Bank of America Mythos patches cost hundreds of millions
A large patching push after Anthropic’s Mythos flagged vulnerabilities shows how AI-driven tools are reshaping bank security and costs.
Talk With Tech Newsroom
The short version
Bank of America contracted roughly 1,000 external workers in the second quarter to fix vulnerabilities exposed by Anthropic’s Mythos AI security tool.
The effort adds to an already large security team and is described as costing hundreds of millions of dollars by CEO Brian Moynihan.
The move underscores a broader shift: AI-assisted vulnerability discovery is accelerating patch work for big banks, raising questions about budget and timelines.
Industry observers say Mythos-like tools can surface issues faster than teams can close them, prompting new staffing and policing approaches.
Quick read · 1 min
Bank of America hired about 1,000 external contractors in Q2 to patch software flaws found by Anthropic’s Mythos AI security tool. The move adds to an already large security team and costs it says run into the hundreds of millions.
Why it matters: AI-driven bug discovery is speeding up remediation, which can mean bigger short-term costs but potentially stronger protections in the long run. For customers, that can translate to steadier service and security, but also possible changes in fees or policies as banks absorb the cost of these new tools.
What’s next: The bank expects the patching push to ease as fixes land, with regulators watching how AI-enabled security work is financed and prioritized.
Bank of America has an unusually large security push underway, spurred by AI-driven findings. The bank disclosed that it enlisted about 1,000 external workers in the second quarter to repair vulnerabilities unearthed by Anthropic’s Mythos, an AI tool designed to identify security gaps in code. This surge sits alongside the bank’s existing security team and is described by CEO Brian Moynihan as costing “a couple hundred million dollars plus” and likely temporary as fixes roll out.
Mythos was introduced earlier this year as a controlled, advanced AI system that can autonomously spot weaknesses in software. Banks and a select group of users are granted access to test and act on its discoveries. When Mythos flags issues, companies face a wave of remediation work, from patching to tightening compliance controls, which can be expensive and time-consuming in large organizations.
The numbers reveal the scale: Moynihan said the bank already had about 3,000 people focused on patching before the contractor surge, and the new staff was brought in to speed up the process. He framed the spending as a temporary spike, with expectations that the workload will ease once the most critical fixes are in place.
Regulators and financial prosecutors have been keeping a close eye on AI-enabled risk and compliance, especially after civil penalties tied to anti-money-laundering lapses and other issues. The Mythos program, and the broader push to patch faster, highlight a shift in how banks manage cyber risk in an era where AI tools can surface problems more quickly than traditional teams can finish fixing them.
For everyday readers, this isn’t just a tech buzzword story. It signals that banks could pass along higher security and compliance costs to customers in the form of higher fees or tighter controls, at least in the near term. It also shows why you might see bigger delays or more alerts in the event of security incidents, as institutions lean on AI to shrink attack windows and hasten remediation.
What happens next? Moynihan said the additional contractor pace should slow as patches are completed. Banks watching Mythos and similar tools will be looking for clearer timelines, cost controls, and evidence that AI-driven findings don’t overwhelm human teams with work without clear priorities.
