Bank of America deployed 1,000 external contractors in the second quarter to repair software vulnerabilities uncovered by Anthropic’s Mythos AI model.
Bank of America CEO Brian Moynihan said the bank hired an external workforce to handle the volume of work generated by AI discoveries.
"We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area"
The 1,000 contractors remain on site today. They supplement the bank’s existing 3,000 technical staff members who handle software maintenance and security.
In April, Mythos launched with a limited rollout to select government agencies, technology firms, and banks. Mozilla CTO Bobby Holley reported that the model identified 271 flaws in Firefox 150 shortly after its release.
"So far we've found no category or complexity of vulnerability that humans can find that this model can't"
Holley noted that no bugs had been seen that could not have been found by an elite human researcher. Early adopters observed that Mythos identified complex vulnerabilities quicker than humans, causing a massive influx of required patches.
Concerns about how quickly the bank would tackle all the work associated with Mythos' discoveries were shared globally. Anthropic promoted Mythos as a dominant model that disrupted established cybersecurity norms. Moynihan said the bank recruited outside assistance because it worried about managing the workload speed.
"That risk is real risk, and that's why when the frontier-type models came out. … A lot of us sat down and said, 'How do we figure out how to get through this quickly?"
Moynihan told analysts that the bank spent a "couple of hundred million plus" in the third quarter on regulatory matters and software fixes for anti-money laundering compliance. He did not break down how much of that sum was devoted to AI or Mythos compared with cleaning up the bank’s AML issues.
Financial Impact and Regulatory Penalties
The bank faces significant financial pressure from both defensive spending and regulatory penalties. Shares slid more than 8 percent on Wednesday morning after the bank reported a 17 percent drop in profits. This decline followed a $1.21 billion settlement reached with the Treasury's Financial Crimes Enforcement Network (FinCEN).
The FinCEN order relates to the bank's failure to police national security risks. These included Chinese money laundering and a failure to report over $5 billion in suspicious activity. The Office of the Comptroller of the Currency simultaneously issued a $750 million penalty addressing Bank Secrecy Act and AML compliance deficiencies.
Bank of America also settled with the Office of Foreign Assets Control for $11.6 million. This settlement covered breaches of sanctions involving Iran, Russia, drug trafficking, and worldwide terrorism.
| Cost/Fine | Projected Benefit | |
|---|---|---|
| Q3 Remediation and AML | $200 million+ | - |
| FinCEN Settlement | $1.21 billion | - |
| OCC Penalty | $750 million | - |
| AI Savings (2027) | - | $700 million |
Moynihan said AI forces costly defense but also boosts productivity. The bank has about 130 internal AI projects. Savings from these initiatives are projected to grow from $300 million this year to $700 million in 2027, though he did not detail how these savings will be achieved.
Each of the circa 130 AI-related projects is projected to yield a return on investment of 2x or 3x eventually. Moynihan said the bank made its tech engineering workforce around 10 percent more efficient.
Workforce Strategy and Future Outlook
Moynihan said the bank must stay ahead of vendors who are also developers of these AI models.
"We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services"
He explained that patching reduces future workload. "Once you patch, you don't have to patch as much. … The pipeline moves through," he said.
Moynihan said the contractors' assistance won't be needed in the longer term, describing the spending increase as temporary to reassure investors.
The bank has reduced its headcount in parallel with these AI investments. Sources differ on the exact number of roles cut. One report states the bank reduced around 3,000 roles. Another indicates that approximately 3,400 employees left their positions over the last year. Both sources note a roughly 5 percent decrease in the number of managers.
It remains unclear how much of that reduction is attributable to AI. Moynihan did not specify how much of a role AI played in the workforce changes.
What we know
- Bank of America hired 1,000 contractors in Q2.
- The bank spent over $200 million on remediation and AML in Q3.
- AI projects are projected to save $700 million by 2027.
Still unclear
- Exact portion of the $200 million+ spent on Mythos patches versus AML.
- Specific mechanisms for achieving $700 million in AI savings.
- Precise number of job cuts attributable directly to AI.
