Bank of America has discovered that the expensive part of AI-powered security is not finding the bugs. It is fixing them. The bank has brought in 1,000 contractors to repair software vulnerabilities flagged by advanced AI models, among them Anthropic's Mythos, and its CEO says the bill is real.
What the bank said
CEO Brian Moynihan told analysts about the contractors after the bank published its quarterly results. The 1,000 were hired in the second quarter and are still on the job. They work alongside 3,000 in-house specialists who handle security and software remediation.
So the bank now has roughly 4,000 people on the problem, a quarter of them on a contract basis. That is a large team to assign to the sentence "we found some issues."
Whose code is being checked
This year the bank is reviewing and repairing two kinds of software:
- Its own code. The programs it wrote and maintains itself.
- Vendor software. Programs supplied by outside providers, which the bank also has to assess.
Moynihan said the risks are real. Banks, in his telling, need to stay ahead of threats while also judging how secure their suppliers' products are. The second job is the less comfortable one, since a bank can fix its own code but can only ask politely about everyone else's.
The price tag
Moynihan said the bank spent more than $200 million in the third quarter on fixing vulnerabilities and on measures tied to regulatory compliance. The report words this as one combined figure, so it does not say how the money divides between the two.
Management expects the spending on software remediation to shrink over time. The reasoning is simple enough: once the accumulated backlog of problems is cleared, there will be less to clear. Whether the backlog stays cleared is a question the report does not address.
Why Mythos matters here
Anthropic gave access to Mythos in April, but only to a limited circle of banks, technology companies and government bodies. After the model appeared, US banks began scanning their software systems.
The reported effect on speed is notable. Vulnerabilities whose repair could previously wait for weeks are now being fixed within days. The number of defects found ran into the thousands, though most were of low or moderate severity.
That last detail deserves a moment. Thousands of findings sounds alarming, and it is a workload, but the report says most were not the kind that keeps a security chief awake. The expense comes from volume, not from a series of catastrophes.
The compliance bill next door
The extra costs also relate to anti-money-laundering requirements. On the Tuesday before the report, the US Financial Crimes Enforcement Network (FinCEN) announced a $1.2 billion penalty against Bank of America for improperly reporting suspicious transactions.
The report places this fine alongside the remediation spending as part of the bank's compliance burden. It does not say that the fine is included in the $200 million figure, and it should not be read that way.
What to take from it
The story is a useful corrective to the idea that AI-driven security tools are a cost-saving device. At least in the first year, the tools produce work. A model that can surface thousands of flaws creates a queue, and a queue needs people.
The reported pattern, with a hiring wave in the second quarter, heavy spending in the third and a hope for lower costs later, looks like a one-time cleanup followed by a hoped-for plateau. That is management's expectation, not a result.
The faster fix times are the part worth watching. If a flaw that once sat for weeks now gets patched in days, the window in which attackers can exploit it narrows. The report offers no figures on how much, only the direction.
For a bank, in short, the arrival of a model that finds everything is wonderful news and also an invoice. Bank of America has chosen to pay it with 1,000 extra pairs of hands.