs as urgent. Policymakers who talk about "AI for cyber defense" need to budget for the remediation wave that follows successful defense tools. Discovery without patch capacity is just a better inventory of open doors.

Earnings optics. Blending remediation with AML costs makes the Mythos line hard to isolate. Future CFOs may need cleaner breakouts if investors want to separate model-driven cyber spend from classic compliance penalties. Transparency will decide whether this becomes a one-off story or a recurring line item.

What to watch next

Several follow-ups will show whether Moynihan's temporary-cost claim holds.

• Contractor count in future quarters. If the 1,000 outsiders shrink by mid-2027 while finding rates stay high, the bank either automated more triage or slowed discovery. If they stay, the "pipeline" never really cleared.
• Cleaner cost splits. A dedicated Mythos or frontier-model remediation line would let investors compare banks. The current blended Q3 figure cannot do that.
• Vendor patch SLAs. Watch whether core banking, payments and middleware vendors publish faster response commitments after Mythos-class findings.
• Peer disclosures. JPMorgan, Citi, Wells Fargo and regional banks with or without Mythos access have mostly stayed quieter on exact contractor numbers. The first peer that matches Moynihan's candor will reset the narrative.
• Model access policy. Anthropic's limited Mythos release is itself a governance choice. Broader access could accelerate discovery industry-wide. Tighter access could leave smaller institutions flying blind while large banks harden first.

Bottom line

On October 14, 2026, Bank of America put concrete labor and cost language around a story that had been mostly qualitative since the spring: Anthropic Mythos and peer frontier models are forcing banks to patch faster and hire harder. One thousand contractors on top of three thousand internals is not a footnote. A couple hundred million dollars plus in a single quarter for remediation and AML work is not a rounding error, even if only part of it is Mythos-driven.

At the same time, Moynihan sold investors on AI as a savings engine: roughly 130 projects, hundreds of millions in 2026 benefits, and a $700 million 2027 target. That is the dual edge in one earnings cycle. The same class of technology that blows open legacy software is supposed to make the bank leaner and faster. Whether the savings outrun the patch factory is now a measurable, quarter-by-quarter question, not a keynote slogan.

Sources

• CNBC: Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's Mythos (Hugh Son, Oct 14, 2026)
• Quartz: Bank of America hired 1,000 contractors to patch AI-exposed flaws
• The Register: Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified
• Reuters: Anthropic's Mythos sends US banks rushing to plug cyber holes (May 12, 2026)