Summary: Bank of America CEO Brian Moynihan said on October 14, after releasing Q3 earnings, that the bank added 1,000 external contractors in Q2 to patch software flaws exposed by Anthropic’s Mythos model, on top of an existing 3,000-person team. It is one of the first concrete public accounting by a large US company of the labor and money needed to keep up with frontier-model vulnerability discovery. For builders, it marks a shift: finding flaws is no longer the bottleneck — patching capacity is.
What Moynihan actually said
Speaking to CNBC’s Leslie Picker, Moynihan described a real risk that forced a fast response: “when these frontier models appeared… many of us sat down and discussed: how do we get through this as quickly as possible?” The 1,000 contractors joined as advisors, not headcount, and were still on staff as of the interview. On the earnings call the same day, he said Q3 spending on software patching plus anti-money-laundering compliance issues totaled over $200 million combined, without splitting the two.
The cost context matters for anyone selling or budgeting AI programs. Bank of America’s profit fell 17% that quarter, dragged by AML-related settlements, and the stock dropped more than 8% intraday. Moynihan told investors the patching spend is temporary — “once the patching is done, there will be less to patch” — while also citing roughly 130 internal AI projects expected to save $300 million this year and $700 million by 2027. The same bank is both harvesting AI savings and paying hundreds of millions to fix what AI uncovers.
The bottleneck moved from discovery to remediation
Mythos, which Anthropic launched in April to a limited set of banks, tech companies, and government agencies, can surface hundreds to thousands of low-to-medium severity vulnerabilities. Per Reuters reporting from May, weaknesses that banks might once have patched over weeks now need fixing in days, and increased workload may push more frequent system downtime.
Suzu Labs senior director Jacob Krell, commenting via The IT Nerd, put it bluntly: the bottleneck has shifted from finding vulnerabilities to fixing them, and patch capacity is now the scarce resource. Black Hills Information Security’s John Strand made the same point from the other direction — more findings simply mean more work for the people doing the repairs. I covered a related angle in how US officials urged banks to test Mythos; this disclosure shows what the follow-through actually costs.
How big banks are absorbing the load
Bank of America is not alone. Bloomberg reported in May that JPMorgan, Morgan Stanley, and Goldman Sachs all formed confidential teams to handle Mythos findings, some pairing with security vendors or federal intelligence agencies. JPMorgan CEO Jamie Dimon said on Bloomberg TV that “hundreds” of his staff now work on this full-time, and by July he was warning, per Bloomberg Law, that broadened Mythos access is a “real problem.”
Regulators adjusted too: the Federal Reserve and OCC delayed some security examinations of the largest banks to give them time to harden systems — a schedule shift, not a loosening of oversight. Large banks also began warning smaller ones, which face both the cost and the compute barriers to running such models themselves.
The contractor tradeoff you should budget for
Outsourcing patch capacity creates its own exposure. Krell estimated the ratio works out to roughly one contractor per three existing security staff, and argued that a bank’s vulnerability list is effectively a target map of its weakest points — internal and supplier code alike. Handing that list to outsiders means sharing your most sensitive operational intelligence with people outside your HR, monitoring, and disciplinary systems. His advice is to nail down three things up front: contractor tenure, offboarding procedure, and who audits their access to live vulnerability data.
Strand’s caution is the longer arc: patching “is continuous work,” not an easter-egg hunt you finish. Moynihan expects remediation demand to taper; security practitioners expect it to persist. For your own roadmap, assume both — a temporary surge to burn down the backlog, and a permanent line item for the ongoing flow. The practical next step is simple: before you point a discovery model at your codebase, decide who patches, who audits the patchers, and how long they stay.