Bank of America Mobilizes 4,000 Workers After Anthropic's Mythos Exposes Vast Software Weaknesses

Bank of America chief executive Brian Moynihan delivered a blunt assessment this week. When frontier AI models began surfacing flaws across the bank's proprietary systems and vendor software, executives saw immediate danger. "That risk is real risk," he told CNBC. So the institution acted. It added 1,000 contractors to its existing team of roughly 3,000 specialists dedicated to remediation work.

The contractors arrived in the second quarter. They remain on site. Their assignment centers on addressing vulnerabilities uncovered by tools that include Anthropic's Mythos model. The effort contributed to third-quarter costs that Moynihan described to analysts as "a couple hundred million plus." That figure covers both the software fixes and separate anti-money laundering compliance demands. Expenses should ease, he added, once the initial surge of discoveries subsides.

Mythos arrived quietly in April under Project Glasswing. Anthropic granted limited access to select banks, technology companies and government agencies. The goal was defensive. Let trusted parties scan critical codebases before adversaries could weaponize the same capabilities. One early scan flagged more than 23,000 potential issues. Most rated low to moderate. Some carried higher severity. The volume proved overwhelming.

Similar pressure hit other large lenders. JPMorgan Chase CEO Jamie Dimon told Bloomberg in early October that cybersecurity risks had risen tenfold after Mythos appeared. "AI created vulnerabilities that we didn't know about," he said. Banks that once measured patching cycles in weeks suddenly faced demands measured in days. Reuters reported last May that major institutions began sharing insights with smaller peers lacking direct access to the model.

The model's track record extended beyond finance. It identified 271 flaws in Mozilla's Firefox 150 release. Mozilla CTO Bobby Holley offered a striking verdict in April. "So far we've found no category or complexity of vulnerability that humans can find that this model can't," he said, according to The Register. "We also haven't seen any bugs that couldn't have been found by an elite human researcher." The observation underscored a key point. Mythos accelerated discovery. It did not invent entirely new classes of problems. Yet the speed at which it surfaced them changed the math for security teams.

Bank of America's response reflects that shift. Its technical workforce gained about 10 percent in efficiency from AI initiatives overall. The bank runs roughly 130 AI-related projects. Each carries expectations of two- to threefold returns over time. Those gains offer a partial offset. Moynihan projected AI-driven savings climbing from roughly $300 million this year to $700 million in 2027. Still, the immediate remediation bill landed heavily in the third quarter.

And the pattern repeats elsewhere. Comcast and Booz Allen Hamilton reported using Mythos-class models to locate authentication weaknesses and complex exploit chains that traditional scanners missed. One Comcast assessment spanned 258 critical systems and approximately 170 million lines of code. The model's ability to reason across boundaries, rather than flag isolated issues, surprised some reviewers.

Yet questions linger about long-term balance. Every vulnerability Mythos surfaces still requires human verification, code changes, testing and deployment. The contractors at Bank of America perform exactly that labor. They augment staff rather than replace it. Early hype around autonomous AI agents fixing their own discoveries has not fully materialized. Machines file the tickets. People still close them.

Regulators took notice quickly. The U.S. government briefly restricted Mythos exports before lifting the ban. Anthropic later expanded its Cyber Verification Program, allowing broader vetted access while maintaining controls. By July, partners under the original Glasswing effort had verified more than 129,000 vulnerabilities. The company's own open-source scanning added thousands more.

Bank of America's disclosure marks one of the most specific public accountings to date from a major corporation. It quantifies both headcount and spending tied directly to AI-generated findings. Other executives have spoken in broader terms. Dimon's warning on amplified risk. Earlier Reuters reporting on accelerated patching cycles across the industry. The collective message is consistent. Advanced models now scan at machine scale. Human remediation capacity has limits. Banks are paying to expand that capacity in the short term.

Costs are expected to moderate. Once core systems receive attention, the volume of new high-priority findings should drop. Vendor software updates will incorporate many fixes over time. Moynihan signaled as much. The contractors will not stay indefinitely. Their presence buys breathing room while the bank absorbs the initial wave.

Even so, the episode illustrates a broader tension. AI promises efficiency gains across operations. In security it first delivers an avalanche of work. That avalanche arrived at one of the country's largest financial institutions. Bank of America met it with thousands of additional hands and hundreds of millions of dollars. The rest of the sector watches closely. So do the regulators charged with ensuring systemic stability.

The contractors continue their tasks. The models keep scanning. And the industry adjusts to a new rhythm where discovery outpaces repair, at least until equilibrium returns. How quickly that happens will shape cybersecurity budgets and staffing plans for years ahead.