Bank of America has assigned 4,000 people to work on software vulnerabilities uncovered by AI models, including Anthropic's Mythos. The effort brings together 1,000 outside contractors and 3,000 internal employees, according to CEO Brian Moynihan.
A large team is tackling AI-identified vulnerabilities
The contractors have been working alongside the bank's employees since the second quarter. Their task is to fix software vulnerabilities identified by AI models, turning findings about security weaknesses into practical repair work.
The disclosure gives a rare view of the staffing involved when a large company responds to vulnerabilities found with AI. Bank of America is one of the first major US companies to say how many people it has assigned to this kind of patching work.
The cost covers more than patching
Moynihan said the bank spent a few hundred million dollars in the third quarter on software work and anti-money-laundering requirements combined. He did not break out how much of that spending went specifically to patching vulnerabilities.
That distinction matters when interpreting the figure: it describes two areas of work together, not a standalone price tag for responding to AI findings. Moynihan expects patching costs to come down over time, though the source does not give a timeline or estimate for that change.
AI security warnings have gained attention
Anthropic released Mythos in April to select partners through Project Glasswing. The company said the model had found thousands of serious security vulnerabilities. OpenAI followed in May with its Daybreak cybersecurity program.
At first, critics dismissed the AI labs' warnings and countermeasures as public relations. The debate has since shifted. Security incidents such as the Hugging Face hack, along with independent evaluations confirming stronger capabilities in new models, changed the conversation.
Finding flaws is only the start
AI systems can identify vulnerabilities, but organizations still need people to address them. Bank of America's staffing figures show the scale of its response: hundreds of contractors working with thousands of employees to carry out software work.
The bank's disclosure also points to a practical challenge for companies weighing AI-driven security findings. Identifying weaknesses can create a substantial repair workload, and the reported spending figure combines patching-related work with another requirement area. As Moynihan anticipates lower patching costs over time, the bank's current commitment offers a snapshot of the resources it has assigned so far.