Bank of America hired 1,000 outside contractors to help remediate software vulnerabilities identified by advanced AI models, including Anthropic’s Mythos, according to CNBC.
CEO Brian Moynihan said the contractors were brought in during the second quarter and continue working alongside approximately 3,000 existing employees.
The bank accelerated remediation of vulnerabilities in its internal software and third-party vendor code as AI models became more capable of discovering security weaknesses. Moynihan said software remediation and anti-money-laundering compliance efforts together added more than $200 million in third-quarter expenses.
The bank did not disclose how many vulnerabilities were identified or patched.
John Strand, Owner, Black Hills Information Security:
“What do you call a thousand outside contractors helping Bank of America remediate software vulnerabilities? A good start.
“That’s an infosec joke, but it also shows one way AI may actually contribute to job growth in computer security. Finding more vulnerabilities creates more work for the people who have to fix them.
“My bigger concern is the idea that finding and remediating vulnerabilities is going to be an Easter egg hunt. Find all the eggs, put them in the basket, and you’re done. Software doesn’t work that way. It’s constantly evolving, changing, and getting patched. New vulnerabilities and attack paths keep emerging. We’re not going to find everything, fix everything, and then have everything be fine. This is ongoing work.”
ㅤ
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“Bank of America’s 1,000 remediation contractors confirm what I have argued for a while now, the chokepoint has moved from finding vulnerabilities to fixing them. AI models like Anthropic’s Mythos can surface weaknesses faster than any bank can patch, so remediation capacity becomes the scarce resource, and Moynihan’s $200 million in added quarterly expenses puts a price tag on how scarce.
“Hiring that capacity this way creates its own exposure. A bank’s vulnerability inventory is effectively a targeting package, it maps exactly where the defenses are weak across internal software and third-party vendor code. Handing it to 1,000 outside contractors, roughly one contractor for every three existing security employees, distributes the bank’s most sensitive operational intelligence to people sitting outside its HR controls, monitoring, and enforcement chain. The bank can say the contractors follow the same security practices as employees, but without employee-grade endpoint logging and access oversight, the claim is unverifiable.
“I would want to know how long these contractors stay, what offboarding looks like, and who audits their access to live vulnerability data. The remediation backlog will shrink. Third-party risk like this outlasts every patch those 1,000 contractors ship.”
If AI created all this work, that’s not a good thing as all these bugs were out there. The real question is if the bad guys are using AI and for what for. Chances are that it was not anything good.
Related
This entry was posted on October 15, 2026 at 4:23 pm and is filed under Commentary with tags AI. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Bank Of America hires 1,000 contractors to patch software vulnerabilities exposed by AI
Bank of America hired 1,000 outside contractors to help remediate software vulnerabilities identified by advanced AI models, including Anthropic’s Mythos, according to CNBC.
CEO Brian Moynihan said the contractors were brought in during the second quarter and continue working alongside approximately 3,000 existing employees.
The bank accelerated remediation of vulnerabilities in its internal software and third-party vendor code as AI models became more capable of discovering security weaknesses. Moynihan said software remediation and anti-money-laundering compliance efforts together added more than $200 million in third-quarter expenses.
The bank did not disclose how many vulnerabilities were identified or patched.
John Strand, Owner, Black Hills Information Security:
“What do you call a thousand outside contractors helping Bank of America remediate software vulnerabilities? A good start.
“That’s an infosec joke, but it also shows one way AI may actually contribute to job growth in computer security. Finding more vulnerabilities creates more work for the people who have to fix them.
“My bigger concern is the idea that finding and remediating vulnerabilities is going to be an Easter egg hunt. Find all the eggs, put them in the basket, and you’re done. Software doesn’t work that way. It’s constantly evolving, changing, and getting patched. New vulnerabilities and attack paths keep emerging. We’re not going to find everything, fix everything, and then have everything be fine. This is ongoing work.”
ㅤ
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“Bank of America’s 1,000 remediation contractors confirm what I have argued for a while now, the chokepoint has moved from finding vulnerabilities to fixing them. AI models like Anthropic’s Mythos can surface weaknesses faster than any bank can patch, so remediation capacity becomes the scarce resource, and Moynihan’s $200 million in added quarterly expenses puts a price tag on how scarce.
“Hiring that capacity this way creates its own exposure. A bank’s vulnerability inventory is effectively a targeting package, it maps exactly where the defenses are weak across internal software and third-party vendor code. Handing it to 1,000 outside contractors, roughly one contractor for every three existing security employees, distributes the bank’s most sensitive operational intelligence to people sitting outside its HR controls, monitoring, and enforcement chain. The bank can say the contractors follow the same security practices as employees, but without employee-grade endpoint logging and access oversight, the claim is unverifiable.
“I would want to know how long these contractors stay, what offboarding looks like, and who audits their access to live vulnerability data. The remediation backlog will shrink. Third-party risk like this outlasts every patch those 1,000 contractors ship.”
If AI created all this work, that’s not a good thing as all these bugs were out there. The real question is if the bad guys are using AI and for what for. Chances are that it was not anything good.
Share this:
Like this:
Related
This entry was posted on October 15, 2026 at 4:23 pm and is filed under Commentary with tags AI. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.