Glonce

Bank of America puts 4,000 people on fixing vulnerabilities found by AI models like Anthropic's Mythos

securityThe Glonce editorsThe Decoder🔥52Glonce rating52Impact50Novelty40Relevance70Surprise35Players50Credibility75
Bank of America puts 4,000 people on fixing vulnerabilities found by AI models like Anthropic's Mythos

Bank of America has hired 1,000 outside contractors to fix software vulnerabilities uncovered by AI models like Anthropic's Mythos, CNBC reports, in an account relayed by The Decoder. According to CEO Brian Moynihan, the contractors have been working alongside 3,000 internal employees since the second quarter. That makes 4,000 people assigned to the job.

On cost, Moynihan said the bank spent a few hundred million dollars in the third quarter on the software work and on anti-money-laundering requirements combined. He did not give a separate figure for patching alone. He expects patching costs to come down over time.

The article sets this against the wider context. In April, Anthropic released Mythos only to select partners through Project Glasswing and said the model had found thousands of serious security vulnerabilities. OpenAI followed in May with its Daybreak cybersecurity program. Critics initially dismissed the labs' warnings and countermeasures as PR, but the debate has since shifted. Security incidents like the Hugging Face hack changed the conversation, along with independent evaluations that confirmed the new models' stronger capabilities.

The Decoder describes Bank of America as one of the first major US companies to disclose how many people it has assigned to fixing vulnerabilities that AI found.

Key facts

  • Bank of America has hired 1,000 outside contractors to fix software vulnerabilities uncovered by AI models like Anthropic's Mythos, per CNBC.
  • The contractors have worked alongside 3,000 internal employees since the second quarter, according to CEO Brian Moynihan, so 4,000 people in total.
  • The bank spent a few hundred million dollars in the third quarter on the software work and anti-money-laundering requirements combined; no separate figure for patching alone was given.
  • Moynihan expects patching costs to come down over time.
  • Bank of America is one of the first major US companies to disclose how many people it has assigned to fixing vulnerabilities that AI found.

Why it matters

Until now the debate was largely about what AI models could find. This story is about what happens afterward: someone has to fix the flaws. Bank of America's disclosure puts a headcount on that work, 1,000 contractors plus 3,000 internal employees, and the article calls the bank one of the first major US companies to say how many people it has assigned. The article also notes that critics first dismissed the labs' warnings and countermeasures as PR, and that the debate has since shifted after incidents like the Hugging Face hack and independent evaluations confirming the new models' stronger capabilities. In April, Anthropic said Mythos had found thousands of serious security vulnerabilities, and OpenAI followed in May with its Daybreak cybersecurity program.

Who it affects

Most directly, Bank of America's engineering and security staff and the contractors brought in to work beside them. By the article's framing, other large US companies are the next audience: Bank of America is one of the first to disclose such numbers, which suggests others may be dealing with the same workload. The article also touches the labs, Anthropic and OpenAI, whose vulnerability-finding models and programs are the source of the findings.

How to use it

There is nothing to install, buy or configure here; this is a disclosure, not a product. The practical reading is about scale: a large bank assigned 4,000 people, split between 1,000 hired contractors and 3,000 internal employees, to remediate flaws that AI models surfaced. For context, the article says Anthropic released Mythos only to select partners through Project Glasswing, and that OpenAI launched its Daybreak cybersecurity program in May.

How solid is it

The figures come from CEO Brian Moynihan, as reported by CNBC and relayed by The Decoder, so this is a secondhand account. The article paraphrases Moynihan; no direct quotation from him is given. The headcounts are stated plainly: 1,000 contractors and 3,000 internal employees since the second quarter. The spending figure is looser: a few hundred million dollars in the third quarter, covering the software work and anti-money-laundering requirements together. No year is given for the April and May events or the quarters.

Risks and caveats

Do not read the spending figure as the cost of patching. It combines the software work with anti-money-laundering requirements, and Moynihan gave no separate figure for patching alone. The article does not say how many vulnerabilities Bank of America itself has found or fixed, and does not say which AI models besides Mythos uncovered the vulnerabilities at the bank. It does not say that Bank of America has access to Mythos itself. No details of the Hugging Face hack are given. Moynihan expects patching costs to fall over time, but no timescale or amount is given for that decline.