Bank of America put 1,000 contractors on patching software flaws exposed by advanced AI models, including Anthropic's Mythos, and they are still there, CEO Brian Moynihan told CNBC in an interview on Oct. 14. CNBC calls it among the first company figures on what defending against these models costs.

At a glance

The staffing and spending figures come from CNBC's reporting. Moynihan told CNBC in an interview that the bank added 1,000 contractors in the second quarter, that they are still working, and that they sit on top of about 3,000 bank staff in that area.

On the earnings call, Moynihan told analysts the bank spent a "couple hundred million plus" in the third quarter on software remediation and anti-money-laundering (AML) compliance issues combined, according to CNBC. CNBC reports he expects remediation costs to decline, saying: "Once you patch, you don't have to patch as much."

Bank of America's written third-quarter release has no line for software remediation and does not mention Mythos.

What is confirmed

Bank of America's release says the bank had $19.7 billion of noninterest expense, including a $1.2 billion charge for civil penalties from OCC and FinCEN AML orders announced Oct. 13. That is a penalty accrual, a different item from the remediation spending Moynihan described, and the release has no remediation line.

The contractor and remediation figures are Moynihan's claims as reported by CNBC. CNBC also reports that shares fell as much as 8% that day. It does not tie the drop to Mythos.

What Mythos is

Anthropic's Project Glasswing page describes Claude Mythos Preview as an unreleased, general-purpose frontier model. Anthropic says it has found thousands of high-severity vulnerabilities, including some in every major operating system and web browser.

On Apr. 7, Anthropic named launch partners including AWS, Apple, Cisco, Google, JPMorganChase, Microsoft and NVIDIA, plus over 40 more organizations. That page does not name Bank of America. CNBC says Mythos went to a small group of banks, tech firms and government agencies in April.

Why a model that finds old flaws forces a patch rush

Anthropic says many software flaws go unnoticed for years because finding them took rare expertise. With the latest models, it says, "the cost, effort, and level of expertise required to find and exploit software vulnerabilities have all dropped dramatically."

Anthropic's examples are a 27-year-old OpenBSD flaw and a 16-year-old FFmpeg flaw, both since patched. Once old bugs are cheap to find, a company has to fix its own code and its vendors' code before someone else finds them. Moynihan said, as CNBC reports, that the bank rushed to do that.

Why it matters

The bill lands on ordinary software users, not only on AI labs. A bank that already had about 3,000 people in this work still added 1,000 more, according to CNBC, and CNBC frames AI as cutting costs in one place while forcing a costly defensive scramble in another.

On the savings side, Moynihan told analysts, according to CNBC, that the bank's roughly 130 internal AI projects should save $300 million this year and $700 million in 2027. CNBC reports head count fell by about 3,400 in a year and says it is unclear how much of that is AI.

What to do

Nothing in CNBC's report describes a breach or says customers must act. For your own devices, keep software updated. CISA's guidance is plain:

  • Install updates as soon as possible. CISA says attackers may target flaws for months or even years after a fix exists.
  • Turn on automatic updates where offered, for your phone, computer, browser and banking app.
  • Take updates only from the vendor's own site or app store, never from an email link.

Our look at Anthropic's AI-worm report covers the same habit for routers and smart devices.