Bank of America Adds 1,000 Contractors to Patch Flaws Found by Mythos AI
Bank of America added 1,000 contractors to fix flaws found by Mythos AI. What it means for LatAm banks and fintechs weighing AI in security.
Bank of America added 1,000 external contractors in the second quarter of 2026 to fix software vulnerabilities detected by frontier artificial intelligence models, including Anthropic's Mythos, and those technicians are still working at the bank. CEO Brian Moynihan said on the October 14 earnings call that the figure comes on top of roughly 3,000 internal technical employees.
Moynihan spoke during the third-quarter earnings presentation, reported by CNBC that same day and picked up by The Register on October 15. Anthropic released Mythos in April to a limited group of banks, tech companies and government agencies, according to CNBC. According to PYMNTS, which cites a Reuters report, the institutions with access are patching in days rather than weeks, and they share findings with smaller banks that lack the tool. The question for Mexico is whether local banks and fintechs will join the group with access or whether they will depend on what the institutions that already have it choose to share.
In the same quarter, the company reported around 130 internal AI projects, with expected savings of 300 million dollars in 2026 and close to 700 million by the end of 2027, according to CNBC. In parallel, headcount fell by about 3,400 people over a year, including 5% of managers, and the bank did not specify how much of that reduction corresponds to AI, according to The Register. Remediation spending was mixed in with anti-money-laundering compliance: Moynihan described the quarterly total as "a couple of hundred million plus" and did not break down how much went to each item. On the timeline, he added: "Once you patch, you don't have to patch as much". Anthropic said in May that Mythos found more than 10,000 vulnerabilities across 50 partner organizations, according to PYMNTS.
For a bank or fintech evaluating AI for security auditing, the data point leaves open the question of how many person-hours it takes to remediate what the model finds: detection accelerates, repair remains human work. There is also the question of what reaches the rest of the market when the tool is distributed among only a few players.
This article was drafted with the assistance of artificial intelligence from verified sources and reviewed by a human editor before publication.