Bank of America still has 1,000 contractors patching flaws that AI models exposed
Bank of America CEO Brian Moynihan said 1,000 contractors hired in the second quarter to patch AI-exposed software flaws remain, on top of 3,000 staff. The headcount can anchor a budget; the dollar figure released with it cannot.
The Investor · Invest desk
Three figures: one quarter's remediation and anti-money laundering spend, taken as $200 million from 'a couple hundred million'; AI savings expected this year, $300 million; about 130 internal AI projects behind those savings.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Remediation and AML spend, one quarter, taken as | $200 million | From 'a couple hundred million' | 13 |
| AI savings expected this year | $300 million | Moynihan told analysts | 8 |
| Internal AI projects, about | 130 projects | 8 |
What happened
- Moynihan told analysts the bank spent a "couple hundred million plus" in the third quarter on software remediation and regulatory issues tied to anti-money laundering compliance.
- CNBC called the comments some of the first from a major U.S. corporation to put manpower and dollar figures on defending software against Mythos.
- Mythos reached only a small group of banks, technology firms and government agencies when it was released in April.
- Separately, the bank expects savings from about 130 internal AI projects to rise from $300 million this year to $700 million in 2027.
- CNBC reported that Moynihan sought to reassure investors the spending increase was temporary while the bank's shares fell as much as 8% on Wednesday.
Why it matters
- cost At $200 million, one quarter of the combined spend equals 67% of the $300 million the bank expects its AI projects to save this year, so the defensive bill lands before the savings do.
- constraint The bank did not split remediation from anti-money laundering costs, so no outside firm can turn the quarter's total into a per-contractor cost. The 1,000-on-3,000 staffing ratio is the only portable number.
- contradiction Moynihan forecasts falling costs, but contractors hired in the second quarter were still on the job when third-quarter results came out, so the decline remains a forecast.
Moynihan's forecast is that the bill fades. "Once you patch, you don't have to patch as much. ... The pipeline moves through," he said, adding that the bank expects remediation costs to decline over time [9]. That can go three ways. The pipeline empties on his schedule. Or it refills, because Mythos is still confined to vetted cybersecurity and research users [4] after an April release to a small group of institutions [3], and a wider release could send a new round of findings into code the bank has already worked through. Or remediation is already the smaller part of the combined figure, in which case the cost that fades is small too.
We think the second is the one to budget for. Cryptobriefing reported that one scan alone flagged more than 23,000 potential issues, most rated low to moderate severity [11]; each item may be cheap, but 23,000 of them is a long queue, and the outlet did not say which participant's scan that was.
The staffing figure is the part a planner can lift. "We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area," Moynihan told CNBC [1]. That adds a third to the team, 4,000 people in all [6].
He also named the dependency under the spending. "We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services," he said [5].
We would be wrong if the 1,000 contractors have gone by the next earnings call and the combined line has fallen with them.
What to watch
- Whether Bank of America reports remediation separately from anti-money laundering costs on its next quarterly call.
- Any widening of Mythos access beyond vetted cybersecurity and research users.
- Whether other large banks publish contractor headcount or dollar figures for AI-driven patching.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+22
- Incentives55
- Confidence64
Perspective Coverage
4 publishers- Builder
- Builder 18%
- Operator
- Operator 42%
- Investor
- Investor 40%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Moynihan told CNBC: "We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area," he said.
- [2]
The bank spent a "couple hundred million plus" on software remediation and regulatory issues related to anti-money laundering compliance in the third quarter, Moynihan told analysts earlier Wednesday.
- [3]
Mythos was released to a small group of banks, technology firms and government agencies in April.
- [4]
As of October 2026, Mythos versions remain available only to vetted cybersecurity and research users through controlled programs.
- [5]
Moynihan said: "We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services."
- [6]
The 1,000 contractors add a third to the existing 3,000-person team, making 4,000 people in all.
- [7]
Contractors hired in the second quarter were still working when third-quarter results were released, so the engagement spans at least two quarters.
- [8]
Bank of America has about 130 internal AI projects, and savings from those efforts are expected to rise from $300 million this year to $700 million in 2027, Moynihan told analysts.
- [9]
Moynihan said, "Once you patch, you don't have to patch as much. ... The pipeline moves through," and added that the bank expects remediation costs to decline over time.
- [10]
CNBC reported that Moynihan, speaking as the company's shares slumped as much as 8% Wednesday, sought to reassure investors that the spending increase was temporary.
- [11]
One scan alone flagged more than 23,000 potential issues, and most findings were rated low to moderate severity, though broader testing also surfaced some critical flaws.
- [12]
CNBC reported that the comments are some of the first by a major U.S. corporation to specify the manpower and dollars spent to protect software systems from Mythos.
- [13]
Taking "a couple hundred million" as $200 million, one quarter of combined remediation and AML spend equals about 67% of the $300 million in AI savings expected this year.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- cnbc.comBank of America hired 1,000 contractors to patch software flaws exposed by Anthropic's Mythos
1 article · October 14, 2026
- cryptobriefing.comBank of America hires 1,000 contractors to patch flaws exposed by Anthropic’s Mythos
1 article · October 14, 2026
- qz.comBank of America hired 1,000 contractors to patch software flaws exposed by AI
1 article · October 14, 2026
- runtimewire.comBank of America added 1,000 contractors to patch AI-exposed software flaws
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Frontier AI modelsFollow
- Bank cybersecurityFollow
- AI vulnerability remediationFollow